{"categories":{"breach":{"changes":"https://helix.ml/threat-watch/c/breach/changes.json","description":"Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer.","incidents":987,"json":"https://helix.ml/threat-watch/c/breach/feed.json","label":"Breaches","live":5,"llms":"https://helix.ml/threat-watch/c/breach/llms.txt","page":"https://helix.ml/threat-watch?c=breach","rss":"https://helix.ml/threat-watch/c/breach/feed.xml"},"patch":{"changes":"https://helix.ml/threat-watch/c/patch/changes.json","description":"Flaws in software you may run — which versions are affected, the fixed release, and what to do first.","incidents":1785,"json":"https://helix.ml/threat-watch/c/patch/feed.json","label":"Vulnerabilities","live":39,"llms":"https://helix.ml/threat-watch/c/patch/llms.txt","page":"https://helix.ml/threat-watch?c=patch","rss":"https://helix.ml/threat-watch/c/patch/feed.xml"},"supply-chain":{"changes":"https://helix.ml/threat-watch/c/supply-chain/changes.json","description":"Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust.","incidents":7,"json":"https://helix.ml/threat-watch/c/supply-chain/feed.json","label":"Supply chain","live":4,"llms":"https://helix.ml/threat-watch/c/supply-chain/llms.txt","page":"https://helix.ml/threat-watch?c=supply-chain","rss":"https://helix.ml/threat-watch/c/supply-chain/feed.xml"}},"generatedAt":"2026-10-25T11:12:49Z","incidents":[{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-109618","CVE-2026-109619","CVE-2026-115560"],"exploited":"in-the-wild","identifiers":["CVE-2026-109618","CVE-2026-109619","CVE-2026-115560","GHSA-6wmf-4rv5-p3rp","GHSA-w8hw-w9fx-j79w"],"json":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619.json","latestUpdate":{"date":"2026-10-25","title":"Wiz publishes analysis of PHP2Shell: AI-uncovered critical PHP engine RCE and Heartbleed-style memory disclosure affecting ~70% of the Internet"},"patchStatus":"partial","product":"PHP runtime (affecting Cisco products, WordPress hosts, and any PHP deployments)","severity":"critical","severityNote":"Cisco rates Critical; RCE via OOM corruption and stale global state; attacks observed in the wild but no confirmed compromises yet","slug":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","stacks":["php","wordpress","hosting","network","devtools"],"startedAt":"2026-10-21","status":"live","summary":"On 2026-10-21 the PHP Foundation released emergency updates for two critical RCE vulnerabilities, CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), collectively tracked as PHP2Shell (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Attacks against the flaws are ongoing; Wordfence, which protects over 5 million WordPress sites, reports no confirmed compromises yet, suggesting complex exploitation. Cisco issued a Critical advisory listing affected products (e.g., Ultra-Reliable Wireless Backhaul, Expressway, Duo Access Gateway) with fixes pending or scheduled (e.g., URWB 27.1.1 in Feb 2027, Expressway 15.5.21), workarounds in bug trackers, and many products confirmed not vulnerable. Community backported patches exist for EOL PHP 5.4-5.6. All organisations running PHP should patch immediately.","tags":["rce","php","php2shell","memory-corruption","exploited-in-the-wild","critical"],"title":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","updatedAt":"2026-10-25T11:06:38Z","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","vendor":"PHP Foundation / Cisco / Wordfence / Aikido"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-20011","CVE-2026-20043","CVE-2026-20218","CVE-2026-20221","CVE-2026-20236","CVE-2026-20291","CVE-2026-20356","CVE-2026-76445","CVE-2026-76524"],"exploited":"none-known","identifiers":["CVE-2026-20011","CVE-2026-20043","CVE-2026-20218","CVE-2026-20221","CVE-2026-20236","CVE-2026-20291","CVE-2026-20356","CVE-2026-76445","CVE-2026-76524"],"json":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl.json","latestUpdate":{"date":"2026-10-25","title":"Open Source Snort 3 control channel socket allows low-privilege local arbitrary command execution (CVE-2026-76524)"},"patchStatus":"patched","product":"Snort 3 (integrated in Cisco CDFW, Cyber Vision, Meraki MX, Secure Access, Secure FTD, UTD on IOS XE)","severity":"critical","severityNote":"Max CVSS 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); found in internal testing, not known to be actively exploited; affects Snort 3 across Cisco CDFW, Cyber Vision, Meraki MX, Secure Access, Secure FTD and UTD on IOS XE","slug":"cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","stacks":["network","cloud"],"startedAt":"2026-10-21","status":"live","summary":"Cisco's Snort 3 engineering team completed an internal security review and released hardening updates addressing multiple internally discovered vulnerabilities, grouped by CWE with one CVE per class: CVE-2026-20043 (out-of-bounds write, CWE-787), CVE-2026-20236 (incorrect calculation, CWE-682), CVE-2026-20291 (improper privilege management, CWE-269) and CVE-2026-20356 (uncontrolled resource consumption, CWE-400), with a maximum CVSS of 9.0. Affected products include Cisco Cloud-delivered Firewall, Cyber Vision, Meraki MX, Secure Access, Secure Firewall Threat Defense and UTD on IOS XE; Snort 2 is not affected. The flaws were found in internal testing and are not known to be exploited. Snort 3.12.4.0, Cyber Vision 5.6.0 and various FTD releases contain fixes; CDFW, CSA and Meraki instances were updated automatically on 2026-10-21. No workarounds exist.","tags":["out-of-bounds-write","privilege-escalation","dos","ips","hardening","memory-corruption"],"title":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","updatedAt":"2026-10-25T11:06:22Z","url":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-76435","CVE-2026-76466","CVE-2026-76490","CVE-2026-76491","CVE-2026-76492","CVE-2026-76493","CVE-2026-76494","CVE-2026-76495","CVE-2026-76496","CVE-2026-76497"],"exploited":"none-known","identifiers":["CVE-2026-76435","CVE-2026-76466","CVE-2026-76490","CVE-2026-76491","CVE-2026-76492","CVE-2026-76493","CVE-2026-76494","CVE-2026-76495","CVE-2026-76496","CVE-2026-76497"],"json":"https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466.json","latestUpdate":{"date":"2026-10-25","title":"Cisco Expressway Series hardening batch adds unauthenticated information disclosure via MRA provisioning (CVE-2026-76435)"},"patchStatus":"patched","product":"Cisco Expressway-C and Expressway-E (virtual and appliance)","severity":"critical","severityNote":"CVSS 9.8 (CVE-2026-76466); no known exploitation; affects clustered Expressway-C/E devices","slug":"cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466","stacks":["network","vpn"],"startedAt":"2026-10-21","status":"live","summary":"Cisco published advisories on 2026-10-21 for Cisco Expressway Series (Expressway-C/E). CVE-2026-76466 (CVSS 9.8, CWE-798) is a critical unauthenticated remote RCE: use of persistent cookies plus insufficient client-certificate validation in clustering lets an attacker with network access connect to the database service and invoke RPC commands to execute arbitrary OS commands as root. It affects devices running X15.5.3 or earlier when configured in a cluster; no workarounds exist. A companion hardening advisory (cisco-sa-exwy-hardening-FhcqBVcs, max CVSS 8.6) fixes eight internally discovered issues (CVE-2026-76490 through -76497) covering out-of-bounds write, reachable assertions, null derefs, code injection, link following, insecure temp files and permission flaws, found partly using frontier AI models. Neither is known to be exploited. Fixed in X15.5.20; X14 and earlier must migrate.","tags":["rce","static-credentials","hardcoded-credentials","certificate-validation","root","cisco-expressway","hardening","memory-corruption"],"title":"Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)","updatedAt":"2026-10-25T11:06:12Z","url":"https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466","vendor":"Cisco"},{"auto":true,"category":"supply-chain","closedAt":null,"cveIds":[],"exploited":"unknown","identifiers":["GHSA-4fw4-xm5r-mh69","GHSA-5f99-52fc-5rc9","GHSA-5pw8-3xv5-6cmg","GHSA-5xjv-xr86-9hrv","GHSA-65qr-q8w8-4q7r","GHSA-7mfw-r26v-9r9f","GHSA-9w8h-674f-4x2j","GHSA-fr38-45mf-vcqf","GHSA-g89m-8c48-9x73","GHSA-j8vh-32vh-rj39","GHSA-v2r2-x76j-6fcx","GHSA-wwj3-4v8w-w98j"],"json":"https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware.json","latestUpdate":{"date":"2026-10-25","title":"Typosquat malware cluster expands with new packages: insta-reel-search, ionic-tiktok-scraper, ionic-sound-cloud-loader-api, sound-cloud-loader-api, insta-api-wrapper"},"patchStatus":"no-fix-needed","product":"appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search, appit-cordova-admob (npm)","severity":"critical","severityNote":"No CVSS stated; GitHub marks critical malware, all versions affected, no patched versions; reach unknown","slug":"npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware","stacks":["npm","node","devtools","android","ios"],"startedAt":"2026-10-25","status":"live","summary":"On 2026-10-25 GitHub published four malware advisories (GHSA-fr38-45mf-vcqf, GHSA-5pw8-3xv5-6cmg, GHSA-4fw4-xm5r-mh69, GHSA-9w8h-674f-4x2j) covering npm packages appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search and appit-cordova-admob. All versions (\u003e= 0) are affected, CWE-506 embedded malicious code, no patched versions exist. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential/key theft and remote control by an outside party. The names mimic legitimate Cordova/Ionic plugins, suggesting a typosquatting or account-compromise campaign targeting Ionic/Cordova developers. No exploitation details or fixed versions are available; removal alone may not eliminate the compromise.","tags":["malicious-package","typosquat","credential-theft","supply-chain","cwe-506"],"title":"npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware","updatedAt":"2026-10-25T11:06:12Z","url":"https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware","vendor":"unknown (typosquat-style npm packages)"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-76473","CVE-2026-76474","CVE-2026-76475","CVE-2026-76476","CVE-2026-76477","CVE-2026-76478","CVE-2026-76479","CVE-2026-76481","CVE-2026-76487"],"exploited":"none-known","identifiers":["CVE-2026-76473","CVE-2026-76474","CVE-2026-76475","CVE-2026-76476","CVE-2026-76477","CVE-2026-76478","CVE-2026-76479","CVE-2026-76481","CVE-2026-76487"],"json":"https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo.json","latestUpdate":{"date":"2026-10-25","title":"October 2026 UC hardening release also fixes Unified CM/Unified CM SME improper access control flaw (CVE-2026-76487)"},"patchStatus":"patched","product":"Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM\u0026P, Unified CM SME, Unity Connection","severity":"critical","severityNote":"Max CVSS 9.8 (CVE-2026-76473, CVE-2026-76474); found in internal testing, no known exploitation; affects all configurations of six products","slug":"cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo","stacks":["network","linux"],"startedAt":"2026-10-21","status":"live","summary":"Cisco published a critical hardening release on 2026-10-21 addressing multiple internally discovered vulnerabilities across Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM\u0026P, Unified CM SME, and Unity Connection. Issues are grouped by CWE into eight CVEs (CVE-2026-76473 through CVE-2026-76481) covering injection (CWE-74, max 9.8), improper authentication (CWE-287, 9.8), XSS (9.3), input validation, SQL injection, access control (all 8.8), path traversal (7.8), and exceptional-condition handling (7.5). Vulnerabilities affect the products regardless of configuration, were found during internal testing including use of frontier AI models, and are not known to be exploited. No workarounds exist; fixed software is available — release 15SU5, while release 14 users must migrate to a fixed release.","tags":["auth-bypass","sql-injection","xss","path-traversal","access-control","input-validation","voice","hardening"],"title":"Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)","updatedAt":"2026-10-25T11:06:06Z","url":"https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-76519"],"exploited":"in-the-wild","identifiers":["CVE-2026-76519"],"json":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76519.json","latestUpdate":{"date":"2026-10-25","title":"Cisco publishes dedicated advisory for Secure Email Gateway arbitrary file write via AMP attachment handling (CVE-2026-76519)"},"patchStatus":"unknown","product":"Secure Email Gateway","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-email-gateway-cve-2026-76519","stacks":["network"],"startedAt":"2026-10-14","status":"live","summary":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog on Oct 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-23"],"title":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519)","updatedAt":"2026-10-25T11:05:20Z","url":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76519","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-100104","CVE-2026-100755","CVE-2026-101168","CVE-2026-103515","CVE-2026-103549","CVE-2026-104661","CVE-2026-105458","CVE-2026-105711","CVE-2026-105777","CVE-2026-110264","CVE-2026-112212","CVE-2026-112326","CVE-2026-112378","CVE-2026-12664","CVE-2026-13319","CVE-2026-14210","CVE-2026-14288","CVE-2026-14552","CVE-2026-14814","CVE-2026-15723","CVE-2026-16255","CVE-2026-16275","CVE-2026-16301","CVE-2026-5954","CVE-2026-6567","CVE-2026-7767","CVE-2026-78335","CVE-2026-81839","CVE-2026-82632","CVE-2026-84284","CVE-2026-85529","CVE-2026-89078","CVE-2026-92528","CVE-2026-9268","CVE-2026-92883","CVE-2026-93577","CVE-2026-96893","CVE-2026-97229"],"exploited":"none-known","identifiers":["CVE-2026-100104","CVE-2026-100755","CVE-2026-101168","CVE-2026-103515","CVE-2026-103549","CVE-2026-104661","CVE-2026-105458","CVE-2026-105711","CVE-2026-105777","CVE-2026-110264","CVE-2026-112212","CVE-2026-112326","CVE-2026-112378","CVE-2026-12664","CVE-2026-13319","CVE-2026-14210","CVE-2026-14288","CVE-2026-14552","CVE-2026-14814","CVE-2026-15723","CVE-2026-16255","CVE-2026-16275","CVE-2026-16301","CVE-2026-5954","CVE-2026-6567","CVE-2026-7767","CVE-2026-78335","CVE-2026-81839","CVE-2026-82632","CVE-2026-84284","CVE-2026-85529","CVE-2026-89078","CVE-2026-92528","CVE-2026-9268","CVE-2026-92883","CVE-2026-93577","CVE-2026-96893","CVE-2026-97229"],"json":"https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264.json","latestUpdate":{"date":"2026-10-25","title":"GitLab critical patch release 19.5.1/19.4.3/19.3.6/19.2.9/19.1.9/19.0.10/18.11.13 includes fixes for CVE-2026-110264 and CVE-2026-112212"},"patchStatus":"patched","product":"GitLab (self-managed) / Ruby Onigmo regex engine","severity":"critical","severityNote":"CVSS 10.0, unauthenticated RCE on self-managed instances; no known exploitation or CISA KEV listing as of Oct 22-23; affects every GitLab version since 7.0 (2014)","slug":"gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","stacks":["ruby","devtools","github-actions"],"startedAt":"2026-10-21","status":"live","summary":"GitLab patched CVE-2026-110264 (CVSS 10.0), an unauthenticated RCE caused by an integer overflow in Ruby's Onigmo regex compiler, which GitLab bundles and ships. It affects every self-managed GitLab version since 7.0 (2014); the Oct 12 fix for the earlier CVE-2026-97229 covered only 19.2+, so instances patched then are vulnerable again. It is the fourth Onigmo RCE reported by researcher joaxcar in a month (two 9.9 auth-required, two 10.0 unauthenticated). Ruby released 4.0.9, 3.4.12, and 3.3.13 fixing three underlying bugs; Ruby 3.2 and earlier get no fix. No exploitation or CISA KEV listing as of Oct 23; no workaround exists. GitLab also fixed 10 other issues including an 8.2 account-takeover and a 7.5 OAuth/OIDC cache-poisoning flaw.","tags":["rce","regex-engine","integer-overflow","unauthenticated","patch","backport"],"title":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","updatedAt":"2026-10-25T11:05:09Z","url":"https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","vendor":"GitLab / Ruby"},{"auto":true,"category":"supply-chain","closedAt":null,"cveIds":["CVE-2026-111943","CVE-2026-113470","CVE-2026-115557","CVE-2026-115570"],"exploited":"none-known","identifiers":["CVE-2026-111943","CVE-2026-113470","CVE-2026-115557","CVE-2026-115570","GHSA-jr5w-w6x2-84p9"],"json":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570.json","latestUpdate":{"date":"2026-10-25","title":"Guidance published for Python/pip/CI-CD users on compromised eMudhra intermediate CA keys"},"patchStatus":"patched","product":"Electron","severity":"high","severityNote":"CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N); EPSS 0.478%; no known in-the-wild exploitation; affects apps making TLS connections over interceptable networks","slug":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","stacks":["npm","node","devtools"],"startedAt":"2026-10-22","status":"live","summary":"A set of eMudhra intermediate CA certificates was compromised and is being blocked by browsers and other TLS clients. Electron releases before the patched versions did not block these intermediates in either Chromium networking or Node.js tls/https/fetch, so an attacker holding a certificate issued via the compromised intermediates and able to intercept network traffic (e.g. on-path/MitM) could impersonate a TLS server to an Electron app. Only apps making TLS network connections are affected; offline apps are not. Go (CVE-2026-111943) and Firefox (CVE-2026-113470) shipped the same mitigation. There are no app-side workarounds; fixed releases are 45.0.0-beta.6, 44.9.1, 43.8.1 and 42.11.16, published 2026-10-22/23.","tags":["tls","mitm","certificate-revocation","ca-compromise","supply-chain"],"title":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","updatedAt":"2026-10-25T10:31:28Z","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","vendor":"Electron project"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-102764"],"exploited":"in-the-wild","identifiers":["CVE-2026-102764"],"json":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764.json","latestUpdate":{"date":"2026-10-25","title":"BeyondTrust Remote Support CVE-2026-102764 zero-day reported under active exploitation"},"patchStatus":"unknown","product":"Remote Support","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"beyondtrust-remote-support-cve-2026-102764","stacks":["rust"],"startedAt":"2026-10-16","status":"live","summary":"BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on Oct 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-290"],"title":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)","updatedAt":"2026-10-25T10:31:07Z","url":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764","vendor":"BeyondTrust"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-104935"],"exploited":"in-the-wild","identifiers":["CVE-2026-104935"],"json":"https://helix.ml/threat-watch/i/ivanti-connect-secure-cve-2026-104935.json","latestUpdate":{"date":"2026-10-25","title":"Ivanti ICS CVE-2026-104935 authentication bypass/RCE zero-day under active exploitation after partial July patch"},"patchStatus":"unknown","product":"Connect Secure","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-connect-secure-cve-2026-104935","stacks":["vpn"],"startedAt":"2026-10-13","status":"live","summary":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on Oct 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-290"],"title":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935)","updatedAt":"2026-10-25T10:30:08Z","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-cve-2026-104935","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-112393","CVE-2026-112398","CVE-2026-112403","CVE-2026-112900"],"exploited":"none-known","identifiers":["CVE-2026-112393","CVE-2026-112398","CVE-2026-112403","CVE-2026-112900","GHSA-5x8w-8jj5-q52h"],"json":"https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20.json","latestUpdate":{"date":"2026-10-25","title":"New Pillow heap buffer overflow in FlashPix (FPX) JPEG-tile decoding enables code execution via crafted image files (CVE-2026-112398)"},"patchStatus":"patched","product":"Pillow (Python imaging library)","severity":"critical","severityNote":"CVE records score 9.2/10 (critical); maintainers rate moderate-to-critical; no known exploitation, public PoC for TIFF flaw; ~436M monthly downloads","slug":"pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20","stacks":["python","pypi","ai","devtools"],"startedAt":"2026-10-16","status":"live","summary":"Pillow, the most widely used Python image library (~436M downloads/month), fixed a batch of vulnerabilities in version 13.0.0 released 2026-10-16. The headline flaw, CVE-2026-112900, lets an attacker run OS commands by controlling the filename of an EPS image, which Pillow passes unvalidated to Ghostscript; it affects versions 2.6.0–12.3.0 and only hosts with the gs binary installed. Two maintainer-critical fixes cover a stale-image-data memory bug and JPEG decoding overflows, including an FPX flaw enabling RCE from a single Image.open() call when olefile is installed, and CVE-2026-112403, a lossless-JPEG thumbnail buffer overflow. CVE-2026-112393, present since 2013, overflows a buffer when saving compressed TIFFs to in-memory buffers. No exploitation is known; a public PoC exists for the TIFF flaw. One JPEG flaw was found by Anthropic using Claude and validated by Ada Logics.","tags":["rce","buffer-overflow","image-parsing","filename-injection","ghostscript","memory-corruption"],"title":"Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)","updatedAt":"2026-10-25T09:55:01Z","url":"https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20","vendor":"Pillow"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-0322"],"exploited":"in-the-wild","identifiers":["CVE-2026-0322"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322.json","latestUpdate":{"date":"2026-10-25","title":"Unit 42 reports PAN-OS compromises attacked by multiple ransomware groups since June"},"patchStatus":"unknown","product":"PAN-OS","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2026-0322","stacks":["network"],"startedAt":"2026-10-14","status":"live","summary":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on Oct 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322)","updatedAt":"2026-10-25T09:54:54Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-110447"],"exploited":"in-the-wild","identifiers":["CVE-2026-110447"],"json":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447.json","latestUpdate":{"date":"2026-10-25","title":"CISA adds Collabora Online CVE-2026-110447 to Known Exploited Vulnerabilities catalog"},"patchStatus":"unknown","product":"Collabora Online – Built-in CODE Server","severity":"critical","severityNote":"CVSS 9.2 (v4.0) · exploited in the wild (CISA KEV)","slug":"collabora-collabora-online-built-in-code-server-cve-2026-110447","stacks":[],"startedAt":"2026-10-23","status":"live","summary":"Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on Oct 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","updatedAt":"2026-10-25T09:54:45Z","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447","vendor":"Collabora"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-111497"],"exploited":"none-known","identifiers":["CVE-2026-111497","GHSA-9v8h-qqgm-4m35"],"json":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497.json","latestUpdate":{"date":"2026-10-25","title":"Node2Shell evolves to HTTP2Shell: CVE-2026-111497 blast radius extends to libraries/apps using HTTP with Brotli"},"patchStatus":"patched","product":"Brotli decoder (c/dec/decode.c), PyPI brotli and brotlicffi packages","severity":"critical","severityNote":"CVSS v4 9.2 critical; no confirmed in-the-wild exploitation reported; affects Brotli 1.0.3–1.2.0 across platforms including PyPI brotli/brotlicffi and Node.js","slug":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","stacks":["python","pypi","node","devtools"],"startedAt":"2026-10-22","status":"live","summary":"A buffer overflow (out-of-bounds write) in the Brotli decoder in Google Brotli 1.0.3 through 1.2.0, dubbed \"Node2Shell\", allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory, cause denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. The flaw affects all platforms and also impacts the PyPI brotli and brotlicffi packages (\u003e=1.0.3, \u003c1.2.1) and Node.js, which disclosed it in its October 2026 security releases. No in-the-wild exploitation is reported. Fixed versions are 1.0.10, 1.1.1, and 1.2.1 (brotlicffi 1.2.1.0); organisations should upgrade any affected Brotli libraries or binaries.","tags":["rce","buffer-overflow","out-of-bounds-write","decoder","memory-disclosure","dos","memory-corruption"],"title":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","updatedAt":"2026-10-25T09:53:26Z","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","vendor":"Google / Python packaging (brotli, brotlicffi)"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-114625"],"exploited":"in-the-wild","identifiers":["CVE-2026-114625"],"json":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625.json","latestUpdate":{"date":"2026-10-25","title":"CISA adds Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625, CVSS 9.4) to its Known Exploited Vulnerabilities catalog"},"patchStatus":"unknown","product":"VeloCloud Orchestrator","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"arista-velocloud-orchestrator-cve-2026-114625","stacks":["network"],"startedAt":"2026-10-23","status":"live","summary":"Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on Oct 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","updatedAt":"2026-10-25T09:53:08Z","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625","vendor":"Arista"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-65900"],"exploited":"poc-public","identifiers":["CVE-2026-65900","GHSA-55q2-fjhq-7xh7","GHSA-cg2g-xh64-v4q7","GHSA-gvmj-g25r-r7wr","GHSA-mrv2-3pqr-j5jr","GHSA-p98j-92pf-mc4p"],"json":"https://helix.ml/threat-watch/i/dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg.json","latestUpdate":{"date":"2026-10-25","title":"New DOMPurify IN_PLACE incomplete-fix bypass (GHSA-mrv2-3pqr-j5jr) leaves detached subtree event handlers armed after hook removes parent/sibling"},"patchStatus":"patched","product":"DOMPurify (npm)","severity":"critical","severityNote":"Advisory rated critical; no in-the-wild exploitation reported; requires non-default config (SAFE_FOR_TEMPLATES + DOM-returning mode) and downstream template evaluation","slug":"dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg","stacks":["npm","node","browser"],"startedAt":"2026-10-12","status":"live","summary":"DOMPurify 3.4.4 through 3.4.16 fails to scrub template expressions ({{...}}, ${...}, \u003c%...%\u003e) inside attached shadow roots when SAFE_FOR_TEMPLATES is enabled with a DOM-returning mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). The post-walk safety net _scrubTemplateExpressions recurses into \u003ctemplate\u003e.content but not shadow roots, so an attacker-supplied expression split across text nodes separated by disallowed elements reassembles after sanitization and can be evaluated by a downstream template engine, yielding XSS or server-side template injection. Declarative shadow DOM via setHTMLUnsafe also reaches the gap. Exploitation requires non-default configuration and downstream template evaluation. Fixed in DOMPurify 3.4.17; a public proof of concept exists but no in-the-wild exploitation is known.","tags":["xss","template-injection","sanitizer-bypass","shadow-dom"],"title":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7)","updatedAt":"2026-10-25T09:53:08Z","url":"https://helix.ml/threat-watch/i/dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg","vendor":"Cure53"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-96652"],"exploited":"in-the-wild","identifiers":["CVE-2026-96652"],"json":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652.json","latestUpdate":{"date":"2026-10-25","title":"CISA adds Plex2Shell Plex Media Server vulnerabilities to KEV catalog citing active exploitation"},"patchStatus":"unknown","product":"Media Server","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"plex-media-server-cve-2026-96652","stacks":[],"startedAt":"2026-10-20","status":"live","summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. CISA added CVE-2026-96652 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652)","updatedAt":"2026-10-25T09:51:25Z","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652","vendor":"Plex"},{"auto":true,"category":"supply-chain","closedAt":null,"cveIds":["CVE-2026-111497","CVE-2026-115936"],"exploited":"none-known","identifiers":["CVE-2026-111497","CVE-2026-115936"],"json":"https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe.json","latestUpdate":{"date":"2026-10-23","title":"IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)"},"patchStatus":"patched","product":"IO-Compress-Brotli","severity":"high","severityNote":"No CVSS stated; not known exploited; affects any Perl caller decompressing untrusted brotli streams via bundled vulnerable brotli 1.0.4–1.2.0","slug":"io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe","stacks":["devtools"],"startedAt":"2026-10-23","status":"live","summary":"The CPAN Security Group disclosed CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 bundle a copy of the brotli library (1.0.4 through 1.2.0) containing an out-of-bounds write in the decoder (CVE-2026-111497). Because the module compiles the bundled brotli rather than linking the system library, upgrading system brotli does not remediate. Any application decompressing untrusted data via unbro or the decompress method is exposed: a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Version 0.023, released 2026-10-23, updates the bundled brotli to 1.2.1 and fixes the issue. No in-the-wild exploitation reported.","tags":["oob-write","dependency","memory-disclosure","potential-rce","perl","rce","memory-corruption"],"title":"IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)","updatedAt":"2026-10-25T10:10:21Z","url":"https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe","vendor":"CPAN / Timothy Legge"},{"auto":true,"category":"patch","closedAt":null,"cveIds":[],"exploited":"none-known","identifiers":[],"json":"https://helix.ml/threat-watch/i/x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat.json","latestUpdate":{"date":"2026-10-22","title":"x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)"},"patchStatus":"patched","product":"x402 SDKs (TypeScript, Python, Go)","severity":"critical","severityNote":"Three critical flaws among 25 found by V12; no public exploitation reported; affects agents auto-signing payments without spend limits","slug":"x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat","stacks":["node","npm","pypi","python","go","ai"],"startedAt":"2026-10-22","status":"live","summary":"Security firm V12 disclosed three critical flaws in the x402 payment SDKs used by AI agents to pay for API calls. The default client set no spending limit, letting a malicious API request an agent's full token balance; the TypeScript Solana facilitator accepted token approvals (moving no tokens) as valid payments, enabling complete payment bypass; and the SIWx sign-in client signed login messages without verifying the destination site, enabling relayed authentication. All three were fixed in August 18 releases (2.23.0+), which add $1-per-payment caps, stablecoin-only defaults, instruction-type checks, and domain verification. No attacks reported, but npm/PyPI audits give no warning to upgrade. Latest versions: 2.28.0 (TypeScript/Go), 2.25.0 (Python).","tags":["payment-bypass","auth-bypass","crypto","ai-agents","spend-limit","solana","signature-relay"],"title":"x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)","updatedAt":"2026-10-25T10:50:25Z","url":"https://helix.ml/threat-watch/i/x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat","vendor":"x402 Foundation (originated by Coinbase)"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-115324"],"exploited":"none-known","identifiers":["CVE-2026-115324","GHSA-7587-9684-52r6"],"json":"https://helix.ml/threat-watch/i/mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324.json","latestUpdate":{"date":"2026-10-22","title":"mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)"},"patchStatus":"patched","product":"mem0ai (mem0)","severity":"critical","severityNote":"CVSS 9.2 (v4, critical; advisory also lists CVSS 8.1); no known in-the-wild exploitation; affects mem0ai \u003e= 0.1.117, \u003c 1.0.8 using the Databricks vector store","slug":"mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324","stacks":["pypi","python","ai","database","cloud"],"startedAt":"2026-10-22","status":"live","summary":"A SQL injection vulnerability (CVE-2026-115324) was disclosed on 2026-10-22 in mem0ai's Databricks vector store (mem0/vector_stores/databricks.py). Versions 0.1.117 through before 1.0.8 pass attacker-influenced memory text, metadata, or message names into unescaped string interpolation in insert() and update() calls, allowing injection of arbitrary SQL against the configured Databricks SQL warehouse. Any application storing untrusted user content in mem0 memories backed by the Databricks vector store is affected, with high confidentiality, integrity, and availability impact. No in-the-wild exploitation is reported. Fixed in mem0ai 1.0.8 (commit a2ffca3), which escapes/parameterizes the affected queries.","tags":["sql-injection","ai","databricks","vector-store"],"title":"mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)","updatedAt":"2026-10-25T09:51:07Z","url":"https://helix.ml/threat-watch/i/mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324","vendor":"mem0ai"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-96639"],"exploited":"poc-public","identifiers":["CVE-2026-96639","GHSA-v9pv-5gc8-w2m6"],"json":"https://helix.ml/threat-watch/i/pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026.json","latestUpdate":{"date":"2026-10-22","title":"Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)"},"patchStatus":"patched","product":"Pillow","severity":"critical","severityNote":"CVSS 9.8; PoC demonstrated command execution via MPO/JPEG path on Pillow 12.3.0; no known in-the-wild exploitation","slug":"pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026","stacks":["python","pypi"],"startedAt":"2026-10-22","status":"live","summary":"Pillow multi-frame image loaders (PSD, MPO/JPEG, DCX, MIC) can retain native ImagingCore storage allocated for one frame while a later frame changes the image mode and decoder tiles. ImageFile.load_prepare() only reallocates storage when _im is None and does not verify the retained buffer matches the current mode/size, so a crafted file with frame 0 in a narrow mode (e.g. L) and frame 1 in a wider mode (RGB/CMYK) causes native out-of-bounds writes, crashes, and over-reads. The researcher demonstrated command execution via the documented ImageSequence.Iterator + frame.load() path, including a one-request unauthenticated web-upload exploit. All Pillow users processing untrusted images (web upload services especially) are affected. Fixed in Pillow 13.0.0, published 2026-10-22.","tags":["rce","memory-corruption","oob-write","dos","image-parsing"],"title":"Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)","updatedAt":"2026-10-25T09:50:19Z","url":"https://helix.ml/threat-watch/i/pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026","vendor":"python-pillow"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2025-31699","CVE-2025-55702","CVE-2026-111804","CVE-2026-111805","CVE-2026-111808","CVE-2026-111813","CVE-2026-111816"],"exploited":"none-known","identifiers":["CVE-2025-31699","CVE-2025-55702","CVE-2026-111804","CVE-2026-111805","CVE-2026-111808","CVE-2026-111813","CVE-2026-111816"],"json":"https://helix.ml/threat-watch/i/apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling.json","latestUpdate":{"date":"2026-10-20","title":"Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)"},"patchStatus":"patched","product":"Apache Traffic Server","severity":"critical","severityNote":"CVSS 10.0 for magick plugin flaw; 15 CVEs total, mostly critical/important; no exploitation reported","slug":"apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling","stacks":["network","hosting"],"startedAt":"2026-10-20","status":"live","summary":"The Apache Software Foundation announced fixes for 15 vulnerabilities in Apache Traffic Server, addressed in versions 9.2.16, 10.1.5 and 10.2.1. The most severe (CVE-2026-111813, CVSS 10.0) lets an unauthenticated client control ImageMagick convert arguments via the experimental magick plugin's default configuration. Other issues include a wasm plugin use-after-free and unvalidated metric IDs (CVE-2026-111804), request smuggling via reused origin connections owed a request body (CVE-2025-31699) and unread Expect: 100-continue bodies (CVE-2025-55702), cache poisoning via a malformed 302 bypassing parse-error rejection (CVE-2026-111816), and HTTP/2-triggered origin worker-pool exhaustion (CVE-2026-111805, CVE-2026-111808). All ATS versions 9.0.0 through 10.2.0 are affected; no in-the-wild exploitation is reported. Fixes are available in the new releases.","tags":["rce","request-smuggling","cache-poisoning","use-after-free","dos","command-injection","memory-corruption"],"title":"Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)","updatedAt":"2026-10-25T10:10:46Z","url":"https://helix.ml/threat-watch/i/apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling","vendor":"Apache Software Foundation"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-106173"],"exploited":"poc-public","identifiers":["CVE-2026-106173"],"json":"https://helix.ml/threat-watch/i/fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv.json","latestUpdate":{"date":"2026-10-20","title":"Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)"},"patchStatus":"patched","product":"FortiSIEM","severity":"critical","severityNote":"CVSS 9.4; public PoC exploit released by Horizon3.ai; unauthenticated remote code execution via gRPC service on TCP 27918","slug":"fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv","stacks":["network","linux"],"startedAt":"2026-10-20","status":"live","summary":"Researchers at Horizon3.ai published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM allowing unauthenticated remote code execution. The gRPC QueryResultReq handler on TCP port 27918 processes a user-supplied 'query-id' without validation, letting attackers traverse directories and embed a NUL byte to truncate the appended filename and overwrite arbitrary files. The PoC overwrites /opt/charting/redishb.sh, a Redis health-check script run by cron every 60 seconds, converting the arbitrary-file-write into code execution. Fortinet patched the flaw last week: FortiSIEM 7.5.0 users must upgrade to 7.5.1 or above; 7.6 is not affected. With a public PoC available, organisations running affected versions face imminent exploitation risk.","tags":["rce","path-traversal","arbitrary-file-write","grpc","poc-exploit","siem"],"title":"Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)","updatedAt":"2026-10-25T09:50:35Z","url":"https://helix.ml/threat-watch/i/fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-112992","CVE-2026-112993","CVE-2026-112994","CVE-2026-112995","CVE-2026-112996","CVE-2026-112997","CVE-2026-112998","CVE-2026-112999","CVE-2026-113000","CVE-2026-113001","CVE-2026-113002","CVE-2026-113003","CVE-2026-113004","CVE-2026-113005","CVE-2026-113006","CVE-2026-113007","CVE-2026-113008","CVE-2026-113009","CVE-2026-113010","CVE-2026-113011"],"exploited":"none-known","identifiers":["CVE-2026-112992","CVE-2026-112993","CVE-2026-112994","CVE-2026-112995","CVE-2026-112996","CVE-2026-112997","CVE-2026-112998","CVE-2026-112999","CVE-2026-113000","CVE-2026-113001","CVE-2026-113002","CVE-2026-113003","CVE-2026-113004","CVE-2026-113005","CVE-2026-113006","CVE-2026-113007","CVE-2026-113008","CVE-2026-113009","CVE-2026-113010","CVE-2026-113011"],"json":"https://helix.ml/threat-watch/i/chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1.json","latestUpdate":{"date":"2026-10-20","title":"Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)"},"patchStatus":"patched","product":"Chrome 156 (Windows, Mac, Linux)","severity":"critical","severityNote":"Multiple critical memory corruption bugs; details restricted until majority updated; no exploitation reported","slug":"chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1","stacks":["browser"],"startedAt":"2026-10-20","status":"live","summary":"On 2026-10-20 Google promoted Chrome 156 to the stable channel for Windows, Mac and Linux, rolling out over coming days/weeks. Versions 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows/Mac) contain 353 security fixes, including several critical memory corruption vulnerabilities in Skia, Accessibility, and CSS (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280), reported by Google and Xinyang Ge in early October 2026. Bug details and links are restricted until a majority of users are updated. No in-the-wild exploitation is mentioned. All users of Chrome on desktop platforms are affected until updated; the fix is delivered in the 156 stable release.","tags":["memory-corruption","browser","patch","critical"],"title":"Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)","updatedAt":"2026-10-25T09:50:14Z","url":"https://helix.ml/threat-watch/i/chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1","vendor":"Google"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-106931"],"exploited":"in-the-wild","identifiers":["CVE-2026-106931"],"json":"https://helix.ml/threat-watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931.json","latestUpdate":{"date":"2026-10-20","title":"CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)"},"patchStatus":"unknown","product":"SiteGuard Server Edition","severity":"high","severityNote":"CVSS 8.5 (v4.0) · exploited in the wild (CISA KEV)","slug":"eg-secure-solutions-siteguard-server-edition-cve-2026-106931","stacks":[],"startedAt":"2026-10-20","status":"live","summary":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CVE-2026-106931)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931","vendor":"EG Secure Solutions"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-96656"],"exploited":"in-the-wild","identifiers":["CVE-2026-96656"],"json":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96656.json","latestUpdate":{"date":"2026-10-20","title":"CISA added CVE-2026-96656 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)"},"patchStatus":"unknown","product":"Media Server","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"plex-media-server-cve-2026-96656","stacks":[],"startedAt":"2026-10-20","status":"live","summary":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. CISA added CVE-2026-96656 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-73"],"title":"Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96656","vendor":"Plex"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-96655"],"exploited":"in-the-wild","identifiers":["CVE-2026-96655"],"json":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96655.json","latestUpdate":{"date":"2026-10-20","title":"CISA added CVE-2026-96655 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)"},"patchStatus":"unknown","product":"Media Server","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"plex-media-server-cve-2026-96655","stacks":[],"startedAt":"2026-10-20","status":"live","summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96655)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96655","vendor":"Plex"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-96654"],"exploited":"in-the-wild","identifiers":["CVE-2026-96654"],"json":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96654.json","latestUpdate":{"date":"2026-10-20","title":"CISA added CVE-2026-96654 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)"},"patchStatus":"unknown","product":"Media Server","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"plex-media-server-cve-2026-96654","stacks":[],"startedAt":"2026-10-20","status":"live","summary":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-84"],"title":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVE-2026-96654)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96654","vendor":"Plex"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-110936"],"exploited":"in-the-wild","identifiers":["CVE-2026-110936"],"json":"https://helix.ml/threat-watch/i/siemens-software-center-cve-2026-110936.json","latestUpdate":{"date":"2026-10-20","title":"CISA added CVE-2026-110936 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)"},"patchStatus":"patched","product":"Software Center","severity":"medium","severityNote":"CVSS 6.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"siemens-software-center-cve-2026-110936","stacks":[],"startedAt":"2026-10-20","status":"live","summary":"Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-427"],"title":"Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVE-2026-110936)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/siemens-software-center-cve-2026-110936","vendor":"Siemens"},{"auto":true,"category":"breach","closedAt":null,"cveIds":[],"exploited":"unknown","identifiers":["HIBP:ASSURANCERETRAITE"],"json":"https://helix.ml/threat-watch/i/assuranceretraite-data-breach.json","latestUpdate":{"date":"2026-10-20","title":"Have I Been Pwned loaded 70K breached Assurance Retraite accounts"},"patchStatus":"no-fix-needed","product":"lassuranceretraite.fr","severity":"medium","severityNote":"70K accounts","slug":"assuranceretraite-data-breach","stacks":[],"startedAt":"2026-10-20","status":"live","summary":"In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account. Exposed data: dates of birth, email addresses, family members' names, government issued ids, income levels, marital statuses, names, phone numbers, physical addresses. The breach dates from Sep 1, 2024; Have I Been Pwned loaded it on Oct 20, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","family-members-names","government-issued-ids","income-levels","marital-statuses","names","phone-numbers","physical-addresses"],"title":"Assurance Retraite data breach: 70K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/assuranceretraite-data-breach","vendor":"Assurance Retraite"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-115889"],"exploited":"none-known","identifiers":["CVE-2026-115889","GHSA-897f-g5gm-fmxm"],"json":"https://helix.ml/threat-watch/i/wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889.json","latestUpdate":{"date":"2026-10-19","title":"Wasmtime: Cranelift bit-packing overflow enables sandbox escape via crafted Wasm module (CVE-2026-115889)"},"patchStatus":"patched","product":"Wasmtime (Cranelift compiler backend)","severity":"critical","severityNote":"CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H); no known in-the-wild exploitation; EPSS 0.66%","slug":"wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889","stacks":["rust","devtools"],"startedAt":"2026-10-19","status":"live","summary":"Wasmtime's Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds, producing incorrect value references in the IR and arbitrary miscompilation. A very large or specially crafted Wasm function using many SSA values can force type confusion or other side effects and escape the sandbox. Any Wasmtime engine using default settings (Cranelift backend) on any architecture is affected, making this critical for anyone running untrusted Wasm modules. Fixed in Wasmtime v36.0.19 (backport) and v43.0.0, where Cranelift now uses a full u32 index with explicit limit checks. No public exploitation reported; EPSS 0.66%.","tags":["sandbox-escape","type-confusion","miscompilation","numeric-truncation","wasm","memory-corruption"],"title":"Wasmtime: Cranelift bit-packing overflow enables sandbox escape via crafted Wasm module (CVE-2026-115889)","updatedAt":"2026-10-25T11:05:50Z","url":"https://helix.ml/threat-watch/i/wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889","vendor":"Bytecode Alliance"},{"auto":true,"category":"breach","closedAt":null,"cveIds":[],"exploited":"in-the-wild","identifiers":[],"json":"https://helix.ml/threat-watch/i/pingcap-tidb-cloud-extortion-group-fulcrumsec-used-stolen-service-account-credentials-to-access-internal-systems-copying.json","latestUpdate":{"date":"2026-10-19","title":"PingCAP (TiDB Cloud): Extortion group FulcrumSec used stolen service account credentials to access internal systems, copying business data and source code"},"patchStatus":"no-fix-needed","product":"TiDB Cloud","severity":"high","severityNote":"No CVSS stated; exploited in the wild Sept 9–Oct 7, 2026; customer databases not breached but billing, account, usage data, encrypted API keys, and 4-year connection logs stolen; thousands of orgs named","slug":"pingcap-tidb-cloud-extortion-group-fulcrumsec-used-stolen-service-account-credentials-to-access-internal-systems-copying","stacks":["cloud","database"],"startedAt":"2026-10-19","status":"live","summary":"On Oct 19, 2026, PingCAP disclosed that extortion group FulcrumSec breached its internal systems between Sept 9 and Oct 7 using stolen service account credentials, copying data and source code. Forensics found no evidence attackers accessed customer TiDB databases or ran malicious commands, but exported records included TiDB Cloud account info, billing/contract details, email addresses, SQL editor text, encrypted API keys, and a four-year log of customer connections. FulcrumSec claims broader access (financial records, Google Cloud files, Jira, CRM, analytics) and named ~2,500+ affected organizations including Airbnb, Booking.com, Baidu, Fujitsu, Capcom, Konami, and Square Enix. PingCAP has invalidated compromised credentials, fixed four reported vulnerabilities, and advised API key rotation.","tags":["breach","credential-theft","extortion","cloud-security","data-exposure"],"title":"PingCAP (TiDB Cloud): Extortion group FulcrumSec used stolen service account credentials to access internal systems, copying business data and source code","updatedAt":"2026-10-25T10:50:56Z","url":"https://helix.ml/threat-watch/i/pingcap-tidb-cloud-extortion-group-fulcrumsec-used-stolen-service-account-credentials-to-access-internal-systems-copying","vendor":"PingCAP"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-99999"],"exploited":"none-known","identifiers":["CVE-2026-99999"],"json":"https://helix.ml/threat-watch/i/linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999.json","latestUpdate":{"date":"2026-10-19","title":"Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)"},"patchStatus":"patched","product":"Linux kernel KVM hypervisor (networking checksum offload path)","severity":"critical","severityNote":"CVSS 9.3; no confirmed in-the-wild exploitation; affects KVM hosts across hyperscale and private clouds","slug":"linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999","stacks":["linux","cloud","network","kubernetes","docker","hosting"],"startedAt":"2026-10-19","status":"live","summary":"Researcher Paulos Yibelo disclosed 'PwnEscape', a critical (CVSS 9.3) guest-to-host escape in Linux KVM, tracked as CVE-2026-99999. A guest can send malformed IPv4 packets whose checksum metadata causes skb_checksum_help to corrupt the network header, letting untrusted guest-controlled metadata rewrite security-sensitive packet fields after kernel validation. Red Hat says impact may include arbitrary code execution on the host, denial of service, or sensitive memory disclosure, breaking guest-host isolation. Yibelo describes it as a novel attack class in Linux networking. AWS EC2 says it is not at risk and Google Cloud is likely unaffected. An upstream kernel fix is rolling into Debian, RHEL, Ubuntu and KVM-based products like Nutanix and Proxmox.","tags":["vm-escape","rce","info-disclosure","dos","hypervisor","kvm"],"title":"Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)","updatedAt":"2026-10-25T09:54:01Z","url":"https://helix.ml/threat-watch/i/linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999","vendor":"Linux kernel / distros (Red Hat, Debian, Ubuntu)"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-114509"],"exploited":"none-known","identifiers":["CVE-2026-114509","GHSA-f9x3-7vq9-cph6"],"json":"https://helix.ml/threat-watch/i/laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509.json","latestUpdate":{"date":"2026-10-19","title":"Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)"},"patchStatus":"patched","product":"Laravel framework (TokenGuard)","severity":"critical","severityNote":"CVSS 9.2 Critical; unauthenticated auth bypass on token-guarded API routes; no public exploitation reported","slug":"laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509","stacks":["php","database"],"startedAt":"2026-10-19","status":"live","summary":"A critical authentication bypass (CVE-2026-114509, CVSS 9.2) was disclosed in Laravel's built-in TokenGuard. When a standard token-based API guard is configured, an unauthenticated attacker can submit a specially crafted non-string credential value that is mishandled during the authentication lookup; under certain MySQL/MariaDB database configurations the query matches an unintended user record, letting the attacker authenticate as an arbitrary existing user without knowing their API token. Any route protected by the affected guard is exposed to account takeover. Fixes were released in laravel/framework 12.68.0 and 13.29.0 on 2026-10-19/23; no in-the-wild exploitation is known.","tags":["auth-bypass","account-takeover","cve-2026-114509","laravel","api-token"],"title":"Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)","updatedAt":"2026-10-25T09:50:29Z","url":"https://helix.ml/threat-watch/i/laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509","vendor":"Laravel"},{"auto":true,"category":"breach","closedAt":null,"cveIds":[],"exploited":"unknown","identifiers":["HIBP:GITESDEFRANCE"],"json":"https://helix.ml/threat-watch/i/gitesdefrance-data-breach.json","latestUpdate":{"date":"2026-10-18","title":"Have I Been Pwned loaded 117K breached Gîtes de France accounts"},"patchStatus":"no-fix-needed","product":"gites-de-france.com","severity":"medium","severityNote":"117K accounts","slug":"gitesdefrance-data-breach","stacks":[],"startedAt":"2026-10-18","status":"live","summary":"In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details. Exposed data: booking details, email addresses, names, phone numbers, physical addresses. The breach dates from May 16, 2026; Have I Been Pwned loaded it on Oct 18, 2026.","tags":["data-breach","hibp","booking-details","email-addresses","names","phone-numbers","physical-addresses"],"title":"Gîtes de France data breach: 117K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gitesdefrance-data-breach","vendor":"Gîtes de France"},{"auto":true,"category":"supply-chain","closedAt":null,"cveIds":[],"exploited":"poc-public","identifiers":["GHSA-78g4-xqwv-q3g8"],"json":"https://helix.ml/threat-watch/i/pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8.json","latestUpdate":{"date":"2026-10-17","title":"Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)"},"patchStatus":"partial","product":"Pillow (pip wheels bundling OpenJPEG)","severity":"high","severityNote":"CVSS 8.1; no in-the-wild exploitation known; public ASan PoC; reachable via default Image.open().load() on any JPEG 2000 input, including files mislabeled as PNG/JPEG","slug":"pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8","stacks":["python","pypi"],"startedAt":"2026-10-17","status":"live","summary":"Pillow wheels from 11.1.0 through 12.3.0 bundle a libopenjp2 (2.5.3/2.5.4) containing a heap-buffer-overflow write in opj_j2k_read_sod (OSV-2025-219), introduced in OpenJPEG in June 2024 — notably, older OpenJPEG 2.5.2 is safe. The flaw is reachable from Image.open(fp); im.load() with default settings, and because the wheel bundles its own copy, patched host OS libraries do not help. A public ASan PoC demonstrates the overflow through Pillow's own decoder. Attackers can craft a JPEG 2000 codestream that triggers memory corruption even when uploaded as avatar.png with image/png Content-Type, since Image.open() sniffs magic bytes. Fixed in Pillow 13.0.0; the upstream OpenJPEG fix (91d08b11, Feb 2026) remains unreleased. No in-the-wild exploitation reported.","tags":["heap-buffer-overflow","memory-corruption","bundled-dependency","image-decoder","content-type-bypass"],"title":"Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)","updatedAt":"2026-10-25T10:50:41Z","url":"https://helix.ml/threat-watch/i/pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8","vendor":"python-pillow / OpenJPEG"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2025-61624"],"exploited":"in-the-wild","identifiers":["CVE-2025-61624"],"json":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-61624.json","latestUpdate":{"date":"2026-10-16","title":"CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 19, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-multiple-products-cve-2025-61624","stacks":["network"],"startedAt":"2026-10-16","status":"live","summary":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on Oct 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-61624","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-110144","CVE-2026-110151","CVE-2026-110159","CVE-2026-110166","CVE-2026-110172","CVE-2026-110913","CVE-2026-110914","CVE-2026-110915","CVE-2026-110916","CVE-2026-110917","CVE-2026-110918","CVE-2026-110919","CVE-2026-110920","CVE-2026-110921","CVE-2026-110922"],"exploited":"none-known","identifiers":["CVE-2026-110144","CVE-2026-110151","CVE-2026-110159","CVE-2026-110166","CVE-2026-110172","CVE-2026-110913","CVE-2026-110914","CVE-2026-110915","CVE-2026-110916","CVE-2026-110917","CVE-2026-110918","CVE-2026-110919","CVE-2026-110920","CVE-2026-110921","CVE-2026-110922"],"json":"https://helix.ml/threat-watch/i/google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922.json","latestUpdate":{"date":"2026-10-15","title":"Google Chrome: Extended Stable update fixes 10 security flaws including two critical CVEs (CVE-2026-110151, CVE-2026-110922)"},"patchStatus":"patched","product":"Chrome (Extended Stable channel, Windows and Mac)","severity":"critical","severityNote":"Two Critical and eight High CVEs; no CVSS scores stated; bug details restricted until most users are updated; no exploitation reported","slug":"google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922","stacks":["browser","windows","macos"],"startedAt":"2026-10-15","status":"live","summary":"On 2026-10-15 Google released Chrome Extended Stable 152.0.7977.169 for Windows and Mac, fixing 10 security vulnerabilities: two Critical (CVE-2026-110151, CVE-2026-110922) and eight High severity issues (CVE-2026-110144, CVE-2026-110159, CVE-2026-110166, CVE-2026-110172, CVE-2026-110913, CVE-2026-110918, CVE-2026-110919, CVE-2026-110921). Google has not disclosed vulnerability types or exploit details, keeping bug information restricted until a majority of users are updated, which is standard practice and does not indicate active exploitation. No in-the-wild exploitation is reported. The update rolls out over the coming days/weeks; organisations managing Chrome via Extended Stable should ensure deployment of this build.","tags":["chrome","security-update","extended-stable","critical-cve"],"title":"Google Chrome: Extended Stable update fixes 10 security flaws including two critical CVEs (CVE-2026-110151, CVE-2026-110922)","updatedAt":"2026-10-25T09:50:54Z","url":"https://helix.ml/threat-watch/i/google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922","vendor":"Google"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-21589"],"exploited":"in-the-wild","identifiers":["CVE-2026-21589"],"json":"https://helix.ml/threat-watch/i/atlassian-multiple-products-cve-2026-21589.json","latestUpdate":{"date":"2026-10-15","title":"CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 18, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-multiple-products-cve-2026-21589","stacks":["devtools"],"startedAt":"2026-10-15","status":"live","summary":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on Oct 15, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-552"],"title":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/atlassian-multiple-products-cve-2026-21589","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":null,"cveIds":[],"exploited":"none-known","identifiers":["GHSA-673q-mjm6-r5xr"],"json":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr.json","latestUpdate":{"date":"2026-10-14","title":"Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr)"},"patchStatus":"patched","product":"Next.js","severity":"critical","severityNote":"CVSS v4 9.5 critical; no known exploitation reported; affects App Router apps with Cache Components using `use cache` functions returning multiple typed arrays","slug":"next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr","stacks":["node","npm","devtools","hosting"],"startedAt":"2026-10-14","status":"live","summary":"Vercel disclosed a critical (CVSS 9.5) unauthenticated remote code execution vulnerability in Next.js affecting App Router applications using Cache Components where a `use cache` function returns multiple typed arrays. All versions from 16.0.0 through 16.4.0 are affected; no workaround exists for applications with such cache functions, and Vercel urges immediate upgrades even for apps without similar functions. The advisory was published Oct 14, 2026 and last updated Oct 22, 2026. No in-the-wild exploitation is reported. The fix is available in Next.js 16.4.1 (commit a4cea6a).","tags":["rce","unauthenticated","cache","nextjs"],"title":"Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr)","updatedAt":"2026-10-25T09:50:54Z","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr","vendor":"Vercel"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-96889"],"exploited":"none-known","identifiers":["CVE-2026-96889","GHSA-2464-fhr4-w9xw"],"json":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96.json","latestUpdate":{"date":"2026-10-14","title":"Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889)"},"patchStatus":"patched","product":"Next.js","severity":"critical","severityNote":"CVSS v4 9.5 critical; unauthenticated network RCE on glibc-based Linux; no known in-the-wild exploitation reported","slug":"next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96","stacks":["node","npm","linux"],"startedAt":"2026-10-14","status":"live","summary":"A critical (CVSS 9.5) unauthenticated remote code execution vulnerability (CVE-2026-96889) in Next.js was disclosed via GitHub Advisory GHSA-2464-fhr4-w9xw. The flaw stems from a memory-related vulnerability in the upstream sharp image-processing library used by Next.js's Image Optimization API, and is exploitable when SVG files are processed on glibc-based Linux deployments. All Next.js versions from 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected. No in-the-wild exploitation is known. Fixes shipped in Next.js 15.5.28 and 16.4.1, which ensure package managers provide sharp \u003e= 0.35.5; alternatively, operators can directly ensure sharp \u003e= 0.35.5 as a workaround.","tags":["rce","unauthenticated","image-optimization","dependency-vulnerability","nextjs"],"title":"Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889)","updatedAt":"2026-10-25T09:50:50Z","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96","vendor":"Vercel"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-105134"],"exploited":"in-the-wild","identifiers":["CVE-2026-105134"],"json":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105134.json","latestUpdate":{"date":"2026-10-14","title":"CISA added CVE-2026-105134 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)"},"patchStatus":"unknown","product":"AhsayCBS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ahsay-ahsaycbs-cve-2026-105134","stacks":[],"startedAt":"2026-10-14","status":"live","summary":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134 to its Known Exploited Vulnerabilities catalog on Oct 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77","cwe-78"],"title":"Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105134","vendor":"Ahsay"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-105133"],"exploited":"in-the-wild","identifiers":["CVE-2026-105133"],"json":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105133.json","latestUpdate":{"date":"2026-10-14","title":"CISA added CVE-2026-105133 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)"},"patchStatus":"unknown","product":"AhsayCBS","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"ahsay-ahsaycbs-cve-2026-105133","stacks":[],"startedAt":"2026-10-14","status":"live","summary":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. CISA added CVE-2026-105133 to its Known Exploited Vulnerabilities catalog on Oct 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Ahsay AhsayCBS Improper Authentication Vulnerability (CVE-2026-105133)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105133","vendor":"Ahsay"},{"auto":true,"category":"breach","closedAt":null,"cveIds":[],"exploited":"unknown","identifiers":["HIBP:CRUNCHBASE"],"json":"https://helix.ml/threat-watch/i/crunchbase-data-breach.json","latestUpdate":{"date":"2026-10-14","title":"Have I Been Pwned loaded 559K breached Crunchbase accounts"},"patchStatus":"no-fix-needed","product":"crunchbase.com","severity":"medium","severityNote":"559K accounts","slug":"crunchbase-data-breach","stacks":[],"startedAt":"2026-10-14","status":"live","summary":"In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters \"pay or leak\" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, social media profiles. The breach dates from Jan 22, 2026; Have I Been Pwned loaded it on Oct 14, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","social-media-profiles"],"title":"Crunchbase data breach: 559K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/crunchbase-data-breach","vendor":"Crunchbase"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-106172","CVE-2026-107656"],"exploited":"poc-public","identifiers":["CVE-2026-106172","CVE-2026-107656"],"json":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th.json","latestUpdate":{"date":"2026-10-13","title":"Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172)"},"patchStatus":"patched","product":"FortiSandbox / FortiSandbox Cloud","severity":"critical","severityNote":"CVSS 9.6 (GUI bypass) and 4.9 (Fabric API hard-coded key); CVSS E:F indicates functional exploit availability; no confirmed in-the-wild exploitation; affects FortiSandbox 4.4–5.2 and FortiSandbox Cloud","slug":"fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th","stacks":["network","cloud","docker"],"startedAt":"2026-10-13","status":"live","summary":"On 2026-10-13 Fortinet published two PSIRT advisories for FortiSandbox and FortiSandbox Cloud. FG-IR-26-185 (CVE-2026-107656, CVSS 9.6) is an authentication bypass via alternate path (CWE-288) in the GUI letting a remote unauthenticated attacker bypass authentication with crafted HTTP requests, potentially executing unauthorized code; it affects FortiSandbox 4.4, 5.0 and 5.2 and the PaaS offering. FG-IR-26-179 (CVE-2026-106172, CVSS 4.9) is a hard-coded cryptographic key (CWE-321) in the Fabric API allowing unauthenticated access to some endpoints and privilege escalation, affecting dozens of FortiSandbox and FortiSandbox Cloud releases from 4.4.0 through 5.2.1. Both were reported via responsible disclosure (Fortinet, TrendAI Research, watchTowr). Fixes are available (RL:O) and CVSS E:F suggests functional exploits exist; no in-the-wild exploitation is confirmed.","tags":["auth-bypass","hardcoded-key","privilege-escalation","advisory","fortinet"],"title":"Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172)","updatedAt":"2026-10-25T11:06:29Z","url":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-102208","CVE-2026-102866","CVE-2026-108398","CVE-2026-21413","CVE-2026-70242","CVE-2026-96951"],"exploited":"in-the-wild","identifiers":["CVE-2026-102208","CVE-2026-102866","CVE-2026-108398","CVE-2026-21413","CVE-2026-70242","CVE-2026-96951"],"json":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026.json","latestUpdate":{"date":"2026-10-13","title":"Microsoft: October 2026 Patch Tuesday fixes 1,413 CVEs incl. two zero-days, one actively exploited (CVE-2026-96951, CVE-2026-108398)"},"patchStatus":"patched","product":"Windows, Office, SharePoint, SQL Server, Exchange, Azure, .NET Framework","severity":"critical","severityNote":"80 critical flaws; CVE-2026-96951 (CVSS 8.8) actively exploited MOTW bypass; CVE-2026-108398 (CVSS 8.8) local, exploitation less likely; also critical Outlook RCE CVE-2026-70242 (CVSS 9.8)","slug":"microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","stacks":["windows","dotnet","cloud","database"],"startedAt":"2026-10-13","status":"live","summary":"Microsoft's October 2026 Patch Tuesday, its largest update ever, fixes 1,413 CVEs (1,102 in Windows), including 80 critical flaws and two zero-days. CVE-2026-96951 (CVSS 8.8), a Windows Shell Mark-of-the-Web bypass under active exploitation (discovered by Anthropic's Claude AI), lets crafted files skip SmartScreen, Office Protected View, macro blocking and Smart App Control. CVE-2026-108398 (CVSS 8.8) is a .NET Framework untrusted search path enabling code execution inside WDAC-protected processes; no active exploitation confirmed. Also critical: Outlook Reading Pane RCE CVE-2026-70242 (CVSS 9.8) triggering via email preview without interaction, and SharePoint EoP CVE-2026-102866 (CVSS 8.1). Fixes are available in the October updates.","tags":["zero-day","security-bypass","motw-bypass","rce","eop","patch-tuesday"],"title":"Microsoft: October 2026 Patch Tuesday fixes 1,413 CVEs incl. two zero-days, one actively exploited (CVE-2026-96951, CVE-2026-108398)","updatedAt":"2026-10-25T10:31:07Z","url":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":null,"cveIds":["CVE-2026-96951"],"exploited":"in-the-wild","identifiers":["CVE-2026-96951"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-96951.json","latestUpdate":{"date":"2026-10-13","title":"CISA added CVE-2026-96951 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2026)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-96951","stacks":["windows"],"startedAt":"2026-10-13","status":"live","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on Oct 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Microsoft Windows Command Injection Vulnerability (CVE-2026-96951)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-96951","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":null,"cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHARECARE"],"json":"https://helix.ml/threat-watch/i/sharecare-data-breach.json","latestUpdate":{"date":"2026-10-12","title":"Have I Been Pwned loaded 318K breached Sharecare accounts"},"patchStatus":"no-fix-needed","product":"sharecare.com","severity":"medium","severityNote":"318K accounts","slug":"sharecare-data-breach","stacks":[],"startedAt":"2026-10-12","status":"live","summary":"In August 2026, the digital health company Sharecare was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers). Exposed data: dates of birth, email addresses, employers, genders, government issued ids, job titles, marital statuses, names, phone numbers, physical addresses. The breach dates from Aug 12, 2026; Have I Been Pwned loaded it on Oct 12, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","employers","genders","government-issued-ids","job-titles","marital-statuses","names","phone-numbers","physical-addresses"],"title":"Sharecare data breach: 318K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/sharecare-data-breach","vendor":"Sharecare"},{"auto":true,"category":"supply-chain","closedAt":"2026-10-25","cveIds":["CVE-2026-114134","CVE-2026-31900"],"exploited":"poc-public","identifiers":["CVE-2026-114134","CVE-2026-31900","GHSA-cg8m-r9f2-5wm2"],"json":"https://helix.ml/threat-watch/i/black-github-action-installs-unvalidated-required-version-from-pyproject-toml-enabling-rce-cve-2026-114134.json","latestUpdate":{"date":"2026-10-10","title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml enabling RCE (CVE-2026-114134)"},"patchStatus":"patched","product":"black (pip) / psf/black GitHub Action","severity":"high","severityNote":"CVSS 8.7 (High); no known in-the-wild exploitation; PoC described in advisory; affects users of psf/black GitHub Action with use_pyproject: true","slug":"black-github-action-installs-unvalidated-required-version-from-pyproject-toml-enabling-rce-cve-2026-114134","stacks":["python","pypi","github-actions","devtools"],"startedAt":"2026-10-10","status":"closed","summary":"The GitHub Action bundled with Black accepts the version from tool.black.required-version in pyproject.toml when use_pyproject is set to true, without validating it. An attacker can open a PR modifying pyproject.toml to point Black at a malicious repository, causing the Action to install and execute attacker-controlled code in the context of the victim's repository — remote code execution in CI. This is similar to the earlier CVE-2026-31900. Only users of the psf/black GitHub Action with use_pyproject: true are affected; the widely-used black package itself is unaffected for normal use. Fixed in black 26.10.1 (commit ac1f715, release 26.10.1). Published Oct 10, 2026; advisory database entry Oct 22, 2026.","tags":["rce","supply-chain","ci-cd","unvalidated-input"],"title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml enabling RCE (CVE-2026-114134)","updatedAt":"2026-10-25T09:55:00Z","url":"https://helix.ml/threat-watch/i/black-github-action-installs-unvalidated-required-version-from-pyproject-toml-enabling-rce-cve-2026-114134","vendor":"psf/black"},{"auto":true,"category":"breach","closedAt":"2026-10-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NEOGEN"],"json":"https://helix.ml/threat-watch/i/neogen-data-breach.json","latestUpdate":{"date":"2026-10-09","title":"Have I Been Pwned loaded 435K breached Neogen accounts"},"patchStatus":"no-fix-needed","product":"neogen.com","severity":"medium","severityNote":"435K accounts","slug":"neogen-data-breach","stacks":[],"startedAt":"2026-10-09","status":"closed","summary":"In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters \"pay or leak\" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, salutations. The breach dates from Aug 29, 2026; Have I Been Pwned loaded it on Oct 9, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","salutations"],"title":"Neogen data breach: 435K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/neogen-data-breach","vendor":"Neogen"},{"auto":true,"category":"patch","closedAt":"2026-10-22","cveIds":["CVE-2015-5477"],"exploited":"in-the-wild","identifiers":["CVE-2015-5477"],"json":"https://helix.ml/threat-watch/i/isc-bind-cve-2015-5477.json","latestUpdate":{"date":"2026-10-08","title":"CISA added CVE-2015-5477 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)"},"patchStatus":"patched","product":"BIND","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"isc-bind-cve-2015-5477","stacks":[],"startedAt":"2026-10-08","status":"closed","summary":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. CISA added CVE-2015-5477 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-19"],"title":"ISC BIND Data Processing Errors Vulnerability (CVE-2015-5477)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/isc-bind-cve-2015-5477","vendor":"ISC"},{"auto":true,"category":"patch","closedAt":"2026-10-22","cveIds":["CVE-2016-3081"],"exploited":"in-the-wild","identifiers":["CVE-2016-3081"],"json":"https://helix.ml/threat-watch/i/apache-struts-cve-2016-3081.json","latestUpdate":{"date":"2026-10-08","title":"CISA added CVE-2016-3081 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)"},"patchStatus":"patched","product":"Struts","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-cve-2016-3081","stacks":["java"],"startedAt":"2026-10-08","status":"closed","summary":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Apache Struts Command Injection Vulnerability (CVE-2016-3081)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2016-3081","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2026-10-22","cveIds":["CVE-2023-22894"],"exploited":"in-the-wild","identifiers":["CVE-2023-22894"],"json":"https://helix.ml/threat-watch/i/strapi-strapi-cve-2023-22894.json","latestUpdate":{"date":"2026-10-08","title":"CISA added CVE-2023-22894 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)"},"patchStatus":"unknown","product":"Strapi","severity":"medium","severityNote":"CVSS 4.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"strapi-strapi-cve-2023-22894","stacks":[],"startedAt":"2026-10-08","status":"closed","summary":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. CISA added CVE-2023-22894 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-312"],"title":"Strapi Cleartext Storage of Sensitive Information Vulnerability (CVE-2023-22894)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/strapi-strapi-cve-2023-22894","vendor":"Strapi"},{"auto":true,"category":"patch","closedAt":"2026-10-22","cveIds":["CVE-2021-3199"],"exploited":"in-the-wild","identifiers":["CVE-2021-3199"],"json":"https://helix.ml/threat-watch/i/onlyoffice-docs-cve-2021-3199.json","latestUpdate":{"date":"2026-10-08","title":"CISA added CVE-2021-3199 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)"},"patchStatus":"unknown","product":"Docs","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"onlyoffice-docs-cve-2021-3199","stacks":[],"startedAt":"2026-10-08","status":"closed","summary":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"ONLYOFFICE Docs Server Path Traversal Vulnerability (CVE-2021-3199)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/onlyoffice-docs-cve-2021-3199","vendor":"ONLYOFFICE"},{"auto":true,"category":"patch","closedAt":"2026-10-22","cveIds":["CVE-2015-3306"],"exploited":"in-the-wild","identifiers":["CVE-2015-3306"],"json":"https://helix.ml/threat-watch/i/proftpd-proftpd-cve-2015-3306.json","latestUpdate":{"date":"2026-10-08","title":"CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)"},"patchStatus":"unknown","product":"ProFTPD","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"proftpd-proftpd-cve-2015-3306","stacks":[],"startedAt":"2026-10-08","status":"closed","summary":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. CISA added CVE-2015-3306 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"ProFTPD Improper Access Control Vulnerability (CVE-2015-3306)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/proftpd-proftpd-cve-2015-3306","vendor":"ProFTPD"},{"auto":true,"category":"patch","closedAt":"2026-10-25","cveIds":["CVE-2026-76463","CVE-2026-76464","CVE-2026-76467","CVE-2026-76468","CVE-2026-76469","CVE-2026-76470","CVE-2026-76472"],"exploited":"none-known","identifiers":["CVE-2026-76463","CVE-2026-76464","CVE-2026-76467","CVE-2026-76468","CVE-2026-76469","CVE-2026-76470","CVE-2026-76472"],"json":"https://helix.ml/threat-watch/i/cisco-meraki-critical-hardening-release-fixes-7-internally-discovered-vulnerability-groups-across-mg-mr-ms-mv-mx-and-cam.json","latestUpdate":{"date":"2026-10-07","title":"Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.)"},"patchStatus":"patched","product":"Meraki MG, MR, MS, MV, MX and Campus Gateway products","severity":"critical","severityNote":"CVSS up to 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); not known to be exploited; affects nearly all Meraki product lines","slug":"cisco-meraki-critical-hardening-release-fixes-7-internally-discovered-vulnerability-groups-across-mg-mr-ms-mv-mx-and-cam","stacks":["network","cloud"],"startedAt":"2026-10-07","status":"closed","summary":"Cisco published a Critical-rated security hardening release for Meraki OS addressing seven internally discovered vulnerability groups, each assigned a CVE by CWE class: improper access control (CVE-2026-76463, CVSS 8.8), memory buffer issues (CVE-2026-76464, CVSS 9.6), resource lifetime control (CVE-2026-76467), input validation (CVE-2026-76468), control flow management (CVE-2026-76469), incorrect calculation (CVE-2026-76470) and injection (CVE-2026-76472). Affected products include Meraki MG cellular gateways, MR access points, MS switches, MV cameras, MX security/SD-WAN appliances and Campus Gateways regardless of configuration. Issues were found in internal testing (including with frontier AI models) and are not known to be exploited. No workarounds exist; fixed releases are shipping or scheduled through mid-November 2026.","tags":["cisco","meraki","hardening","memory-corruption","access-control","input-validation","command-injection","no-workaround"],"title":"Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.)","updatedAt":"2026-10-25T11:10:00Z","url":"https://helix.ml/threat-watch/i/cisco-meraki-critical-hardening-release-fixes-7-internally-discovered-vulnerability-groups-across-mg-mr-ms-mv-mx-and-cam","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-10-25","cveIds":["CVE-2026-101767","CVE-2026-104935","CVE-2026-109618","CVE-2026-109619","CVE-2026-76268"],"exploited":"poc-public","identifiers":["CVE-2026-101767","CVE-2026-104935","CVE-2026-109618","CVE-2026-109619","CVE-2026-76268"],"json":"https://helix.ml/threat-watch/i/splunk-enterprise-unauthenticated-patroni-rest-api-flaw-allows-os-command-execution-on-search-head-cluster-members-cve-2.json","latestUpdate":{"date":"2026-10-07","title":"Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268)"},"patchStatus":"patched","product":"Splunk Enterprise (search head clustering with Patroni REST API)","severity":"critical","severityNote":"CVSS 9.8 (AV:N/AC:L/PR:N/UI:N); no active exploitation reported; public PoC repository exists; exploitable via internal network access, internet exposure not required","slug":"splunk-enterprise-unauthenticated-patroni-rest-api-flaw-allows-os-command-execution-on-search-head-cluster-members-cve-2","stacks":["database","linux","devtools"],"startedAt":"2026-10-07","status":"closed","summary":"Splunk disclosed SVD-2026-1001 on 2026-10-07: CVE-2026-76268, a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the Patroni REST API on Splunk Enterprise search head cluster members. An unauthenticated attacker with network access to the API can abuse unauthenticated configuration operations to execute attacker-controlled OS commands, with high impact to confidentiality, integrity, and availability; no user interaction or credentials required, and internal network access suffices. Affected: Splunk Enterprise 10.4.0–10.4.2 and 10.2.0–10.2.6 (10.0.x and 9.4.x not affected). No active exploitation reported, but a public proof-of-concept repository exists. Fixed in 10.4.3 and 10.2.7; workaround disables the PostgreSQL sidecar in server.conf for those not using Edge Processor, OpAmp, or SPL2 pipelines. Horizon3 released a NodeZero Rapid Response validation test.","tags":["rce","auth-bypass","cwe-306","search-head-cluster","patroni"],"title":"Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268)","updatedAt":"2026-10-25T09:55:00Z","url":"https://helix.ml/threat-watch/i/splunk-enterprise-unauthenticated-patroni-rest-api-flaw-allows-os-command-execution-on-search-head-cluster-members-cve-2","vendor":"Splunk/Cisco"},{"auto":true,"category":"breach","closedAt":"2026-10-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANGELONE"],"json":"https://helix.ml/threat-watch/i/angelone-data-breach.json","latestUpdate":{"date":"2026-10-07","title":"Have I Been Pwned loaded 6.8M breached Angel One accounts"},"patchStatus":"no-fix-needed","product":"angelone.in","severity":"high","severityNote":"6.8M accounts · financial data exposed","slug":"angelone-data-breach","stacks":[],"startedAt":"2026-10-07","status":"closed","summary":"In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach \"has no impact on client securities, funds, or credentials\". Exposed data: bank account numbers, dates of birth, email addresses, financial investments, government issued ids, names, phone numbers, physical addresses. The breach dates from Apr 1, 2023; Have I Been Pwned loaded it on Oct 7, 2026.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","email-addresses","financial-investments","government-issued-ids","names","phone-numbers","physical-addresses"],"title":"Angel One data breach: 6.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/angelone-data-breach","vendor":"Angel One"},{"auto":true,"category":"breach","closedAt":"2026-10-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOUBLECOUNTER"],"json":"https://helix.ml/threat-watch/i/doublecounter-data-breach.json","latestUpdate":{"date":"2026-10-07","title":"Have I Been Pwned loaded 274K breached Double Counter accounts"},"patchStatus":"no-fix-needed","product":"doublecounter.gg","severity":"medium","severityNote":"274K accounts","slug":"doublecounter-data-breach","stacks":[],"startedAt":"2026-10-07","status":"closed","summary":"In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes. Exposed data: email addresses, geographic locations, names, usernames. The breach dates from Oct 4, 2026; Have I Been Pwned loaded it on Oct 7, 2026.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","usernames"],"title":"Double Counter data breach: 274K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/doublecounter-data-breach","vendor":"Double Counter"},{"auto":true,"category":"breach","closedAt":"2026-10-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CYRUSONE"],"json":"https://helix.ml/threat-watch/i/cyrusone-data-breach.json","latestUpdate":{"date":"2026-10-07","title":"Have I Been Pwned loaded 373K breached CyrusOne accounts"},"patchStatus":"no-fix-needed","product":"cyrusone.com","severity":"medium","severityNote":"373K accounts","slug":"cyrusone-data-breach","stacks":[],"startedAt":"2026-10-07","status":"closed","summary":"In August 2026, data centre operator CyrusOne was the target of a ShinyHunters \"pay or leak\" extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation's operations. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, support tickets. The breach dates from Aug 5, 2026; Have I Been Pwned loaded it on Oct 7, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","support-tickets"],"title":"CyrusOne data breach: 373K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cyrusone-data-breach","vendor":"CyrusOne"},{"auto":true,"category":"patch","closedAt":"2026-10-25","cveIds":["CVE-2026-102255","CVE-2026-15409","CVE-2026-15410"],"exploited":"in-the-wild","identifiers":["CVE-2026-102255","CVE-2026-15409","CVE-2026-15410"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma-1000-actively-exploited-max-severity-ssrf-in-workplace-interface-allows-unauthenticated-attackers-to-reach.json","latestUpdate":{"date":"2026-10-06","title":"SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255)"},"patchStatus":"patched","product":"SMA 1000 appliances (WorkPlace interface)","severity":"critical","severityNote":"CVSS 10.0; exploitation observed in the wild on honeypots from Oct 8-9, 2026; internet-facing edge appliances","slug":"sonicwall-sma-1000-actively-exploited-max-severity-ssrf-in-workplace-interface-allows-unauthenticated-attackers-to-reach","stacks":["network","vpn"],"startedAt":"2026-10-06","status":"closed","summary":"A maximum-severity (CVSS 10.0) server-side request forgery flaw, CVE-2026-102255, in the WorkPlace interface of SonicWall SMA 1000 secure access gateways is under active attack. Disclosed Oct 6, 2026, the flaw stems from an unintended alternate access path letting a remote unauthenticated attacker direct the appliance to issue requests on their behalf, reaching internal functionality and performing unauthorized operations — effectively turning the internet-facing gateway into a proxy to internal services. Honeypot operators Previdian and Defused observed exploitation attempts starting Oct 8-9. SonicWall has released a hotfix; SSL-VPN on SonicWall firewalls and SMA 100 Series are not affected. This follows July zero-day exploitation of two SMA 1000 flaws by the Inc ransomware gang.","tags":["ssrf","edge-device","exploited-in-the-wild","unauthenticated","zero-trust","zero-day","ransomware"],"title":"SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255)","updatedAt":"2026-10-25T10:35:00Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma-1000-actively-exploited-max-severity-ssrf-in-workplace-interface-allows-unauthenticated-attackers-to-reach","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2026-10-18","cveIds":["CVE-2026-88779"],"exploited":"in-the-wild","identifiers":["CVE-2026-88779"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88779.json","latestUpdate":{"date":"2026-10-04","title":"CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 7, 2026)"},"patchStatus":"unknown","product":"NetScaler","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-cve-2026-88779","stacks":["cloud","vpn"],"startedAt":"2026-10-04","status":"closed","summary":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog on Oct 4, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88779","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2026-10-16","cveIds":["CVE-2026-102490"],"exploited":"in-the-wild","identifiers":["CVE-2026-102490"],"json":"https://helix.ml/threat-watch/i/zammad-gmbh-zammad-cve-2026-102490.json","latestUpdate":{"date":"2026-10-02","title":"CISA added CVE-2026-102490 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2026)"},"patchStatus":"unknown","product":"Zammad","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zammad-gmbh-zammad-cve-2026-102490","stacks":[],"startedAt":"2026-10-02","status":"closed","summary":"Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. CISA added CVE-2026-102490 to its Known Exploited Vulnerabilities catalog on Oct 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-269"],"title":"Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/zammad-gmbh-zammad-cve-2026-102490","vendor":"Zammad GmbH"},{"auto":true,"category":"patch","closedAt":"2026-10-16","cveIds":["CVE-2026-102489"],"exploited":"in-the-wild","identifiers":["CVE-2026-102489"],"json":"https://helix.ml/threat-watch/i/zammad-gmbh-zammad-cve-2026-102489.json","latestUpdate":{"date":"2026-10-02","title":"CISA added CVE-2026-102489 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2026)"},"patchStatus":"unknown","product":"Zammad","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zammad-gmbh-zammad-cve-2026-102489","stacks":[],"startedAt":"2026-10-02","status":"closed","summary":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. CISA added CVE-2026-102489 to its Known Exploited Vulnerabilities catalog on Oct 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-384"],"title":"Zammad GmbH Zammad Session Fixation Vulnerability (CVE-2026-102489)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/zammad-gmbh-zammad-cve-2026-102489","vendor":"Zammad GmbH"},{"auto":true,"category":"patch","closedAt":"2026-10-15","cveIds":["CVE-2026-104286"],"exploited":"in-the-wild","identifiers":["CVE-2026-104286"],"json":"https://helix.ml/threat-watch/i/fortinet-fortimail-cve-2026-104286.json","latestUpdate":{"date":"2026-10-01","title":"CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 4, 2026)"},"patchStatus":"unknown","product":"FortiMail","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortimail-cve-2026-104286","stacks":["network"],"startedAt":"2026-10-01","status":"closed","summary":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on Oct 1, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22","cwe-158"],"title":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-fortimail-cve-2026-104286","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2026-10-14","cveIds":["CVE-2026-76504"],"exploited":"in-the-wild","identifiers":["CVE-2026-76504"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504.json","latestUpdate":{"date":"2026-09-30","title":"CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 3, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-manager-cve-2026-76504","stacks":["network"],"startedAt":"2026-09-30","status":"closed","summary":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog on Sep 30, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-177"],"title":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (CVE-2026-76504)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-10-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MEDELA"],"json":"https://helix.ml/threat-watch/i/medela-data-breach.json","latestUpdate":{"date":"2026-09-30","title":"Have I Been Pwned loaded 423K breached Medela accounts"},"patchStatus":"no-fix-needed","product":"medela.com","severity":"high","severityNote":"423K accounts","slug":"medela-data-breach","stacks":[],"startedAt":"2026-09-30","status":"closed","summary":"In September 2026, Swiss medical device company Medela was the target of a ShinyHunters \"pay or leak\" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, salutations, support tickets. The breach dates from Sep 7, 2026; Have I Been Pwned loaded it on Sep 30, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","salutations","support-tickets"],"title":"Medela data breach: 423K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/medela-data-breach","vendor":"Medela"},{"auto":true,"category":"patch","closedAt":"2026-10-13","cveIds":["CVE-2026-86950"],"exploited":"in-the-wild","identifiers":["CVE-2026-86950"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2026-86950.json","latestUpdate":{"date":"2026-09-29","title":"CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 13, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2026-86950","stacks":[],"startedAt":"2026-09-29","status":"closed","summary":"Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on Sep 29, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2026-86950","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-10-11","cveIds":["CVE-2026-88772"],"exploited":"in-the-wild","identifiers":["CVE-2026-88772"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88772.json","latestUpdate":{"date":"2026-09-27","title":"CISA added CVE-2026-88772 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 30, 2026)"},"patchStatus":"unknown","product":"NetScaler","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-cve-2026-88772","stacks":["cloud","vpn"],"startedAt":"2026-09-27","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service. CISA added CVE-2026-88772 to its Known Exploited Vulnerabilities catalog on Sep 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88772)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88772","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2026-10-11","cveIds":["CVE-2026-88771"],"exploited":"in-the-wild","identifiers":["CVE-2026-88771"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88771.json","latestUpdate":{"date":"2026-09-27","title":"CISA added CVE-2026-88771 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 30, 2026)"},"patchStatus":"unknown","product":"NetScaler","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-cve-2026-88771","stacks":["cloud","vpn"],"startedAt":"2026-09-27","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog on Sep 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Citrix NetScaler Improper Input Validation Vulnerability (CVE-2026-88771)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88771","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2026-10-09","cveIds":["CVE-2026-67279"],"exploited":"in-the-wild","identifiers":["CVE-2026-67279"],"json":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2026-67279.json","latestUpdate":{"date":"2026-09-25","title":"CISA added CVE-2026-67279 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 28, 2026)"},"patchStatus":"unknown","product":"RouterOS","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"mikrotik-routeros-cve-2026-67279","stacks":["network"],"startedAt":"2026-09-25","status":"closed","summary":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. CISA added CVE-2026-67279 to its Known Exploited Vulnerabilities catalog on Sep 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-841"],"title":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2026-67279","vendor":"MikroTik"},{"auto":true,"category":"patch","closedAt":"2026-10-09","cveIds":["CVE-2026-65660"],"exploited":"in-the-wild","identifiers":["CVE-2026-65660"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-65660.json","latestUpdate":{"date":"2026-09-25","title":"CISA added CVE-2026-65660 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 28, 2026)"},"patchStatus":"patched","product":"SharePoint","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2026-65660","stacks":["windows"],"startedAt":"2026-09-25","status":"closed","summary":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on Sep 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Microsoft SharePoint Code Injection Vulnerability (CVE-2026-65660)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-65660","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-10-09","cveIds":["CVE-2026-87902"],"exploited":"in-the-wild","identifiers":["CVE-2026-87902"],"json":"https://helix.ml/threat-watch/i/wordpress-core-cve-2026-87902.json","latestUpdate":{"date":"2026-09-25","title":"CISA added CVE-2026-87902 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 28, 2026)"},"patchStatus":"unknown","product":"Core","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"wordpress-core-cve-2026-87902","stacks":["wordpress"],"startedAt":"2026-09-25","status":"closed","summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on Sep 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-98"],"title":"WordPress Core Remote File Inclusion Vulnerability (CVE-2026-87902)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/wordpress-core-cve-2026-87902","vendor":"WordPress"},{"auto":true,"category":"patch","closedAt":"2026-10-25","cveIds":["CVE-2026-114139"],"exploited":"none-known","identifiers":["CVE-2026-114139","GHSA-mchm-gjx6-7h55"],"json":"https://helix.ml/threat-watch/i/sentry-nextjs-middleware-bypass-via-tunnelroute-lets-requests-skip-authorization-middleware-cve-2026-114139.json","latestUpdate":{"date":"2026-09-24","title":"@sentry/nextjs: Middleware bypass via tunnelRoute lets requests skip authorization middleware (CVE-2026-114139)"},"patchStatus":"patched","product":"@sentry/nextjs","severity":"critical","severityNote":"CVSS 9.1 critical; no known in-the-wild exploitation; affects apps meeting all four conditions (tunnelRoute set, webpack build, route under tunnel path, middleware-only authz)","slug":"sentry-nextjs-middleware-bypass-via-tunnelroute-lets-requests-skip-authorization-middleware-cve-2026-114139","stacks":["npm","node","devtools"],"startedAt":"2026-09-24","status":"closed","summary":"Sentry disclosed a critical middleware bypass in @sentry/nextjs (CVE-2026-114139, CVSS 9.1). The tunnelRoute option skips Next.js middleware for requests under the tunnel path to let envelope requests reach Sentry, but the skip was broader than the rewrite, which only serves requests with o and p parameters. Requests in the gap reach the application with middleware never running, potentially bypassing middleware-only authorization. Affected only if tunnelRoute is set, the app is built with webpack (Turbopack unaffected), a route resolves under the tunnel path (direct collision or root dynamic segment like app/[locale]/…), and middleware is the sole authorization enforcement. No in-the-wild exploitation reported. Fixed in 9.47.2, 10.75.2 and 11.0.0-rc.1; the skip now matches only requests the rewrite actually serves, with no config change needed.","tags":["auth-bypass","middleware-bypass","nextjs","cve-2026-114139"],"title":"@sentry/nextjs: Middleware bypass via tunnelRoute lets requests skip authorization middleware (CVE-2026-114139)","updatedAt":"2026-10-25T09:55:00Z","url":"https://helix.ml/threat-watch/i/sentry-nextjs-middleware-bypass-via-tunnelroute-lets-requests-skip-authorization-middleware-cve-2026-114139","vendor":"Sentry"},{"auto":true,"category":"patch","closedAt":"2026-10-08","cveIds":["CVE-2026-5430"],"exploited":"in-the-wild","identifiers":["CVE-2026-5430"],"json":"https://helix.ml/threat-watch/i/wso2-multiple-products-cve-2026-5430.json","latestUpdate":{"date":"2026-09-24","title":"CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 27, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"wso2-multiple-products-cve-2026-5430","stacks":[],"startedAt":"2026-09-24","status":"closed","summary":"WSO2 API Control Plane, API Manager, Traffic Manager \u0026 Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on Sep 24, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-347"],"title":"WSO2 Multiple Products Path Traversal Vulnerability (CVE-2026-5430)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/wso2-multiple-products-cve-2026-5430","vendor":"WSO2"},{"auto":true,"category":"patch","closedAt":"2026-10-08","cveIds":["CVE-2026-71362"],"exploited":"in-the-wild","identifiers":["CVE-2026-71362"],"json":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-71362.json","latestUpdate":{"date":"2026-09-24","title":"CISA added CVE-2026-71362 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 27, 2026)"},"patchStatus":"unknown","product":"Commerce and Magento ","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-commerce-and-magento-cve-2026-71362","stacks":["php"],"startedAt":"2026-09-24","status":"closed","summary":"Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. CISA added CVE-2026-71362 to its Known Exploited Vulnerabilities catalog on Sep 24, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-863"],"title":"Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVE-2026-71362)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-71362","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2026-10-06","cveIds":["CVE-2026-93952"],"exploited":"in-the-wild","identifiers":["CVE-2026-93952"],"json":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-93952.json","latestUpdate":{"date":"2026-09-22","title":"CISA added CVE-2026-93952 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)"},"patchStatus":"unknown","product":"VeloCloud Orchestrator","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"arista-velocloud-orchestrator-cve-2026-93952","stacks":["network"],"startedAt":"2026-09-22","status":"closed","summary":"Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. CISA added CVE-2026-93952 to its Known Exploited Vulnerabilities catalog on Sep 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability (CVE-2026-93952)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-93952","vendor":"Arista"},{"auto":true,"category":"patch","closedAt":"2026-10-06","cveIds":["CVE-2026-94127"],"exploited":"in-the-wild","identifiers":["CVE-2026-94127"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-apm-cve-2026-94127.json","latestUpdate":{"date":"2026-09-22","title":"CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)"},"patchStatus":"unknown","product":"BIG-IP APM","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-apm-cve-2026-94127","stacks":["network"],"startedAt":"2026-09-22","status":"closed","summary":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog on Sep 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-122"],"title":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability (CVE-2026-94127)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-apm-cve-2026-94127","vendor":"F5"},{"auto":true,"category":"patch","closedAt":"2026-10-06","cveIds":["CVE-2026-93616"],"exploited":"in-the-wild","identifiers":["CVE-2026-93616"],"json":"https://helix.ml/threat-watch/i/check-point-multiple-products-cve-2026-93616.json","latestUpdate":{"date":"2026-09-22","title":"CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"check-point-multiple-products-cve-2026-93616","stacks":["network"],"startedAt":"2026-09-22","status":"closed","summary":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. CISA added CVE-2026-93616 to its Known Exploited Vulnerabilities catalog on Sep 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Check Point Multiple Products Path Traversal Vulnerability (CVE-2026-93616)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/check-point-multiple-products-cve-2026-93616","vendor":"Check Point"},{"auto":true,"category":"patch","closedAt":"2026-10-06","cveIds":["CVE-2026-85102"],"exploited":"in-the-wild","identifiers":["CVE-2026-85102"],"json":"https://helix.ml/threat-watch/i/check-point-multiple-products-cve-2026-85102.json","latestUpdate":{"date":"2026-09-22","title":"CISA added CVE-2026-85102 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"check-point-multiple-products-cve-2026-85102","stacks":["network"],"startedAt":"2026-09-22","status":"closed","summary":"Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. CISA added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog on Sep 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-295"],"title":"Check Point Multiple Products Improper Certificate Validation Vulnerability (CVE-2026-85102)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/check-point-multiple-products-cve-2026-85102","vendor":"Check Point"},{"auto":true,"category":"breach","closedAt":"2026-10-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIMELEADS"],"json":"https://helix.ml/threat-watch/i/limeleads-data-breach.json","latestUpdate":{"date":"2026-09-22","title":"Have I Been Pwned loaded 17.8M breached LimeLeads accounts"},"patchStatus":"no-fix-needed","product":"limeleads.com","severity":"medium","severityNote":"17.8M accounts","slug":"limeleads-data-breach","stacks":[],"startedAt":"2026-09-22","status":"closed","summary":"In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode. Exposed data: email addresses, employers, geographic locations, job titles, phone numbers. The breach dates from Aug 1, 2019; Have I Been Pwned loaded it on Sep 22, 2026.","tags":["data-breach","hibp","email-addresses","employers","geographic-locations","job-titles","phone-numbers"],"title":"LimeLeads data breach: 17.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/limeleads-data-breach","vendor":"LimeLeads"},{"auto":true,"category":"patch","closedAt":"2026-10-05","cveIds":["CVE-2026-7273"],"exploited":"in-the-wild","identifiers":["CVE-2026-7273"],"json":"https://helix.ml/threat-watch/i/zyxel-gs1900-series-switches-cve-2026-7273.json","latestUpdate":{"date":"2026-09-21","title":"CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 24, 2026)"},"patchStatus":"unknown","product":"GS1900 Series Switches","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-gs1900-series-switches-cve-2026-7273","stacks":["network"],"startedAt":"2026-09-21","status":"closed","summary":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on Sep 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-121"],"title":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (CVE-2026-7273)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/zyxel-gs1900-series-switches-cve-2026-7273","vendor":"Zyxel"},{"auto":true,"category":"breach","closedAt":"2026-10-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BURGERKINGRUSSIA"],"json":"https://helix.ml/threat-watch/i/burgerkingrussia-data-breach.json","latestUpdate":{"date":"2026-09-21","title":"Have I Been Pwned loaded 3.2M breached Burger King Russia accounts"},"patchStatus":"no-fix-needed","product":"burgerkingrus.ru","severity":"medium","severityNote":"3.2M accounts","slug":"burgerkingrussia-data-breach","stacks":[],"startedAt":"2026-09-21","status":"closed","summary":"In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details. Exposed data: dates of birth, email addresses, genders, geographic locations, names, phone numbers. The breach dates from Aug 25, 2024; Have I Been Pwned loaded it on Sep 21, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","phone-numbers"],"title":"Burger King Russia data breach: 3.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/burgerkingrussia-data-breach","vendor":"Burger King Russia"},{"auto":true,"category":"patch","closedAt":"2026-10-02","cveIds":["CVE-2025-39964"],"exploited":"in-the-wild","identifiers":["CVE-2025-39964"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-39964.json","latestUpdate":{"date":"2026-09-18","title":"CISA added CVE-2025-39964 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 21, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2025-39964","stacks":["linux"],"startedAt":"2026-09-18","status":"closed","summary":"Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. CISA added CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on Sep 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-362"],"title":"Linux Kernel Race Condition Vulnerability (CVE-2025-39964)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-39964","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2026-10-02","cveIds":["CVE-2026-53266"],"exploited":"in-the-wild","identifiers":["CVE-2026-53266"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2026-53266.json","latestUpdate":{"date":"2026-09-18","title":"CISA added CVE-2026-53266 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 21, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2026-53266","stacks":["linux"],"startedAt":"2026-09-18","status":"closed","summary":"Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA added CVE-2026-53266 to its Known Exploited Vulnerabilities catalog on Sep 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Linux Kernel Out-of-Bounds Write Vulnerability (CVE-2026-53266)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2026-53266","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2026-10-02","cveIds":["CVE-2025-39682"],"exploited":"in-the-wild","identifiers":["CVE-2025-39682"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-39682.json","latestUpdate":{"date":"2026-09-18","title":"CISA added CVE-2025-39682 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 21, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2025-39682","stacks":["linux"],"startedAt":"2026-09-18","status":"closed","summary":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA added CVE-2025-39682 to its Known Exploited Vulnerabilities catalog on Sep 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-754"],"title":"Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2025-39682)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-39682","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2026-09-30","cveIds":["CVE-2026-58704"],"exploited":"in-the-wild","identifiers":["CVE-2026-58704"],"json":"https://helix.ml/threat-watch/i/google-pixel-cve-2026-58704.json","latestUpdate":{"date":"2026-09-16","title":"CISA added CVE-2026-58704 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 19, 2026)"},"patchStatus":"unknown","product":"Pixel","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-pixel-cve-2026-58704","stacks":["android"],"startedAt":"2026-09-16","status":"closed","summary":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog on Sep 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-693"],"title":"Google Pixel Improper Authorization Vulnerability (CVE-2026-58704)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-pixel-cve-2026-58704","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2026-09-30","cveIds":["CVE-2026-76460"],"exploited":"in-the-wild","identifiers":["CVE-2026-76460"],"json":"https://helix.ml/threat-watch/i/cisco-identity-services-engine-cve-2026-76460.json","latestUpdate":{"date":"2026-09-16","title":"CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 19, 2026)"},"patchStatus":"unknown","product":"Identity Services Engine","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-identity-services-engine-cve-2026-76460","stacks":["network"],"startedAt":"2026-09-16","status":"closed","summary":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on Sep 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-648"],"title":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (CVE-2026-76460)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-identity-services-engine-cve-2026-76460","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-09-30","cveIds":["CVE-2026-87886"],"exploited":"in-the-wild","identifiers":["CVE-2026-87886"],"json":"https://helix.ml/threat-watch/i/acronis-backup-cve-2026-87886.json","latestUpdate":{"date":"2026-09-16","title":"CISA added CVE-2026-87886 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 19, 2026)"},"patchStatus":"unknown","product":"Backup","severity":"high","severityNote":"CVSS 7.8 (v3.0) · exploited in the wild (CISA KEV)","slug":"acronis-backup-cve-2026-87886","stacks":[],"startedAt":"2026-09-16","status":"closed","summary":"Acronis Backup plugin for cPanel \u0026 WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog on Sep 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-276"],"title":"Acronis Backup Incorrect Default Permissions Vulnerability (CVE-2026-87886)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/acronis-backup-cve-2026-87886","vendor":"Acronis"},{"auto":true,"category":"patch","closedAt":"2026-10-25","cveIds":["CVE-2026-20353","CVE-2026-76440","CVE-2026-76441","CVE-2026-76442","CVE-2026-76443"],"exploited":"in-the-wild","identifiers":["CVE-2026-20353","CVE-2026-76440","CVE-2026-76441","CVE-2026-76442","CVE-2026-76443"],"json":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-and-secure-email-and-web-manager-hardening-release-fixes-multiple-critical-vulnerabilities-in.json","latestUpdate":{"date":"2026-09-14","title":"Cisco Secure Email Gateway and Secure Email and Web Manager: hardening release fixes multiple critical vulnerabilities including actively exploited SQL injection and arbitrary file write (CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443)"},"patchStatus":"patched","product":"Cisco Secure Email Gateway and Cisco Secure Email and Web Manager","severity":"critical","severityNote":"CVSS 9.8 (max); two vulnerabilities known to be actively exploited; affects all configurations of Secure Email Gateway and Secure Email and Web Manager","slug":"cisco-secure-email-gateway-and-secure-email-and-web-manager-hardening-release-fixes-multiple-critical-vulnerabilities-in","stacks":["network","cloud"],"startedAt":"2026-09-14","status":"closed","summary":"Cisco released security hardening updates for Secure Email Gateway and Secure Email and Web Manager addressing five internally discovered vulnerability groups, each assigned a CVE by CWE class: path traversal (CWE-23), improper access control (CWE-284), improper resource lifetime control (CWE-664), improper neutralization including SQL injection (CWE-707), and improper input validation (CWE-1284). Two vulnerabilities — the arbitrary file write (path traversal) and SQL injection — are known to be actively exploited. All devices are affected regardless of configuration; Secure Web Appliance is not affected. No workarounds exist. Fixes are available in 15.5.5-014 (Gateway) / 15.5.5-006 (Manager) and 16.5.0-780 / 16.5.0-429; 16.0 users must migrate.","tags":["sql-injection","path-traversal","arbitrary-file-write","access-control","actively-exploited","email-gateway"],"title":"Cisco Secure Email Gateway and Secure Email and Web Manager: hardening release fixes multiple critical vulnerabilities including actively exploited SQL injection and arbitrary file write (CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76443)","updatedAt":"2026-10-25T11:10:00Z","url":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-and-secure-email-and-web-manager-hardening-release-fixes-multiple-critical-vulnerabilities-in","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-09-28","cveIds":["CVE-2026-76461"],"exploited":"in-the-wild","identifiers":["CVE-2026-76461"],"json":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76461.json","latestUpdate":{"date":"2026-09-14","title":"CISA added CVE-2026-76461 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 17, 2026)"},"patchStatus":"unknown","product":"Secure Email Gateway","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-email-gateway-cve-2026-76461","stacks":["network"],"startedAt":"2026-09-14","status":"closed","summary":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on Sep 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Cisco Secure Email Gateway SQL Injection Vulnerability (CVE-2026-76461)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76461","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-09-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHESS2026"],"json":"https://helix.ml/threat-watch/i/chess2026-data-breach.json","latestUpdate":{"date":"2026-09-13","title":"Have I Been Pwned loaded 4.7M breached Chess.com (2026) accounts"},"patchStatus":"no-fix-needed","product":"chess.com","severity":"medium","severityNote":"4.7M accounts","slug":"chess2026-data-breach","stacks":[],"startedAt":"2026-09-13","status":"closed","summary":"In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches. Exposed data: email addresses, geographic locations, names, usernames. The breach dates from Aug 3, 2026; Have I Been Pwned loaded it on Sep 13, 2026.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","usernames"],"title":"Chess.com (2026) data breach: 4.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/chess2026-data-breach","vendor":"Chess.com (2026)"},{"auto":true,"category":"patch","closedAt":"2026-09-25","cveIds":["CVE-2026-84869"],"exploited":"in-the-wild","identifiers":["CVE-2026-84869"],"json":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2026-84869.json","latestUpdate":{"date":"2026-09-11","title":"CISA added CVE-2026-84869 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 14, 2026)"},"patchStatus":"unknown","product":"ScreenConnect","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"connectwise-screenconnect-cve-2026-84869","stacks":[],"startedAt":"2026-09-11","status":"closed","summary":"ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on Sep 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-269","cwe-862"],"title":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability (CVE-2026-84869)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2026-84869","vendor":"ConnectWise"},{"auto":true,"category":"patch","closedAt":"2026-09-25","cveIds":["CVE-2026-42016"],"exploited":"in-the-wild","identifiers":["CVE-2026-42016"],"json":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-42016.json","latestUpdate":{"date":"2026-09-11","title":"CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)"},"patchStatus":"unknown","product":"Artifactory","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jfrog-artifactory-cve-2026-42016","stacks":[],"startedAt":"2026-09-11","status":"closed","summary":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA added CVE-2026-42016 to its Known Exploited Vulnerabilities catalog on Sep 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-863"],"title":"JFrog Artifactory Incorrect Authorization Vulnerability (CVE-2026-42016)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-42016","vendor":"JFrog"},{"auto":true,"category":"patch","closedAt":"2026-09-25","cveIds":["CVE-2026-42018"],"exploited":"in-the-wild","identifiers":["CVE-2026-42018"],"json":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-42018.json","latestUpdate":{"date":"2026-09-11","title":"CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)"},"patchStatus":"unknown","product":"Artifactory","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"jfrog-artifactory-cve-2026-42018","stacks":[],"startedAt":"2026-09-11","status":"closed","summary":"JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. CISA added CVE-2026-42018 to its Known Exploited Vulnerabilities catalog on Sep 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"JFrog Artifactory Improper Authentication Vulnerability (CVE-2026-42018)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-42018","vendor":"JFrog"},{"auto":true,"category":"patch","closedAt":"2026-09-25","cveIds":["CVE-2026-85706"],"exploited":"in-the-wild","identifiers":["CVE-2026-85706"],"json":"https://helix.ml/threat-watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json","latestUpdate":{"date":"2026-09-11","title":"CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 14, 2026)"},"patchStatus":"unknown","product":"Community Edition and Enterprise Edition","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"gitlab-community-edition-and-enterprise-edition-cve-2026-85706","stacks":["devtools"],"startedAt":"2026-09-11","status":"closed","summary":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on Sep 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","path-traversal","cwe-35"],"title":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability (CVE-2026-85706)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706","vendor":"GitLab"},{"auto":true,"category":"patch","closedAt":"2026-09-24","cveIds":["CVE-2026-86060"],"exploited":"in-the-wild","identifiers":["CVE-2026-86060"],"json":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2026-86060.json","latestUpdate":{"date":"2026-09-10","title":"CISA added CVE-2026-86060 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 13, 2026)"},"patchStatus":"unknown","product":"RouterOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mikrotik-routeros-cve-2026-86060","stacks":["network"],"startedAt":"2026-09-10","status":"closed","summary":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on Sep 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-88"],"title":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability (CVE-2026-86060)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2026-86060","vendor":"MikroTik"},{"auto":true,"category":"patch","closedAt":"2026-09-24","cveIds":["CVE-2026-67277"],"exploited":"in-the-wild","identifiers":["CVE-2026-67277"],"json":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2026-67277.json","latestUpdate":{"date":"2026-09-10","title":"CISA added CVE-2026-67277 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 13, 2026)"},"patchStatus":"unknown","product":"RouterOS","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"mikrotik-routeros-cve-2026-67277","stacks":["network"],"startedAt":"2026-09-10","status":"closed","summary":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. CISA added CVE-2026-67277 to its Known Exploited Vulnerabilities catalog on Sep 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability (CVE-2026-67277)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2026-67277","vendor":"MikroTik"},{"auto":true,"category":"breach","closedAt":"2026-09-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MCKESSON"],"json":"https://helix.ml/threat-watch/i/mckesson-data-breach.json","latestUpdate":{"date":"2026-09-10","title":"Have I Been Pwned loaded 6.4M breached McKesson accounts"},"patchStatus":"no-fix-needed","product":"mckesson.com","severity":"high","severityNote":"6.4M accounts","slug":"mckesson-data-breach","stacks":[],"startedAt":"2026-09-10","status":"closed","summary":"In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff and healthcare provider contacts. In McKesson's disclosure notice, the company advised it had identified unauthorised access to \"certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology \u0026 Multispecialty and Medical-Surgical business units\", but had \"reasonable assurance of no ongoing unauthorized activity\". Exposed data: dates of birth, email addresses, employers, genders, names, personal health data, phone numbers, physical addresses. The breach dates from Aug 21, 2026; Have I Been Pwned loaded it on Sep 10, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","employers","genders","names","personal-health-data","phone-numbers","physical-addresses"],"title":"McKesson data breach: 6.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mckesson-data-breach","vendor":"McKesson"},{"auto":true,"category":"patch","closedAt":"2026-09-23","cveIds":["CVE-2026-19490"],"exploited":"in-the-wild","identifiers":["CVE-2026-19490"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-19490.json","latestUpdate":{"date":"2026-09-09","title":"CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 12, 2026)"},"patchStatus":"unknown","product":"NetScaler","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-cve-2026-19490","stacks":["cloud","vpn"],"startedAt":"2026-09-09","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog on Sep 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-19490)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-19490","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2026-09-23","cveIds":["CVE-2025-25249"],"exploited":"in-the-wild","identifiers":["CVE-2025-25249"],"json":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-25249.json","latestUpdate":{"date":"2026-09-09","title":"CISA added CVE-2025-25249 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 12, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-multiple-products-cve-2025-25249","stacks":["network"],"startedAt":"2026-09-09","status":"closed","summary":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on Sep 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122","cwe-787"],"title":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability (CVE-2025-25249)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-25249","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2026-09-23","cveIds":["CVE-2026-87491"],"exploited":"in-the-wild","identifiers":["CVE-2026-87491"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-87491.json","latestUpdate":{"date":"2026-09-09","title":"CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 23, 2026)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2026-87491","stacks":["browser"],"startedAt":"2026-09-09","status":"closed","summary":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2026-87491 to its Known Exploited Vulnerabilities catalog on Sep 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-787"],"title":"Google Chromium V8 Out of Bounds Write Vulnerability (CVE-2026-87491)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-87491","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2026-09-23","cveIds":["CVE-2026-20079"],"exploited":"in-the-wild","identifiers":["CVE-2026-20079"],"json":"https://helix.ml/threat-watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firewall-management-cve-2026-20079.json","latestUpdate":{"date":"2026-09-09","title":"CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 12, 2026)"},"patchStatus":"unknown","product":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firewall-management-cve-2026-20079","stacks":["network"],"startedAt":"2026-09-09","status":"closed","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on Sep 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-20079)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firewall-management-cve-2026-20079","vendor":"Cisco"},{"auto":true,"category":"supply-chain","closedAt":"2026-10-25","cveIds":[],"exploited":"in-the-wild","identifiers":[],"json":"https://helix.ml/threat-watch/i/pub-dev-universal-file-viewer-0-1-5-flutter-package-contains-xcsset-macos-malware.json","latestUpdate":{"date":"2026-09-08","title":"pub.dev: universal_file_viewer 0.1.5 Flutter package contains XCSSET macOS malware"},"patchStatus":"no-fix-needed","product":"universal_file_viewer (pub.dev package)","severity":"medium","severityNote":"~500 downloads; malicious code only in example/ build files, not triggered by normal dependency use; no CVE","slug":"pub-dev-universal-file-viewer-0-1-5-flutter-package-contains-xcsset-macos-malware","stacks":["macos","ios","android","devtools"],"startedAt":"2026-09-08","status":"closed","summary":"Aikido detected XCSSET malware inside universal_file_viewer 0.1.5, a Flutter file-preview package on pub.dev (~500 downloads) — the first compromised package found on that registry. The maintainer's macOS machine was infected with the XCSSET worm, which injected malicious hooks into example/ Android Gradle and iOS/macOS Xcode build files before publication. The Dart library itself is clean and simply adding the package as a dependency does not trigger infection; risk applies to anyone cloning the repo and building the example app, which would contact attacker C2 servers and deploy a multi-stage macOS stealer/orchestrator. The worm also infects other Gradle projects, Xcode projects and git repos on compromised machines, and GitHub search shows maintainers still pushing infected projects. No vendor fix; users should avoid building the example and audit machines.","tags":["supply-chain","malware","xcsset","worm","stealer","build-hook-injection","credential-theft"],"title":"pub.dev: universal_file_viewer 0.1.5 Flutter package contains XCSSET macOS malware","updatedAt":"2026-10-25T10:55:00Z","url":"https://helix.ml/threat-watch/i/pub-dev-universal-file-viewer-0-1-5-flutter-package-contains-xcsset-macos-malware","vendor":"pub.dev / Dart \u0026 Flutter ecosystem"},{"auto":true,"category":"patch","closedAt":"2026-09-22","cveIds":["CVE-2026-75650"],"exploited":"in-the-wild","identifiers":["CVE-2026-75650"],"json":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-75650.json","latestUpdate":{"date":"2026-09-08","title":"CISA added CVE-2026-75650 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2026)"},"patchStatus":"patched","product":"Commerce and Magento","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-commerce-and-magento-cve-2026-75650","stacks":["php"],"startedAt":"2026-09-08","status":"closed","summary":"Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalog on Sep 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-1336"],"title":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2026-75650)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-75650","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2026-09-22","cveIds":["CVE-2026-81963"],"exploited":"in-the-wild","identifiers":["CVE-2026-81963"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-81963.json","latestUpdate":{"date":"2026-09-08","title":"CISA added CVE-2026-81963 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 22, 2026)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-81963","stacks":["windows"],"startedAt":"2026-09-08","status":"closed","summary":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CISA added CVE-2026-81963 to its Known Exploited Vulnerabilities catalog on Sep 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-59","cwe-284"],"title":"Microsoft Windows Link Following Vulnerability (CVE-2026-81963)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-81963","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-09-22","cveIds":["CVE-2026-86218"],"exploited":"in-the-wild","identifiers":["CVE-2026-86218"],"json":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2026-86218.json","latestUpdate":{"date":"2026-09-08","title":"CISA added CVE-2026-86218 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2026)"},"patchStatus":"unknown","product":"N-central","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"n-able-n-central-cve-2026-86218","stacks":[],"startedAt":"2026-09-08","status":"closed","summary":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on Sep 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-96"],"title":"N-able N-central Static Code Injection Vulnerability (CVE-2026-86218)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2026-86218","vendor":"N-able"},{"auto":true,"category":"patch","closedAt":"2026-09-22","cveIds":["CVE-2026-85880"],"exploited":"in-the-wild","identifiers":["CVE-2026-85880"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-85880.json","latestUpdate":{"date":"2026-09-08","title":"CISA added CVE-2026-85880 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 22, 2026)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-85880","stacks":["windows"],"startedAt":"2026-09-08","status":"closed","summary":"Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. CISA added CVE-2026-85880 to its Known Exploited Vulnerabilities catalog on Sep 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122","cwe-908"],"title":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability (CVE-2026-85880)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-85880","vendor":"Microsoft"},{"auto":true,"category":"supply-chain","closedAt":"2026-10-25","cveIds":[],"exploited":"in-the-wild","identifiers":[],"json":"https://helix.ml/threat-watch/i/npm-ecosystem-shai-hulud-worm-payloads-resurface-dormant-hash-republished-after-111-days-and-tensorlake-compromised-with.json","latestUpdate":{"date":"2026-09-07","title":"npm ecosystem: Shai-Hulud worm payloads resurface — dormant hash republished after 111 days and tensorlake compromised with a novel variant (no CVE)"},"patchStatus":"no-fix-needed","product":"npm packages (tensorlake 0.5.144; feishu-docx-mcp, bmc-i18n-extract-cli, blueai-cli, bmc-translate-utils)","severity":"critical","severityNote":"No CVSS stated; actively exploited in the wild via npm installs; tensorlake 0.5.144 had 100k+ lifetime installs; secrets exfiltration and self-replication confirmed","slug":"npm-ecosystem-shai-hulud-worm-payloads-resurface-dormant-hash-republished-after-111-days-and-tensorlake-compromised-with","stacks":["npm","node","devtools","github-actions"],"startedAt":"2026-09-07","status":"closed","summary":"Two Shai-Hulud worm events hit npm in late 2026. On 7 September, four packages (feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, bmc-translate-utils@1.1.1) republished the byte-identical @AntV worm payload (SHA256 e37e3d...b1a6) that had been dormant for 111 days, slipping past npm's publish-time malware scanning despite a known hash. On 8 October, tensorlake@0.5.144 was published with a novel Shai-Hulud variant after a threat actor made verified commits as a maintainer; the payload exfiltrates environment variables, secrets, browser credential stores (including 14 crypto extensions via HackBrowserData), uses C2 iseekaigogo[.]com plus an Ethereum dead-drop fallback, and includes a dead-man's switch that wipes machines if an embedded GitHub token is revoked. Any machine that installed affected versions should be treated as fully compromised; no vendor fix applies beyond removing malicious versions.","tags":["supply-chain","worm","credential-theft","secrets-exfiltration","crypto","persistence","npm-malware"],"title":"npm ecosystem: Shai-Hulud worm payloads resurface — dormant hash republished after 111 days and tensorlake compromised with a novel variant (no CVE)","updatedAt":"2026-10-25T10:55:00Z","url":"https://helix.ml/threat-watch/i/npm-ecosystem-shai-hulud-worm-payloads-resurface-dormant-hash-republished-after-111-days-and-tensorlake-compromised-with","vendor":"TensorLake / npm ecosystem"},{"auto":true,"category":"patch","closedAt":"2026-10-25","cveIds":["CVE-2026-75650"],"exploited":"in-the-wild","identifiers":["CVE-2026-75650"],"json":"https://helix.ml/threat-watch/i/magento-open-source-adobe-commerce-unauthenticated-rce-zero-day-stylesmuggler-actively-exploited-cve-2026-75650.json","latestUpdate":{"date":"2026-09-05","title":"Magento Open Source / Adobe Commerce: unauthenticated RCE zero-day 'StyleSmuggler' actively exploited (CVE-2026-75650)"},"patchStatus":"patched","product":"Magento Open Source / Adobe Commerce","severity":"critical","severityNote":"CVSS 10.0; actively exploited since 2026-09-04; affects all current Magento/Adobe Commerce versions incl. 2.4.9","slug":"magento-open-source-adobe-commerce-unauthenticated-rce-zero-day-stylesmuggler-actively-exploited-cve-2026-75650","stacks":["php","hosting","database"],"startedAt":"2026-09-05","status":"closed","summary":"A zero-day dubbed StyleSmuggler gives unauthenticated attackers remote code execution against every current version of Magento Open Source and Adobe Commerce, including 2.4.9. The two-stage exploit injects PHP via style properties on a GraphQL request, writes the payload into a Magento-generated file, and executes it during server-side rendering of a Payment Transaction Failed Reminder email — no delivery needed. Confirmed intrusions installed a persistent Rust-based backdoor disguised as a kernel thread, exposing PII, payment data, admin credentials and enabling Magecart-style skimmers. Active exploitation began September 4, 2026; Sansec published research September 5. Adobe has since released urgent hotfixes tracked as CVE-2026-75650 (CVSS 10); Aikido also ships drop-in patches for several branches. Temporary mitigation: disable GraphQL, at the cost of headless/PWA storefronts.","tags":["rce","zero-day","auth-bypass","backdoor","magecart","ecommerce","graphql"],"title":"Magento Open Source / Adobe Commerce: unauthenticated RCE zero-day 'StyleSmuggler' actively exploited (CVE-2026-75650)","updatedAt":"2026-10-25T10:55:00Z","url":"https://helix.ml/threat-watch/i/magento-open-source-adobe-commerce-unauthenticated-rce-zero-day-stylesmuggler-actively-exploited-cve-2026-75650","vendor":"Adobe / Magento"},{"auto":true,"category":"patch","closedAt":"2026-09-18","cveIds":["CVE-2026-85046"],"exploited":"in-the-wild","identifiers":["CVE-2026-85046"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-85046.json","latestUpdate":{"date":"2026-09-04","title":"CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 18, 2026)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2026-85046","stacks":["browser"],"startedAt":"2026-09-04","status":"closed","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on Sep 4, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2026-85046)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-85046","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2026-09-16","cveIds":["CVE-2026-59822"],"exploited":"in-the-wild","identifiers":["CVE-2026-59822"],"json":"https://helix.ml/threat-watch/i/berriai-litellm-cve-2026-59822.json","latestUpdate":{"date":"2026-09-02","title":"CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 16, 2026)"},"patchStatus":"patched","product":"LiteLLM","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"berriai-litellm-cve-2026-59822","stacks":["ai"],"startedAt":"2026-09-02","status":"closed","summary":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287","cwe-306"],"title":"BerriAI LiteLLM Improper Authentication Vulnerability (CVE-2026-59822)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/berriai-litellm-cve-2026-59822","vendor":"BerriAI"},{"auto":true,"category":"patch","closedAt":"2026-09-16","cveIds":["CVE-2026-48710"],"exploited":"in-the-wild","identifiers":["CVE-2026-48710"],"json":"https://helix.ml/threat-watch/i/kludex-starlette-cve-2026-48710.json","latestUpdate":{"date":"2026-09-02","title":"CISA added CVE-2026-48710 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 16, 2026)"},"patchStatus":"patched","product":"Starlette","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"kludex-starlette-cve-2026-48710","stacks":[],"startedAt":"2026-09-02","status":"closed","summary":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. CISA added CVE-2026-48710 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-444"],"title":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability (CVE-2026-48710)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/kludex-starlette-cve-2026-48710","vendor":"Kludex"},{"auto":true,"category":"patch","closedAt":"2026-09-16","cveIds":["CVE-2026-49869"],"exploited":"in-the-wild","identifiers":["CVE-2026-49869"],"json":"https://helix.ml/threat-watch/i/kestra-kestra-oss-cve-2026-49869.json","latestUpdate":{"date":"2026-09-02","title":"CISA added CVE-2026-49869 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 5, 2026)"},"patchStatus":"unknown","product":"Kestra OSS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"kestra-kestra-oss-cve-2026-49869","stacks":[],"startedAt":"2026-09-02","status":"closed","summary":"Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-184","cwe-287","cwe-918"],"title":"Kestra OSS OS Command Injection Vulnerability (CVE-2026-49869)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/kestra-kestra-oss-cve-2026-49869","vendor":"Kestra"},{"auto":true,"category":"patch","closedAt":"2026-09-16","cveIds":["CVE-2026-82329"],"exploited":"in-the-wild","identifiers":["CVE-2026-82329"],"json":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-82329.json","latestUpdate":{"date":"2026-09-02","title":"CISA added CVE-2026-82329 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 5, 2026)"},"patchStatus":"unknown","product":"Artifactory","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jfrog-artifactory-cve-2026-82329","stacks":[],"startedAt":"2026-09-02","status":"closed","summary":"JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. CISA added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"JFrog Artifactory Improper Authentication Vulnerability (CVE-2026-82329)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-82329","vendor":"JFrog"},{"auto":true,"category":"patch","closedAt":"2026-09-16","cveIds":["CVE-2026-9586"],"exploited":"in-the-wild","identifiers":["CVE-2026-9586"],"json":"https://helix.ml/threat-watch/i/sangoma-switchvox-cve-2026-9586.json","latestUpdate":{"date":"2026-09-02","title":"CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 5, 2026)"},"patchStatus":"unknown","product":"Switchvox","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sangoma-switchvox-cve-2026-9586","stacks":[],"startedAt":"2026-09-02","status":"closed","summary":"Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. CISA added CVE-2026-9586 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","sql-injection","cwe-89"],"title":"Sangoma Switchvox SQL Injection Vulnerability (CVE-2026-9586)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sangoma-switchvox-cve-2026-9586","vendor":"Sangoma"},{"auto":true,"category":"patch","closedAt":"2026-09-16","cveIds":["CVE-2026-83548"],"exploited":"in-the-wild","identifiers":["CVE-2026-83548"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-83548.json","latestUpdate":{"date":"2026-09-02","title":"CISA added CVE-2026-83548 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 5, 2026)"},"patchStatus":"unknown","product":"SMA1000 Appliances","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma1000-appliances-cve-2026-83548","stacks":["vpn"],"startedAt":"2026-09-02","status":"closed","summary":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA added CVE-2026-83548 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918","cwe-441"],"title":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (CVE-2026-83548)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-83548","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2026-09-16","cveIds":["CVE-2026-83549"],"exploited":"in-the-wild","identifiers":["CVE-2026-83549"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-83549.json","latestUpdate":{"date":"2026-09-02","title":"CISA added CVE-2026-83549 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 5, 2026)"},"patchStatus":"unknown","product":"SMA1000 Appliances","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma1000-appliances-cve-2026-83549","stacks":["vpn"],"startedAt":"2026-09-02","status":"closed","summary":"SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. CISA added CVE-2026-83549 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability (CVE-2026-83549)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-83549","vendor":"SonicWall"},{"auto":true,"category":"breach","closedAt":"2026-09-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MANCHESTERAIRPORTSGROUP"],"json":"https://helix.ml/threat-watch/i/manchesterairportsgroup-data-breach.json","latestUpdate":{"date":"2026-09-02","title":"Have I Been Pwned loaded 8.8M breached Manchester Airports Group accounts"},"patchStatus":"no-fix-needed","product":"magairports.com","severity":"medium","severityNote":"8.8M accounts","slug":"manchesterairportsgroup-data-breach","stacks":[],"startedAt":"2026-09-02","status":"closed","summary":"In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice, MAG advised that \"at no point has passenger safety or aviation security been compromised\". Exposed data: browser user agent details, email addresses, geographic locations, ip addresses, names, phone numbers, purchases, vehicle registration plates. The breach dates from Aug 27, 2026; Have I Been Pwned loaded it on Sep 2, 2026.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","geographic-locations","ip-addresses","names","phone-numbers","purchases","vehicle-registration-plates"],"title":"Manchester Airports Group data breach: 8.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/manchesterairportsgroup-data-breach","vendor":"Manchester Airports Group"},{"auto":true,"category":"breach","closedAt":"2026-09-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QUESTEL"],"json":"https://helix.ml/threat-watch/i/questel-data-breach.json","latestUpdate":{"date":"2026-09-01","title":"Have I Been Pwned loaded 1.2M breached Questel accounts"},"patchStatus":"no-fix-needed","product":"questel.com","severity":"medium","severityNote":"1.2M accounts","slug":"questel-data-breach","stacks":[],"startedAt":"2026-09-01","status":"closed","summary":"In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, support tickets. The breach dates from Aug 1, 2026; Have I Been Pwned loaded it on Sep 1, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","support-tickets"],"title":"Questel data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/questel-data-breach","vendor":"Questel"},{"auto":true,"category":"patch","closedAt":"2026-09-14","cveIds":["CVE-2026-82078"],"exploited":"in-the-wild","identifiers":["CVE-2026-82078"],"json":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2026-82078.json","latestUpdate":{"date":"2026-08-31","title":"CISA added CVE-2026-82078 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 14, 2026)"},"patchStatus":"patched","product":"NG/MF","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"papercut-ng-mf-cve-2026-82078","stacks":[],"startedAt":"2026-08-31","status":"closed","summary":"PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. CISA added CVE-2026-82078 to its Known Exploited Vulnerabilities catalog on Aug 31, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-470"],"title":"PaperCut NG/MF Unsafe Reflection Vulnerability (CVE-2026-82078)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2026-82078","vendor":"PaperCut"},{"auto":true,"category":"patch","closedAt":"2026-09-14","cveIds":["CVE-2026-81578"],"exploited":"in-the-wild","identifiers":["CVE-2026-81578"],"json":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2026-81578.json","latestUpdate":{"date":"2026-08-31","title":"CISA added CVE-2026-81578 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 14, 2026)"},"patchStatus":"patched","product":"NG/MF","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"papercut-ng-mf-cve-2026-81578","stacks":[],"startedAt":"2026-08-31","status":"closed","summary":"PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078. CISA added CVE-2026-81578 to its Known Exploited Vulnerabilities catalog on Aug 31, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability (CVE-2026-81578)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2026-81578","vendor":"PaperCut"},{"auto":true,"category":"patch","closedAt":"2026-09-10","cveIds":["CVE-2023-49105"],"exploited":"in-the-wild","identifiers":["CVE-2023-49105"],"json":"https://helix.ml/threat-watch/i/owncloud-owncloud-cve-2023-49105.json","latestUpdate":{"date":"2026-08-27","title":"CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 30, 2026)"},"patchStatus":"unknown","product":"ownCloud","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"owncloud-owncloud-cve-2023-49105","stacks":[],"startedAt":"2026-08-27","status":"closed","summary":"ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog on Aug 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"ownCloud Improper Authentication Vulnerability (CVE-2023-49105)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/owncloud-owncloud-cve-2023-49105","vendor":"ownCloud"},{"auto":true,"category":"patch","closedAt":"2026-09-10","cveIds":["CVE-2026-53362"],"exploited":"in-the-wild","identifiers":["CVE-2026-53362"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2026-53362.json","latestUpdate":{"date":"2026-08-27","title":"CISA added CVE-2026-53362 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 30, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2026-53362","stacks":["linux"],"startedAt":"2026-08-27","status":"closed","summary":"Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on Aug 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Linux Kernel Unspecified Vulnerability (CVE-2026-53362)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2026-53362","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2026-09-10","cveIds":["CVE-2026-66384"],"exploited":"in-the-wild","identifiers":["CVE-2026-66384"],"json":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-66384.json","latestUpdate":{"date":"2026-08-27","title":"CISA added CVE-2026-66384 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 10, 2026)"},"patchStatus":"unknown","product":"Artifactory","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"jfrog-artifactory-cve-2026-66384","stacks":[],"startedAt":"2026-08-27","status":"closed","summary":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. CISA added CVE-2026-66384 to its Known Exploited Vulnerabilities catalog on Aug 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-22"],"title":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability (CVE-2026-66384)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/jfrog-artifactory-cve-2026-66384","vendor":"JFrog"},{"auto":true,"category":"patch","closedAt":"2026-09-09","cveIds":["CVE-2021-23758"],"exploited":"in-the-wild","identifiers":["CVE-2021-23758"],"json":"https://helix.ml/threat-watch/i/ajax-net-professional-ajax-net-professional-cve-2021-23758.json","latestUpdate":{"date":"2026-08-26","title":"CISA added CVE-2021-23758 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 9, 2026)"},"patchStatus":"patched","product":"Ajax.NET Professional","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ajax-net-professional-ajax-net-professional-cve-2021-23758","stacks":["dotnet","rust"],"startedAt":"2026-08-26","status":"closed","summary":"Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA added CVE-2021-23758 to its Known Exploited Vulnerabilities catalog on Aug 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Ajax.NET Professional Deserialization of Untrusted Data Vulnerability (CVE-2021-23758)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ajax-net-professional-ajax-net-professional-cve-2021-23758","vendor":"Ajax.NET Professional"},{"auto":true,"category":"patch","closedAt":"2026-09-09","cveIds":["CVE-2015-3246"],"exploited":"in-the-wild","identifiers":["CVE-2015-3246"],"json":"https://helix.ml/threat-watch/i/red-hat-libuser-cve-2015-3246.json","latestUpdate":{"date":"2026-08-26","title":"CISA added CVE-2015-3246 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 9, 2026)"},"patchStatus":"unknown","product":"Libuser","severity":"high","severityNote":"CVSS 7.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-libuser-cve-2015-3246","stacks":["linux"],"startedAt":"2026-08-26","status":"closed","summary":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. CISA added CVE-2015-3246 to its Known Exploited Vulnerabilities catalog on Aug 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Red Hat Libuser Race Condition Vulnerability (CVE-2015-3246)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/red-hat-libuser-cve-2015-3246","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2026-09-09","cveIds":["CVE-2015-5287"],"exploited":"in-the-wild","identifiers":["CVE-2015-5287"],"json":"https://helix.ml/threat-watch/i/red-hat-automatic-bug-reporting-tool-cve-2015-5287.json","latestUpdate":{"date":"2026-08-26","title":"CISA added CVE-2015-5287 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 9, 2026)"},"patchStatus":"patched","product":"Automatic Bug Reporting Tool","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-automatic-bug-reporting-tool-cve-2015-5287","stacks":["linux"],"startedAt":"2026-08-26","status":"closed","summary":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA added CVE-2015-5287 to its Known Exploited Vulnerabilities catalog on Aug 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability (CVE-2015-5287)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/red-hat-automatic-bug-reporting-tool-cve-2015-5287","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2026-09-09","cveIds":["CVE-2022-0995"],"exploited":"in-the-wild","identifiers":["CVE-2022-0995"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0995.json","latestUpdate":{"date":"2026-08-26","title":"CISA added CVE-2022-0995 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 29, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2022-0995","stacks":["linux"],"startedAt":"2026-08-26","status":"closed","summary":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system. CISA added CVE-2022-0995 to its Known Exploited Vulnerabilities catalog on Aug 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Linux Kernel Out-of-Bounds Write Vulnerability (CVE-2022-0995)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0995","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2026-09-09","cveIds":["CVE-2026-8452"],"exploited":"in-the-wild","identifiers":["CVE-2026-8452"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2026-8452.json","latestUpdate":{"date":"2026-08-26","title":"CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 29, 2026)"},"patchStatus":"unknown","product":"NetScaler ADC and NetScaler Gateway","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-adc-and-netscaler-gateway-cve-2026-8452","stacks":["cloud","vpn"],"startedAt":"2026-08-26","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog on Aug 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-8452)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2026-8452","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2026-09-09","cveIds":["CVE-2019-1068"],"exploited":"in-the-wild","identifiers":["CVE-2019-1068"],"json":"https://helix.ml/threat-watch/i/microsoft-sql-server-cve-2019-1068.json","latestUpdate":{"date":"2026-08-26","title":"CISA added CVE-2019-1068 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 29, 2026)"},"patchStatus":"patched","product":"SQL Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sql-server-cve-2019-1068","stacks":["database"],"startedAt":"2026-08-26","status":"closed","summary":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CISA added CVE-2019-1068 to its Known Exploited Vulnerabilities catalog on Aug 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft SQL Server Remote Code Execution Vulnerability (CVE-2019-1068)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sql-server-cve-2019-1068","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-09-08","cveIds":["CVE-2026-60004"],"exploited":"in-the-wild","identifiers":["CVE-2026-60004"],"json":"https://helix.ml/threat-watch/i/gitea-gitea-cve-2026-60004.json","latestUpdate":{"date":"2026-08-25","title":"CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 28, 2026)"},"patchStatus":"unknown","product":"Gitea","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gitea-gitea-cve-2026-60004","stacks":[],"startedAt":"2026-08-25","status":"closed","summary":"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on Aug 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Gitea Code Injection Vulnerability (CVE-2026-60004)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gitea-gitea-cve-2026-60004","vendor":"Gitea"},{"auto":true,"category":"breach","closedAt":"2026-09-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CARHARTT"],"json":"https://helix.ml/threat-watch/i/carhartt-data-breach.json","latestUpdate":{"date":"2026-08-25","title":"Have I Been Pwned loaded 12.9M breached Carhartt accounts"},"patchStatus":"no-fix-needed","product":"carhartt.com","severity":"medium","severityNote":"12.9M accounts","slug":"carhartt-data-breach","stacks":[],"startedAt":"2026-08-25","status":"closed","summary":"In August 2026, clothing retailer Carhartt was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Aug 13, 2026; Have I Been Pwned loaded it on Aug 25, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Carhartt data breach: 12.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/carhartt-data-breach","vendor":"Carhartt"},{"auto":true,"category":"patch","closedAt":"2026-09-07","cveIds":["CVE-2026-21962"],"exploited":"in-the-wild","identifiers":["CVE-2026-21962"],"json":"https://helix.ml/threat-watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962.json","latestUpdate":{"date":"2026-08-24","title":"CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 27, 2026)"},"patchStatus":"patched","product":"HTTP Server and Oracle Weblogic Server Proxy Plug-in","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962","stacks":["java"],"startedAt":"2026-08-24","status":"closed","summary":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on Aug 24, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (CVE-2026-21962)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962","vendor":"Oracle"},{"auto":true,"category":"breach","closedAt":"2026-09-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NIUS"],"json":"https://helix.ml/threat-watch/i/nius-data-breach.json","latestUpdate":{"date":"2026-08-23","title":"Have I Been Pwned loaded 6090 breached NIUS accounts"},"patchStatus":"no-fix-needed","product":"nius.de","severity":"high","severityNote":"6090 accounts · financial data exposed","slug":"nius-data-breach","stacks":[],"startedAt":"2026-08-23","status":"closed","summary":"In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly. The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type and expiry). Exposed data: bank account numbers, email addresses, names, partial credit card data, physical addresses, purchases. The breach dates from Jul 13, 2025; Have I Been Pwned loaded it on Aug 23, 2026.","tags":["data-breach","hibp","bank-account-numbers","email-addresses","names","partial-credit-card-data","physical-addresses","purchases"],"title":"NIUS data breach: 6090 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/nius-data-breach","vendor":"NIUS"},{"auto":true,"category":"breach","closedAt":"2026-09-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GOLFCANADA"],"json":"https://helix.ml/threat-watch/i/golfcanada-data-breach.json","latestUpdate":{"date":"2026-08-22","title":"Have I Been Pwned loaded 568K breached Golf Canada accounts"},"patchStatus":"no-fix-needed","product":"golfcanada.ca","severity":"medium","severityNote":"568K accounts","slug":"golfcanada-data-breach","stacks":[],"startedAt":"2026-08-22","status":"closed","summary":"In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability. Exposed data: dates of birth, email addresses, genders, geographic locations, names, usernames. The breach dates from May 14, 2026; Have I Been Pwned loaded it on Aug 22, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","usernames"],"title":"Golf Canada data breach: 568K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/golfcanada-data-breach","vendor":"Golf Canada"},{"auto":true,"category":"patch","closedAt":"2026-09-04","cveIds":["CVE-2026-73570"],"exploited":"in-the-wild","identifiers":["CVE-2026-73570"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570.json","latestUpdate":{"date":"2026-08-21","title":"CISA added CVE-2026-73570 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 24, 2026)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"high","severityNote":"CVSS 8.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2026-73570","stacks":[],"startedAt":"2026-08-21","status":"closed","summary":"Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on Aug 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (CVE-2026-73570)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2026-09-03","cveIds":["CVE-2026-72530"],"exploited":"in-the-wild","identifiers":["CVE-2026-72530"],"json":"https://helix.ml/threat-watch/i/trueconf-server-cve-2026-72530.json","latestUpdate":{"date":"2026-08-20","title":"CISA added CVE-2026-72530 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 3, 2026)"},"patchStatus":"unknown","product":"Server","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"trueconf-server-cve-2026-72530","stacks":[],"startedAt":"2026-08-20","status":"closed","summary":"TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. CISA added CVE-2026-72530 to its Known Exploited Vulnerabilities catalog on Aug 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"TrueConf Server Code Injection Vulnerability (CVE-2026-72530)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/trueconf-server-cve-2026-72530","vendor":"TrueConf"},{"auto":true,"category":"patch","closedAt":"2026-09-03","cveIds":["CVE-2026-72529"],"exploited":"in-the-wild","identifiers":["CVE-2026-72529"],"json":"https://helix.ml/threat-watch/i/trueconf-server-cve-2026-72529.json","latestUpdate":{"date":"2026-08-20","title":"CISA added CVE-2026-72529 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 23, 2026)"},"patchStatus":"unknown","product":"Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trueconf-server-cve-2026-72529","stacks":[],"startedAt":"2026-08-20","status":"closed","summary":"TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script. CISA added CVE-2026-72529 to its Known Exploited Vulnerabilities catalog on Aug 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"TrueConf Server Missing Authentication for Critical Function Vulnerability (CVE-2026-72529)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/trueconf-server-cve-2026-72529","vendor":"TrueConf"},{"auto":true,"category":"patch","closedAt":"2026-09-02","cveIds":["CVE-2026-64849"],"exploited":"in-the-wild","identifiers":["CVE-2026-64849"],"json":"https://helix.ml/threat-watch/i/mlflow-mlflow-cve-2026-64849.json","latestUpdate":{"date":"2026-08-19","title":"CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 2, 2026)"},"patchStatus":"patched","product":"MLflow","severity":"critical","severityNote":"CVSS 9.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"mlflow-mlflow-cve-2026-64849","stacks":[],"startedAt":"2026-08-19","status":"closed","summary":"MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog on Aug 19, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"MLflow Server-Side Request Forgery Vulnerability (CVE-2026-64849)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/mlflow-mlflow-cve-2026-64849","vendor":"MLflow"},{"auto":true,"category":"breach","closedAt":"2026-09-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FANLORE"],"json":"https://helix.ml/threat-watch/i/fanlore-data-breach.json","latestUpdate":{"date":"2026-08-19","title":"Have I Been Pwned loaded 144K breached Fanlore accounts"},"patchStatus":"no-fix-needed","product":"fanlore.org","severity":"high","severityNote":"144K accounts · passwords exposed","slug":"fanlore-data-breach","stacks":[],"startedAt":"2026-08-19","status":"closed","summary":"In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP. Exposed data: email addresses, names, passwords, usernames. The breach dates from Aug 6, 2026; Have I Been Pwned loaded it on Aug 19, 2026.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"Fanlore data breach: 144K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/fanlore-data-breach","vendor":"Fanlore"},{"auto":true,"category":"breach","closedAt":"2026-09-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OZHAIRANDBEAUTY"],"json":"https://helix.ml/threat-watch/i/ozhairandbeauty-data-breach.json","latestUpdate":{"date":"2026-08-19","title":"Have I Been Pwned loaded 2.0M breached Oz Hair and Beauty accounts"},"patchStatus":"no-fix-needed","product":"ozhairandbeauty.com","severity":"medium","severityNote":"2.0M accounts","slug":"ozhairandbeauty-data-breach","stacks":[],"startedAt":"2026-08-19","status":"closed","summary":"In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases. Exposed data: email addresses, geographic locations, names, phone numbers, purchases. The breach dates from Aug 15, 2026; Have I Been Pwned loaded it on Aug 19, 2026.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","phone-numbers","purchases"],"title":"Oz Hair and Beauty data breach: 2.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ozhairandbeauty-data-breach","vendor":"Oz Hair and Beauty"},{"auto":true,"category":"patch","closedAt":"2026-09-01","cveIds":["CVE-2026-33824"],"exploited":"in-the-wild","identifiers":["CVE-2026-33824"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824.json","latestUpdate":{"date":"2026-08-18","title":"CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 21, 2026)"},"patchStatus":"unknown","product":"Internet Key Exchange (IKE) Service Extensions","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824","stacks":[],"startedAt":"2026-08-18","status":"closed","summary":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog on Aug 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-415"],"title":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability (CVE-2026-33824)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-09-01","cveIds":["CVE-2026-59310"],"exploited":"in-the-wild","identifiers":["CVE-2026-59310"],"json":"https://helix.ml/threat-watch/i/broadcom-vmware-vcenter-cve-2026-59310.json","latestUpdate":{"date":"2026-08-18","title":"CISA added CVE-2026-59310 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 21, 2026)"},"patchStatus":"unknown","product":"VMware vCenter","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"broadcom-vmware-vcenter-cve-2026-59310","stacks":["cloud"],"startedAt":"2026-08-18","status":"closed","summary":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities catalog on Aug 18, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-22"],"title":"Broadcom VMware vCenter Path Traversal Vulnerability (CVE-2026-59310)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/broadcom-vmware-vcenter-cve-2026-59310","vendor":"Broadcom"},{"auto":true,"category":"patch","closedAt":"2026-09-01","cveIds":["CVE-2026-55040"],"exploited":"in-the-wild","identifiers":["CVE-2026-55040"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-55040.json","latestUpdate":{"date":"2026-08-18","title":"CISA added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 21, 2026)"},"patchStatus":"patched","product":"SharePoint","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2026-55040","stacks":["windows"],"startedAt":"2026-08-18","status":"closed","summary":"Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on Aug 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1390"],"title":"Microsoft SharePoint Weak Authentication Vulnerability (CVE-2026-55040)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-55040","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-09-01","cveIds":["CVE-2026-65400"],"exploited":"in-the-wild","identifiers":["CVE-2026-65400"],"json":"https://helix.ml/threat-watch/i/apple-macos-cve-2026-65400.json","latestUpdate":{"date":"2026-08-18","title":"CISA added CVE-2026-65400 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 21, 2026)"},"patchStatus":"unknown","product":"macOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-macos-cve-2026-65400","stacks":["macos"],"startedAt":"2026-08-18","status":"closed","summary":"Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities catalog on Aug 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Apple macOS Improper Authentication Vulnerability (CVE-2026-65400)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-macos-cve-2026-65400","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-08-31","cveIds":["CVE-2025-62593"],"exploited":"in-the-wild","identifiers":["CVE-2025-62593"],"json":"https://helix.ml/threat-watch/i/ray-project-ray-cve-2025-62593.json","latestUpdate":{"date":"2026-08-17","title":"CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 20, 2026)"},"patchStatus":"patched","product":"Ray","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ray-project-ray-cve-2025-62593","stacks":[],"startedAt":"2026-08-17","status":"closed","summary":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on Aug 17, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94","cwe-352"],"title":"Ray-Project Ray Code Injection Vulnerability (CVE-2025-62593)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ray-project-ray-cve-2025-62593","vendor":"Ray-Project"},{"auto":true,"category":"breach","closedAt":"2026-08-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RINGCENTRAL"],"json":"https://helix.ml/threat-watch/i/ringcentral-data-breach.json","latestUpdate":{"date":"2026-08-13","title":"Have I Been Pwned loaded 1.6M breached RingCentral accounts"},"patchStatus":"no-fix-needed","product":"ringcentral.com","severity":"medium","severityNote":"1.6M accounts","slug":"ringcentral-data-breach","stacks":[],"startedAt":"2026-08-13","status":"closed","summary":"In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected \"a limited portion of RingCentral customers\" and that it was communicating directly with those affected. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jul 27, 2026; Have I Been Pwned loaded it on Aug 13, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"RingCentral data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ringcentral-data-breach","vendor":"RingCentral"},{"auto":true,"category":"patch","closedAt":"2026-08-25","cveIds":["CVE-2026-20349"],"exploited":"in-the-wild","identifiers":["CVE-2026-20349"],"json":"https://helix.ml/threat-watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat-defense-ftd-cve-2026-20349.json","latestUpdate":{"date":"2026-08-11","title":"CISA added CVE-2026-20349 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 14, 2026)"},"patchStatus":"unknown","product":"Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat-defense-ftd-cve-2026-20349","stacks":["network"],"startedAt":"2026-08-11","status":"closed","summary":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities catalog on Aug 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-244"],"title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability (CVE-2026-20349)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat-defense-ftd-cve-2026-20349","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-08-25","cveIds":["CVE-2026-68820"],"exploited":"in-the-wild","identifiers":["CVE-2026-68820"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820.json","latestUpdate":{"date":"2026-08-11","title":"CISA added CVE-2026-68820 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 25, 2026)"},"patchStatus":"patched","product":"Windows Ancillary Function Driver for WinSock ","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820","stacks":["windows"],"startedAt":"2026-08-11","status":"closed","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on Aug 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (CVE-2026-68820)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-08-25","cveIds":["CVE-2026-72898"],"exploited":"in-the-wild","identifiers":["CVE-2026-72898"],"json":"https://helix.ml/threat-watch/i/metabase-metabase-cve-2026-72898.json","latestUpdate":{"date":"2026-08-11","title":"CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 14, 2026)"},"patchStatus":"patched","product":"Metabase","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"metabase-metabase-cve-2026-72898","stacks":[],"startedAt":"2026-08-11","status":"closed","summary":"Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. CISA added CVE-2026-72898 to its Known Exploited Vulnerabilities catalog on Aug 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Metabase SQL Injection Vulnerability (CVE-2026-72898)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/metabase-metabase-cve-2026-72898","vendor":"Metabase"},{"auto":true,"category":"breach","closedAt":"2026-08-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ALCON"],"json":"https://helix.ml/threat-watch/i/alcon-data-breach.json","latestUpdate":{"date":"2026-08-09","title":"Have I Been Pwned loaded 218K breached Alcon accounts"},"patchStatus":"no-fix-needed","product":"alcon.com","severity":"medium","severityNote":"218K accounts","slug":"alcon-data-breach","stacks":[],"startedAt":"2026-08-09","status":"closed","summary":"In August 2026, the Alcon eye care company was named in a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Aug 1, 2026; Have I Been Pwned loaded it on Aug 9, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Alcon data breach: 218K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/alcon-data-breach","vendor":"Alcon"},{"auto":true,"category":"breach","closedAt":"2026-08-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BRINKSHOME"],"json":"https://helix.ml/threat-watch/i/brinkshome-data-breach.json","latestUpdate":{"date":"2026-08-08","title":"Have I Been Pwned loaded 732K breached Brinks Home accounts"},"patchStatus":"no-fix-needed","product":"brinkshome.com","severity":"high","severityNote":"732K accounts · financial data exposed","slug":"brinkshome-data-breach","stacks":[],"startedAt":"2026-08-08","status":"closed","summary":"In July 2026, Brinks Home was targeted in a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice, they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties \"consistent with applicable law\". Exposed data: dates of birth, email addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Jul 13, 2026; Have I Been Pwned loaded it on Aug 8, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"Brinks Home data breach: 732K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/brinkshome-data-breach","vendor":"Brinks Home"},{"auto":true,"category":"patch","closedAt":"2026-08-21","cveIds":["CVE-2026-8037"],"exploited":"in-the-wild","identifiers":["CVE-2026-8037"],"json":"https://helix.ml/threat-watch/i/progress-loadmaster-cve-2026-8037.json","latestUpdate":{"date":"2026-08-07","title":"CISA added CVE-2026-8037 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2026)"},"patchStatus":"patched","product":"LoadMaster","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-loadmaster-cve-2026-8037","stacks":[],"startedAt":"2026-08-07","status":"closed","summary":"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalog on Aug 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Progress LoadMaster Command Injection Vulnerability (CVE-2026-8037)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/progress-loadmaster-cve-2026-8037","vendor":"Progress"},{"auto":true,"category":"breach","closedAt":"2026-08-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EXACTSCIENCES"],"json":"https://helix.ml/threat-watch/i/exactsciences-data-breach.json","latestUpdate":{"date":"2026-08-07","title":"Have I Been Pwned loaded 10.9M breached Exact Sciences accounts"},"patchStatus":"no-fix-needed","product":"exactsciences.com","severity":"high","severityNote":"10.9M accounts","slug":"exactsciences-data-breach","stacks":[],"startedAt":"2026-08-07","status":"closed","summary":"In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group claimed to have obtained data from the company's cancer diagnostics business, which they later published publicly. The breach contained 10.9M unique email addresses belonging to customers, patients and healthcare providers, along with names, addresses, phone numbers and health records. Abbott subsequently published a public notice advising that \"some of the impacted files contain personal information and/or personal health information\" and that more specific information would follow once their review of the incident was complete. For context, Exact Sciences is the maker of the Cologuard at-home colorectal cancer screening test. Exposed data: dates of birth, email addresses, genders, names, personal health data, phone numbers, physical addresses. The breach dates from Jul 15, 2026; Have I Been Pwned loaded it on Aug 7, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","personal-health-data","phone-numbers","physical-addresses"],"title":"Exact Sciences data breach: 10.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/exactsciences-data-breach","vendor":"Exact Sciences"},{"auto":true,"category":"patch","closedAt":"2026-08-19","cveIds":["CVE-2026-63077"],"exploited":"in-the-wild","identifiers":["CVE-2026-63077"],"json":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2026-63077.json","latestUpdate":{"date":"2026-08-05","title":"CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 8, 2026)"},"patchStatus":"unknown","product":"TeamCity","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jetbrains-teamcity-cve-2026-63077","stacks":["devtools","rust"],"startedAt":"2026-08-05","status":"closed","summary":"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on Aug 5, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502"],"title":"JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (CVE-2026-63077)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2026-63077","vendor":"JetBrains"},{"auto":true,"category":"breach","closedAt":"2026-08-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INTERCONSECURITY"],"json":"https://helix.ml/threat-watch/i/interconsecurity-data-breach.json","latestUpdate":{"date":"2026-08-05","title":"Have I Been Pwned loaded 276K breached Inter-Con Security accounts"},"patchStatus":"no-fix-needed","product":"icsecurity.com","severity":"medium","severityNote":"276K accounts","slug":"interconsecurity-data-breach","stacks":[],"startedAt":"2026-08-05","status":"closed","summary":"In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign. The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses. The breach dates from Jun 18, 2026; Have I Been Pwned loaded it on Aug 5, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses"],"title":"Inter-Con Security data breach: 276K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/interconsecurity-data-breach","vendor":"Inter-Con Security"},{"auto":true,"category":"patch","closedAt":"2026-08-18","cveIds":["CVE-2026-18556"],"exploited":"in-the-wild","identifiers":["CVE-2026-18556"],"json":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2026-18556.json","latestUpdate":{"date":"2026-08-04","title":"CISA added CVE-2026-18556 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 7, 2026)"},"patchStatus":"unknown","product":"N-central","severity":"high","severityNote":"CVSS 7.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"n-able-n-central-cve-2026-18556","stacks":[],"startedAt":"2026-08-04","status":"closed","summary":"N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass. CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on Aug 4, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-18556)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2026-18556","vendor":"N-able"},{"auto":true,"category":"patch","closedAt":"2026-08-18","cveIds":["CVE-2026-34486"],"exploited":"in-the-wild","identifiers":["CVE-2026-34486"],"json":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2026-34486.json","latestUpdate":{"date":"2026-08-04","title":"CISA added CVE-2026-34486 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 7, 2026)"},"patchStatus":"unknown","product":"Tomcat","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-tomcat-cve-2026-34486","stacks":["java"],"startedAt":"2026-08-04","status":"closed","summary":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. CISA added CVE-2026-34486 to its Known Exploited Vulnerabilities catalog on Aug 4, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-311"],"title":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (CVE-2026-34486)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2026-34486","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2026-08-18","cveIds":["CVE-2026-9198"],"exploited":"in-the-wild","identifiers":["CVE-2026-9198"],"json":"https://helix.ml/threat-watch/i/ibm-langflow-cve-2026-9198.json","latestUpdate":{"date":"2026-08-04","title":"CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 7, 2026)"},"patchStatus":"unknown","product":"Langflow","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-langflow-cve-2026-9198","stacks":[],"startedAt":"2026-08-04","status":"closed","summary":"Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on Aug 4, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"IBM Langflow Code Injection Vulnerability (CVE-2026-9198)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ibm-langflow-cve-2026-9198","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2026-08-17","cveIds":["CVE-2026-18577"],"exploited":"in-the-wild","identifiers":["CVE-2026-18577"],"json":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2026-18577.json","latestUpdate":{"date":"2026-08-03","title":"CISA added CVE-2026-18577 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 6, 2026)"},"patchStatus":"patched","product":"N-central","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"n-able-n-central-cve-2026-18577","stacks":[],"startedAt":"2026-08-03","status":"closed","summary":"N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog on Aug 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-18577)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2026-18577","vendor":"N-able"},{"auto":true,"category":"breach","closedAt":"2026-08-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPLITVPN"],"json":"https://helix.ml/threat-watch/i/splitvpn-data-breach.json","latestUpdate":{"date":"2026-08-01","title":"Have I Been Pwned loaded 865K breached SplitVPN accounts"},"patchStatus":"no-fix-needed","product":"splitvpn.io","severity":"high","severityNote":"865K accounts · financial data exposed","slug":"splitvpn-data-breach","stacks":[],"startedAt":"2026-08-01","status":"closed","summary":"In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach. The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date). Exposed data: device information, email addresses, geographic locations, ip addresses, partial credit card data. The breach dates from Jul 21, 2026; Have I Been Pwned loaded it on Aug 1, 2026.","tags":["data-breach","hibp","device-information","email-addresses","geographic-locations","ip-addresses","partial-credit-card-data"],"title":"SplitVPN data breach: 865K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/splitvpn-data-breach","vendor":"SplitVPN"},{"auto":true,"category":"patch","closedAt":"2026-08-12","cveIds":["CVE-2026-20316"],"exploited":"in-the-wild","identifiers":["CVE-2026-20316"],"json":"https://helix.ml/threat-watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316.json","latestUpdate":{"date":"2026-07-29","title":"CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 1, 2026)"},"patchStatus":"unknown","product":"Secure Firewall Management Center (FMC)","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-firewall-management-center-fmc-cve-2026-20316","stacks":["network"],"startedAt":"2026-07-29","status":"closed","summary":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog on Jul 29, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-259"],"title":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (CVE-2026-20316)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-08-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOUSTONCITYCOLLEGE"],"json":"https://helix.ml/threat-watch/i/houstoncitycollege-data-breach.json","latestUpdate":{"date":"2026-07-28","title":"Have I Been Pwned loaded 831K breached Houston City College accounts"},"patchStatus":"no-fix-needed","product":"hccs.edu","severity":"medium","severityNote":"831K accounts","slug":"houstoncitycollege-data-breach","stacks":[],"startedAt":"2026-07-28","status":"closed","summary":"In June 2026, Houston City College was the target of a ShinyHunters \"pay or leak\" extortion campaign. Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni. Exposed data: academic records, citizenship statuses, dates of birth, email addresses, genders, names, phone numbers, physical addresses. The breach dates from Jun 16, 2026; Have I Been Pwned loaded it on Jul 28, 2026.","tags":["data-breach","hibp","academic-records","citizenship-statuses","dates-of-birth","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"Houston City College data breach: 831K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/houstoncitycollege-data-breach","vendor":"Houston City College"},{"auto":true,"category":"patch","closedAt":"2026-08-10","cveIds":["CVE-2025-68686"],"exploited":"in-the-wild","identifiers":["CVE-2025-68686"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2025-68686.json","latestUpdate":{"date":"2026-07-27","title":"CISA added CVE-2025-68686 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2026)"},"patchStatus":"unknown","product":"FortiOS","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2025-68686","stacks":["network","vpn"],"startedAt":"2026-07-27","status":"closed","summary":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog on Jul 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-68686)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2025-68686","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2026-08-10","cveIds":["CVE-2026-16812"],"exploited":"in-the-wild","identifiers":["CVE-2026-16812"],"json":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-16812.json","latestUpdate":{"date":"2026-07-27","title":"CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 30, 2026)"},"patchStatus":"unknown","product":"VeloCloud Orchestrator","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"arista-velocloud-orchestrator-cve-2026-16812","stacks":["network"],"startedAt":"2026-07-27","status":"closed","summary":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog on Jul 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (CVE-2026-16812)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-16812","vendor":"Arista"},{"auto":true,"category":"patch","closedAt":"2026-08-05","cveIds":["CVE-2026-16232"],"exploited":"in-the-wild","identifiers":["CVE-2026-16232"],"json":"https://helix.ml/threat-watch/i/check-point-smartconsole-cve-2026-16232.json","latestUpdate":{"date":"2026-07-22","title":"CISA added CVE-2026-16232 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 25, 2026)"},"patchStatus":"patched","product":"SmartConsole","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"check-point-smartconsole-cve-2026-16232","stacks":["network"],"startedAt":"2026-07-22","status":"closed","summary":"Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog on Jul 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Check Point SmartConsole Improper Authentication Vulnerability (CVE-2026-16232)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/check-point-smartconsole-cve-2026-16232","vendor":"Check Point"},{"auto":true,"category":"patch","closedAt":"2026-08-05","cveIds":["CVE-2026-50522"],"exploited":"in-the-wild","identifiers":["CVE-2026-50522"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-50522.json","latestUpdate":{"date":"2026-07-22","title":"CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 25, 2026)"},"patchStatus":"patched","product":"SharePoint","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2026-50522","stacks":["rust","windows"],"startedAt":"2026-07-22","status":"closed","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on Jul 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-50522)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-50522","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-08-04","cveIds":["CVE-2026-60137"],"exploited":"in-the-wild","identifiers":["CVE-2026-60137"],"json":"https://helix.ml/threat-watch/i/wordpress-core-cve-2026-60137.json","latestUpdate":{"date":"2026-07-21","title":"CISA added CVE-2026-60137 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 4, 2026)"},"patchStatus":"unknown","product":"Core","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"wordpress-core-cve-2026-60137","stacks":["wordpress"],"startedAt":"2026-07-21","status":"closed","summary":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137 to its Known Exploited Vulnerabilities catalog on Jul 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","sql-injection","cwe-89"],"title":"WordPress Core SQL Injection Vulnerability (CVE-2026-60137)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/wordpress-core-cve-2026-60137","vendor":"WordPress"},{"auto":true,"category":"patch","closedAt":"2026-08-04","cveIds":["CVE-2026-63030"],"exploited":"in-the-wild","identifiers":["CVE-2026-63030"],"json":"https://helix.ml/threat-watch/i/wordpress-core-cve-2026-63030.json","latestUpdate":{"date":"2026-07-21","title":"CISA added CVE-2026-63030 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 24, 2026)"},"patchStatus":"unknown","product":"Core","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"wordpress-core-cve-2026-63030","stacks":["wordpress"],"startedAt":"2026-07-21","status":"closed","summary":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. CISA added CVE-2026-63030 to its Known Exploited Vulnerabilities catalog on Jul 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","sql-injection","cwe-436"],"title":"WordPress Core Interpretation Conflict Vulnerability (CVE-2026-63030)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/wordpress-core-cve-2026-63030","vendor":"WordPress"},{"auto":true,"category":"patch","closedAt":"2026-08-04","cveIds":["CVE-2026-0770"],"exploited":"in-the-wild","identifiers":["CVE-2026-0770"],"json":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2026-0770.json","latestUpdate":{"date":"2026-07-21","title":"CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 24, 2026)"},"patchStatus":"unknown","product":"Langflow","severity":"critical","severityNote":"CVSS 9.8 (v3.0) · exploited in the wild (CISA KEV)","slug":"langflow-langflow-cve-2026-0770","stacks":["rust"],"startedAt":"2026-07-21","status":"closed","summary":"Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog on Jul 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-829"],"title":"Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2026-0770)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2026-0770","vendor":"Langflow"},{"auto":true,"category":"patch","closedAt":"2026-08-04","cveIds":["CVE-2021-27137"],"exploited":"in-the-wild","identifiers":["CVE-2021-27137"],"json":"https://helix.ml/threat-watch/i/dd-wrt-dd-wrt-cve-2021-27137.json","latestUpdate":{"date":"2026-07-21","title":"CISA added CVE-2021-27137 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 24, 2026)"},"patchStatus":"patched","product":"DD-WRT","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"dd-wrt-dd-wrt-cve-2021-27137","stacks":[],"startedAt":"2026-07-21","status":"closed","summary":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. CISA added CVE-2021-27137 to its Known Exploited Vulnerabilities catalog on Jul 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-121"],"title":"DD-WRT Stack-Based Buffer Overflow Vulnerability (CVE-2021-27137)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/dd-wrt-dd-wrt-cve-2021-27137","vendor":"DD-WRT"},{"auto":true,"category":"breach","closedAt":"2026-08-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUNO"],"json":"https://helix.ml/threat-watch/i/suno-data-breach.json","latestUpdate":{"date":"2026-07-20","title":"Have I Been Pwned loaded 55.3M breached Suno accounts"},"patchStatus":"no-fix-needed","product":"suno.com","severity":"high","severityNote":"55.3M accounts · financial data exposed","slug":"suno-data-breach","stacks":[],"startedAt":"2026-07-20","status":"closed","summary":"In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year. The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data including the card type, expiry date and last 4 digits. The company advised that \"Suno does not have access to customers' full credit card numbers in Stripe\". Exposed data: email addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Nov 25, 2025; Have I Been Pwned loaded it on Jul 20, 2026.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"Suno data breach: 55.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/suno-data-breach","vendor":"Suno"},{"auto":true,"category":"breach","closedAt":"2026-08-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PAIDWORK"],"json":"https://helix.ml/threat-watch/i/paidwork-data-breach.json","latestUpdate":{"date":"2026-07-19","title":"Have I Been Pwned loaded 23.3M breached Paidwork accounts"},"patchStatus":"no-fix-needed","product":"paidwork.com","severity":"high","severityNote":"23.3M accounts · passwords exposed · financial data exposed","slug":"paidwork-data-breach","stacks":[],"startedAt":"2026-07-19","status":"closed","summary":"In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale. Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes. Exposed data: bank account numbers, dates of birth, device information, education levels, email addresses, financial transactions, genders, ip addresses, names, passwords, personal interests, phone numbers, physical addresses, profile photos. The breach dates from Mar 29, 2026; Have I Been Pwned loaded it on Jul 19, 2026.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","device-information","education-levels","email-addresses","financial-transactions","genders","ip-addresses","names","passwords","personal-interests","phone-numbers"],"title":"Paidwork data breach: 23.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/paidwork-data-breach","vendor":"Paidwork"},{"auto":true,"category":"patch","closedAt":"2026-07-30","cveIds":["CVE-2026-58644"],"exploited":"in-the-wild","identifiers":["CVE-2026-58644"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-58644.json","latestUpdate":{"date":"2026-07-16","title":"CISA added CVE-2026-58644 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 19, 2026)"},"patchStatus":"patched","product":"SharePoint","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2026-58644","stacks":["rust","windows"],"startedAt":"2026-07-16","status":"closed","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog on Jul 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-58644)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-58644","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-07-30","cveIds":["CVE-2026-25089"],"exploited":"in-the-wild","identifiers":["CVE-2026-25089"],"json":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-cve-2026-25089.json","latestUpdate":{"date":"2026-07-16","title":"CISA added CVE-2026-25089 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 19, 2026)"},"patchStatus":"unknown","product":"FortiSandbox","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortisandbox-cve-2026-25089","stacks":["network"],"startedAt":"2026-07-16","status":"closed","summary":"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA added CVE-2026-25089 to its Known Exploited Vulnerabilities catalog on Jul 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-cve-2026-25089","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2026-07-30","cveIds":["CVE-2026-39808"],"exploited":"in-the-wild","identifiers":["CVE-2026-39808"],"json":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-cve-2026-39808.json","latestUpdate":{"date":"2026-07-16","title":"CISA added CVE-2026-39808 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 19, 2026)"},"patchStatus":"unknown","product":"FortiSandbox","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortisandbox-cve-2026-39808","stacks":["network"],"startedAt":"2026-07-16","status":"closed","summary":"Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. CISA added CVE-2026-39808 to its Known Exploited Vulnerabilities catalog on Jul 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-cve-2026-39808","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2026-07-29","cveIds":["CVE-2026-46817"],"exploited":"in-the-wild","identifiers":["CVE-2026-46817"],"json":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2026-46817.json","latestUpdate":{"date":"2026-07-15","title":"CISA added CVE-2026-46817 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2026)"},"patchStatus":"unknown","product":"E-Business Suite","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-e-business-suite-cve-2026-46817","stacks":[],"startedAt":"2026-07-15","status":"closed","summary":"Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on Jul 15, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-269","cwe-287","cwe-306"],"title":"Oracle E-Business Suite Improper Privilege Management Vulnerability (CVE-2026-46817)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2026-46817","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2026-07-29","cveIds":["CVE-2023-4346"],"exploited":"in-the-wild","identifiers":["CVE-2023-4346"],"json":"https://helix.ml/threat-watch/i/knx-association-knx-protocol-connection-authorization-option-1-cve-2023-4346.json","latestUpdate":{"date":"2026-07-15","title":"CISA added CVE-2023-4346 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 29, 2026)"},"patchStatus":"unknown","product":"KNX Protocol Connection Authorization Option 1","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"knx-association-knx-protocol-connection-authorization-option-1-cve-2023-4346","stacks":[],"startedAt":"2026-07-15","status":"closed","summary":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. CISA added CVE-2023-4346 to its Known Exploited Vulnerabilities catalog on Jul 15, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-645"],"title":"KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability (CVE-2023-4346)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/knx-association-knx-protocol-connection-authorization-option-1-cve-2023-4346","vendor":"KNX Association"},{"auto":true,"category":"breach","closedAt":"2026-07-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GOOSECREEK"],"json":"https://helix.ml/threat-watch/i/goosecreek-data-breach.json","latestUpdate":{"date":"2026-07-15","title":"Have I Been Pwned loaded 6.6M breached Goose Creek accounts"},"patchStatus":"no-fix-needed","product":"goosecreek.com","severity":"medium","severityNote":"6.6M accounts","slug":"goosecreek-data-breach","stacks":[],"startedAt":"2026-07-15","status":"closed","summary":"In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers, claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware of the reports but was unable to provide Have I Been Pwned with any further information at the time of publication. Exposed data: email addresses, names, phone numbers, physical addresses, purchases. The breach dates from Jun 9, 2026; Have I Been Pwned loaded it on Jul 15, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"Goose Creek data breach: 6.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/goosecreek-data-breach","vendor":"Goose Creek"},{"auto":true,"category":"breach","closedAt":"2026-07-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLUKE"],"json":"https://helix.ml/threat-watch/i/fluke-data-breach.json","latestUpdate":{"date":"2026-07-15","title":"Have I Been Pwned loaded 821K breached Fluke accounts"},"patchStatus":"no-fix-needed","product":"fluke.com","severity":"medium","severityNote":"821K accounts","slug":"fluke-data-breach","stacks":[],"startedAt":"2026-07-15","status":"closed","summary":"In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present. Exposed data: email addresses, employers, job titles, names, physical addresses, support tickets. The breach dates from Jul 1, 2026; Have I Been Pwned loaded it on Jul 15, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","physical-addresses","support-tickets"],"title":"Fluke data breach: 821K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/fluke-data-breach","vendor":"Fluke"},{"auto":true,"category":"patch","closedAt":"2026-07-28","cveIds":["CVE-2026-56155"],"exploited":"in-the-wild","identifiers":["CVE-2026-56155"],"json":"https://helix.ml/threat-watch/i/microsoft-active-directory-federation-services-cve-2026-56155.json","latestUpdate":{"date":"2026-07-14","title":"CISA added CVE-2026-56155 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2026)"},"patchStatus":"unknown","product":"Active Directory Federation Services","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-active-directory-federation-services-cve-2026-56155","stacks":[],"startedAt":"2026-07-14","status":"closed","summary":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog on Jul 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1220"],"title":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability (CVE-2026-56155)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-active-directory-federation-services-cve-2026-56155","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-07-28","cveIds":["CVE-2026-56164"],"exploited":"in-the-wild","identifiers":["CVE-2026-56164"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2026-56164.json","latestUpdate":{"date":"2026-07-14","title":"CISA added CVE-2026-56164 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 17, 2026)"},"patchStatus":"unknown","product":"SharePoint Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-server-cve-2026-56164","stacks":["windows"],"startedAt":"2026-07-14","status":"closed","summary":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on Jul 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability (CVE-2026-56164)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2026-56164","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-07-28","cveIds":["CVE-2026-15409"],"exploited":"in-the-wild","identifiers":["CVE-2026-15409"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-15409.json","latestUpdate":{"date":"2026-07-14","title":"CISA added CVE-2026-15409 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 17, 2026)"},"patchStatus":"unknown","product":"SMA1000 Appliances","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma1000-appliances-cve-2026-15409","stacks":["vpn"],"startedAt":"2026-07-14","status":"closed","summary":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. CISA added CVE-2026-15409 to its Known Exploited Vulnerabilities catalog on Jul 14, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","ssrf","cwe-918"],"title":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (CVE-2026-15409)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-15409","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2026-07-28","cveIds":["CVE-2026-15410"],"exploited":"in-the-wild","identifiers":["CVE-2026-15410"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-15410.json","latestUpdate":{"date":"2026-07-14","title":"CISA added CVE-2026-15410 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 17, 2026)"},"patchStatus":"unknown","product":"SMA1000 Appliances","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma1000-appliances-cve-2026-15410","stacks":["vpn"],"startedAt":"2026-07-14","status":"closed","summary":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. CISA added CVE-2026-15410 to its Known Exploited Vulnerabilities catalog on Jul 14, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"SonicWall SMA1000 Appliances Code Injection Vulnerability (CVE-2026-15410)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2026-15410","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2026-07-27","cveIds":["CVE-2008-4128"],"exploited":"in-the-wild","identifiers":["CVE-2008-4128"],"json":"https://helix.ml/threat-watch/i/cisco-ios-cve-2008-4128.json","latestUpdate":{"date":"2026-07-13","title":"CISA added CVE-2008-4128 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 16, 2026)"},"patchStatus":"unknown","product":"IOS","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-cve-2008-4128","stacks":["ios","network"],"startedAt":"2026-07-13","status":"closed","summary":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI. CISA added CVE-2008-4128 to its Known Exploited Vulnerabilities catalog on Jul 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-352"],"title":"Cisco IOS Cross-Site Request Forgery Vulnerability (CVE-2008-4128)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-ios-cve-2008-4128","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-07-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GLENDALECOMMUNITYCOLLEGE"],"json":"https://helix.ml/threat-watch/i/glendalecommunitycollege-data-breach.json","latestUpdate":{"date":"2026-07-11","title":"Have I Been Pwned loaded 793K breached Glendale Community College accounts"},"patchStatus":"no-fix-needed","product":"glendale.edu","severity":"medium","severityNote":"793K accounts","slug":"glendalecommunitycollege-data-breach","stacks":[],"startedAt":"2026-07-11","status":"closed","summary":"In June 2026, Glendale Community College was the target of a ShinyHunters \"pay or leak\" extortion campaign. Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice, the college advised that \"the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information\". Exposed data: academic records, dates of birth, email addresses, genders, government issued ids, names, phone numbers, physical addresses. The breach dates from Jun 15, 2026; Have I Been Pwned loaded it on Jul 11, 2026.","tags":["data-breach","hibp","academic-records","dates-of-birth","email-addresses","genders","government-issued-ids","names","phone-numbers","physical-addresses"],"title":"Glendale Community College data breach: 793K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/glendalecommunitycollege-data-breach","vendor":"Glendale Community College"},{"auto":true,"category":"patch","closedAt":"2026-07-24","cveIds":["CVE-2026-56291"],"exploited":"in-the-wild","identifiers":["CVE-2026-56291"],"json":"https://helix.ml/threat-watch/i/balbooa-forms-cve-2026-56291.json","latestUpdate":{"date":"2026-07-10","title":"CISA added CVE-2026-56291 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2026)"},"patchStatus":"unknown","product":"Forms","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"balbooa-forms-cve-2026-56291","stacks":[],"startedAt":"2026-07-10","status":"closed","summary":"Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE. CISA added CVE-2026-56291 to its Known Exploited Vulnerabilities catalog on Jul 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-434"],"title":"Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-56291)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/balbooa-forms-cve-2026-56291","vendor":"Balbooa"},{"auto":true,"category":"patch","closedAt":"2026-07-24","cveIds":["CVE-2026-48939"],"exploited":"in-the-wild","identifiers":["CVE-2026-48939"],"json":"https://helix.ml/threat-watch/i/icagenda-icagenda-cve-2026-48939.json","latestUpdate":{"date":"2026-07-10","title":"CISA added CVE-2026-48939 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2026)"},"patchStatus":"unknown","product":"iCagenda","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"icagenda-icagenda-cve-2026-48939","stacks":[],"startedAt":"2026-07-10","status":"closed","summary":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. CISA added CVE-2026-48939 to its Known Exploited Vulnerabilities catalog on Jul 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48939)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/icagenda-icagenda-cve-2026-48939","vendor":"iCagenda"},{"auto":true,"category":"patch","closedAt":"2026-07-21","cveIds":["CVE-2026-48908"],"exploited":"in-the-wild","identifiers":["CVE-2026-48908"],"json":"https://helix.ml/threat-watch/i/joomshaper-sp-page-builder-cve-2026-48908.json","latestUpdate":{"date":"2026-07-07","title":"CISA added CVE-2026-48908 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2026)"},"patchStatus":"unknown","product":"SP Page Builder","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"joomshaper-sp-page-builder-cve-2026-48908","stacks":[],"startedAt":"2026-07-07","status":"closed","summary":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. CISA added CVE-2026-48908 to its Known Exploited Vulnerabilities catalog on Jul 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48908)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/joomshaper-sp-page-builder-cve-2026-48908","vendor":"JoomShaper"},{"auto":true,"category":"patch","closedAt":"2026-07-21","cveIds":["CVE-2026-55255"],"exploited":"in-the-wild","identifiers":["CVE-2026-55255"],"json":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2026-55255.json","latestUpdate":{"date":"2026-07-07","title":"CISA added CVE-2026-55255 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2026)"},"patchStatus":"patched","product":"Langflow","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"langflow-langflow-cve-2026-55255","stacks":[],"startedAt":"2026-07-07","status":"closed","summary":"Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. CISA added CVE-2026-55255 to its Known Exploited Vulnerabilities catalog on Jul 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-639"],"title":"Langflow Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-55255)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2026-55255","vendor":"Langflow"},{"auto":true,"category":"patch","closedAt":"2026-07-21","cveIds":["CVE-2026-56290"],"exploited":"in-the-wild","identifiers":["CVE-2026-56290"],"json":"https://helix.ml/threat-watch/i/joomlack-page-builder-cve-2026-56290.json","latestUpdate":{"date":"2026-07-07","title":"CISA added CVE-2026-56290 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2026)"},"patchStatus":"patched","product":"Page Builder","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"joomlack-page-builder-cve-2026-56290","stacks":["php"],"startedAt":"2026-07-07","status":"closed","summary":"Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. CISA added CVE-2026-56290 to its Known Exploited Vulnerabilities catalog on Jul 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-284"],"title":"Joomlack Page Builder Improper Access Control Vulnerability (CVE-2026-56290)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/joomlack-page-builder-cve-2026-56290","vendor":"Joomlack"},{"auto":true,"category":"patch","closedAt":"2026-07-21","cveIds":["CVE-2026-48282"],"exploited":"in-the-wild","identifiers":["CVE-2026-48282"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2026-48282.json","latestUpdate":{"date":"2026-07-07","title":"CISA added CVE-2026-48282 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2026)"},"patchStatus":"unknown","product":"ColdFusion","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2026-48282","stacks":[],"startedAt":"2026-07-07","status":"closed","summary":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog on Jul 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48282)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2026-48282","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2026-10-25","cveIds":["CVE-2026-77363","CVE-2026-77366"],"exploited":"none-known","identifiers":["CVE-2026-77363","CVE-2026-77366","GHSA-84c9-qqpq-2pq5","GHSA-pqh8-4pj7-32xx"],"json":"https://helix.ml/threat-watch/i/obsidian-tc-two-critical-flaws-let-tokens-reach-any-vault-and-drive-by-pages-access-loopback-server-cve-2026-77366-cve-2.json","latestUpdate":{"date":"2026-07-03","title":"obsidian-tc: two critical flaws let tokens reach any vault and drive-by pages access loopback server (CVE-2026-77366, CVE-2026-77363)"},"patchStatus":"patched","product":"obsidian-tc (npm)","severity":"critical","severityNote":"CVSS 9.9 and 9.6; no known in-the-wild exploitation; EPSS 0.308%/0.157%","slug":"obsidian-tc-two-critical-flaws-let-tokens-reach-any-vault-and-drive-by-pages-access-loopback-server-cve-2026-77366-cve-2","stacks":["npm","node","devtools"],"startedAt":"2026-07-03","status":"closed","summary":"Two critical advisories were published for the obsidian-tc npm package (MCP server for Obsidian vaults). First, tool dispatch never checked the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and JWTs carried no vault claim, so any valid token could read, write, or delete any configured vault across ~90 tool sites, defeating multi-tenant isolation (CVE-2026-77366, CVSS 9.9). Second, the Streamable HTTP transport lacked Origin validation and DNS-rebinding protection; with the documented auth.mode \"none\" loopback default, a malicious web page could POST to http://127.0.0.1/mcp and receive full vault read/write access via DNS rebinding (CVE-2026-77363, CVSS 9.6). Both fixed in 1.3.1; no exploitation reported.","tags":["auth-bypass","idor","dns-rebinding","origin-validation","multi-tenant-isolation"],"title":"obsidian-tc: two critical flaws let tokens reach any vault and drive-by pages access loopback server (CVE-2026-77366, CVE-2026-77363)","updatedAt":"2026-10-25T11:10:00Z","url":"https://helix.ml/threat-watch/i/obsidian-tc-two-critical-flaws-let-tokens-reach-any-vault-and-drive-by-pages-access-loopback-server-cve-2026-77366-cve-2","vendor":"The-40-Thieves"},{"auto":true,"category":"breach","closedAt":"2026-07-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MOODYBIBLEINSTITUTE"],"json":"https://helix.ml/threat-watch/i/moodybibleinstitute-data-breach.json","latestUpdate":{"date":"2026-07-03","title":"Have I Been Pwned loaded 2.3M breached Moody Bible Institute accounts"},"patchStatus":"no-fix-needed","product":"moody.edu","severity":"medium","severityNote":"2.3M accounts","slug":"moodybibleinstitute-data-breach","stacks":[],"startedAt":"2026-07-03","status":"closed","summary":"In June 2026, Moody Bible Institute was targeted by a ShinyHunters \"pay or leak\" extortion campaign. Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice, Moody advised that they had \"engaged both internal and external cybersecurity experts to thoroughly investigate the matter\". Exposed data: dates of birth, email addresses, genders, marital statuses, names, phone numbers, physical addresses. The breach dates from Jun 15, 2026; Have I Been Pwned loaded it on Jul 3, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","marital-statuses","names","phone-numbers","physical-addresses"],"title":"Moody Bible Institute data breach: 2.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/moodybibleinstitute-data-breach","vendor":"Moody Bible Institute"},{"auto":true,"category":"patch","closedAt":"2026-07-15","cveIds":["CVE-2026-45659"],"exploited":"in-the-wild","identifiers":["CVE-2026-45659"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2026-45659.json","latestUpdate":{"date":"2026-07-01","title":"CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 4, 2026)"},"patchStatus":"unknown","product":"SharePoint Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-server-cve-2026-45659","stacks":["rust","windows"],"startedAt":"2026-07-01","status":"closed","summary":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on Jul 1, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability (CVE-2026-45659)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2026-45659","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-07-13","cveIds":["CVE-2026-48558"],"exploited":"in-the-wild","identifiers":["CVE-2026-48558"],"json":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2026-48558.json","latestUpdate":{"date":"2026-06-29","title":"CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 2, 2026)"},"patchStatus":"patched","product":"SimpleHelp","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"simplehelp-simplehelp-cve-2026-48558","stacks":[],"startedAt":"2026-06-29","status":"closed","summary":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog on Jun 29, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-347"],"title":"SimpleHelp Authentication Bypass Vulnerability (CVE-2026-48558)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2026-48558","vendor":"SimpleHelp "},{"auto":true,"category":"breach","closedAt":"2026-07-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SYSCO"],"json":"https://helix.ml/threat-watch/i/sysco-data-breach.json","latestUpdate":{"date":"2026-06-28","title":"Have I Been Pwned loaded 2.7M breached Sysco accounts"},"patchStatus":"no-fix-needed","product":"sysco.com","severity":"medium","severityNote":"2.7M accounts","slug":"sysco-data-breach","stacks":[],"startedAt":"2026-06-28","status":"closed","summary":"In June 2026, the food distribution company Sysco was targeted by a ShinyHunters \"pay or leak\" extortion campaign. Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback. Exposed data: customer feedback, email addresses, employers, job titles, names, phone numbers, physical addresses, usernames. The breach dates from Jun 15, 2026; Have I Been Pwned loaded it on Jun 28, 2026.","tags":["data-breach","hibp","customer-feedback","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","usernames"],"title":"Sysco data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/sysco-data-breach","vendor":"Sysco"},{"auto":true,"category":"breach","closedAt":"2026-07-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AMERICANTOWER"],"json":"https://helix.ml/threat-watch/i/americantower-data-breach.json","latestUpdate":{"date":"2026-06-26","title":"Have I Been Pwned loaded 216K breached American Tower accounts"},"patchStatus":"no-fix-needed","product":"americantower.com","severity":"medium","severityNote":"216K accounts","slug":"americantower-data-breach","stacks":[],"startedAt":"2026-06-26","status":"closed","summary":"In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data allegedly taken from the company containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. Exposed data also included names, addresses, and phone numbers. Exposed data: email addresses, job titles, names, phone numbers, physical addresses. The breach dates from Jun 12, 2026; Have I Been Pwned loaded it on Jun 26, 2026.","tags":["data-breach","hibp","email-addresses","job-titles","names","phone-numbers","physical-addresses"],"title":"American Tower data breach: 216K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/americantower-data-breach","vendor":"American Tower"},{"auto":true,"category":"patch","closedAt":"2026-07-09","cveIds":["CVE-2026-12569"],"exploited":"in-the-wild","identifiers":["CVE-2026-12569"],"json":"https://helix.ml/threat-watch/i/ptc-windchill-and-flexplm-cve-2026-12569.json","latestUpdate":{"date":"2026-06-25","title":"CISA added CVE-2026-12569 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 28, 2026)"},"patchStatus":"unknown","product":"Windchill and FlexPLM","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ptc-windchill-and-flexplm-cve-2026-12569","stacks":[],"startedAt":"2026-06-25","status":"closed","summary":"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network. CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog on Jun 25, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-502"],"title":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability (CVE-2026-12569)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ptc-windchill-and-flexplm-cve-2026-12569","vendor":"PTC"},{"auto":true,"category":"patch","closedAt":"2026-07-09","cveIds":["CVE-2026-20230"],"exploited":"in-the-wild","identifiers":["CVE-2026-20230"],"json":"https://helix.ml/threat-watch/i/cisco-unified-communications-manager-cve-2026-20230.json","latestUpdate":{"date":"2026-06-25","title":"CISA added CVE-2026-20230 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 28, 2026)"},"patchStatus":"unknown","product":"Unified Communications Manager","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-unified-communications-manager-cve-2026-20230","stacks":["network"],"startedAt":"2026-06-25","status":"closed","summary":"Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalog on Jun 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-20230)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-unified-communications-manager-cve-2026-20230","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-07-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MADISONSQUAREGARDENSPORTS"],"json":"https://helix.ml/threat-watch/i/madisonsquaregardensports-data-breach.json","latestUpdate":{"date":"2026-06-24","title":"Have I Been Pwned loaded 9.8M breached Madison Square Garden Sports accounts"},"patchStatus":"no-fix-needed","product":"msgsports.com","severity":"medium","severityNote":"9.8M accounts","slug":"madisonsquaregardensports-data-breach","stacks":[],"startedAt":"2026-06-24","status":"closed","summary":"In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information. Exposed data: customer service records, email addresses, names, phone numbers, physical addresses. The breach dates from Jun 5, 2026; Have I Been Pwned loaded it on Jun 24, 2026.","tags":["data-breach","hibp","customer-service-records","email-addresses","names","phone-numbers","physical-addresses"],"title":"Madison Square Garden Sports data breach: 9.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/madisonsquaregardensports-data-breach","vendor":"Madison Square Garden Sports"},{"auto":true,"category":"patch","closedAt":"2026-07-07","cveIds":["CVE-2025-67038"],"exploited":"in-the-wild","identifiers":["CVE-2025-67038"],"json":"https://helix.ml/threat-watch/i/lantronix-eds5000-cve-2025-67038.json","latestUpdate":{"date":"2026-06-23","title":"CISA added CVE-2025-67038 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 26, 2026)"},"patchStatus":"unknown","product":"EDS5000","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"lantronix-eds5000-cve-2025-67038","stacks":[],"startedAt":"2026-06-23","status":"closed","summary":"Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. CISA added CVE-2025-67038 to its Known Exploited Vulnerabilities catalog on Jun 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-94"],"title":"Lantronix EDS5000 Code Injection Vulnerability (CVE-2025-67038)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/lantronix-eds5000-cve-2025-67038","vendor":"Lantronix"},{"auto":true,"category":"patch","closedAt":"2026-07-07","cveIds":["CVE-2026-34910"],"exploited":"in-the-wild","identifiers":["CVE-2026-34910"],"json":"https://helix.ml/threat-watch/i/ubiquiti-unifi-os-cve-2026-34910.json","latestUpdate":{"date":"2026-06-23","title":"CISA added CVE-2026-34910 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 26, 2026)"},"patchStatus":"patched","product":"UniFi OS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ubiquiti-unifi-os-cve-2026-34910","stacks":["network"],"startedAt":"2026-06-23","status":"closed","summary":"Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection. CISA added CVE-2026-34910 to its Known Exploited Vulnerabilities catalog on Jun 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Ubiquiti UniFi OS Improper Input Validation Vulnerability (CVE-2026-34910)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ubiquiti-unifi-os-cve-2026-34910","vendor":"Ubiquiti"},{"auto":true,"category":"patch","closedAt":"2026-07-07","cveIds":["CVE-2026-34909"],"exploited":"in-the-wild","identifiers":["CVE-2026-34909"],"json":"https://helix.ml/threat-watch/i/ubiquiti-unifi-os-cve-2026-34909.json","latestUpdate":{"date":"2026-06-23","title":"CISA added CVE-2026-34909 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 26, 2026)"},"patchStatus":"patched","product":"UniFi OS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ubiquiti-unifi-os-cve-2026-34909","stacks":["network"],"startedAt":"2026-06-23","status":"closed","summary":"Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account. CISA added CVE-2026-34909 to its Known Exploited Vulnerabilities catalog on Jun 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Ubiquiti UniFi OS Path Traversal Vulnerability (CVE-2026-34909)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ubiquiti-unifi-os-cve-2026-34909","vendor":"Ubiquiti"},{"auto":true,"category":"patch","closedAt":"2026-07-07","cveIds":["CVE-2026-34908"],"exploited":"in-the-wild","identifiers":["CVE-2026-34908"],"json":"https://helix.ml/threat-watch/i/ubiquiti-unifi-os-cve-2026-34908.json","latestUpdate":{"date":"2026-06-23","title":"CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 26, 2026)"},"patchStatus":"patched","product":"UniFi OS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ubiquiti-unifi-os-cve-2026-34908","stacks":["network"],"startedAt":"2026-06-23","status":"closed","summary":"Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system. CISA added CVE-2026-34908 to its Known Exploited Vulnerabilities catalog on Jun 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Ubiquiti UniFi OS Improper Access Control Vulnerability (CVE-2026-34908)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ubiquiti-unifi-os-cve-2026-34908","vendor":"Ubiquiti"},{"auto":true,"category":"breach","closedAt":"2026-07-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JCPENNEY"],"json":"https://helix.ml/threat-watch/i/jcpenney-data-breach.json","latestUpdate":{"date":"2026-06-20","title":"Have I Been Pwned loaded 368K breached JCPenney accounts"},"patchStatus":"no-fix-needed","product":"jcpenny.com","severity":"medium","severityNote":"368K accounts","slug":"jcpenney-data-breach","stacks":[],"startedAt":"2026-06-20","status":"closed","summary":"In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters \"pay or leak\" extortion campaign. Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses. Exposed data: dates of birth, email addresses, government issued ids, job titles, names, phone numbers, physical addresses, usernames. The breach dates from Jun 12, 2026; Have I Been Pwned loaded it on Jun 20, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","government-issued-ids","job-titles","names","phone-numbers","physical-addresses","usernames"],"title":"JCPenney data breach: 368K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/jcpenney-data-breach","vendor":"JCPenney"},{"auto":true,"category":"patch","closedAt":"2026-07-02","cveIds":["CVE-2026-20253"],"exploited":"in-the-wild","identifiers":["CVE-2026-20253"],"json":"https://helix.ml/threat-watch/i/splunk-enterprise-cve-2026-20253.json","latestUpdate":{"date":"2026-06-18","title":"CISA added CVE-2026-20253 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 21, 2026)"},"patchStatus":"unknown","product":"Enterprise","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"splunk-enterprise-cve-2026-20253","stacks":[],"startedAt":"2026-06-18","status":"closed","summary":"Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalog on Jun 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Splunk Enterprise Missing Authentication for Critical Function Vulnerability (CVE-2026-20253)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/splunk-enterprise-cve-2026-20253","vendor":"Splunk"},{"auto":true,"category":"breach","closedAt":"2026-07-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CFGI"],"json":"https://helix.ml/threat-watch/i/cfgi-data-breach.json","latestUpdate":{"date":"2026-06-18","title":"Have I Been Pwned loaded 248K breached CFGI accounts"},"patchStatus":"no-fix-needed","product":"cfgi.com","severity":"medium","severityNote":"248K accounts","slug":"cfgi-data-breach","stacks":[],"startedAt":"2026-06-18","status":"closed","summary":"In March 2026, the financial consulting and advisory firm CFGI was the target of a ShinyHunters \"pay-or-leak\" extortion campaign. The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses. The breach dates from Mar 6, 2026; Have I Been Pwned loaded it on Jun 18, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses"],"title":"CFGI data breach: 248K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cfgi-data-breach","vendor":"CFGI"},{"auto":true,"category":"breach","closedAt":"2026-07-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OPERATIONENDGAME4"],"json":"https://helix.ml/threat-watch/i/operationendgame4-data-breach.json","latestUpdate":{"date":"2026-06-18","title":"Have I Been Pwned loaded 4.3M breached Operation Endgame 4.0 accounts"},"patchStatus":"no-fix-needed","product":"Operation Endgame 4.0","severity":"high","severityNote":"4.3M accounts · passwords exposed","slug":"operationendgame4-data-breach","stacks":[],"startedAt":"2026-06-18","status":"closed","summary":"On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation also targeted by Operation Endgame were provided, followed by another 131k email addresses the following month, bringing the total to more than 4.3M unique email addresses. Exposed data: email addresses, passwords. The breach dates from Jun 18, 2026; Have I Been Pwned loaded it on Jun 18, 2026.","tags":["data-breach","hibp","malware","email-addresses","passwords"],"title":"Operation Endgame 4.0 data breach: 4.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/operationendgame4-data-breach","vendor":"Operation Endgame 4.0"},{"auto":true,"category":"breach","closedAt":"2026-07-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RALPHLAUREN"],"json":"https://helix.ml/threat-watch/i/ralphlauren-data-breach.json","latestUpdate":{"date":"2026-06-18","title":"Have I Been Pwned loaded 139K breached Ralph Lauren accounts"},"patchStatus":"no-fix-needed","product":"ralphlauren.com","severity":"medium","severityNote":"139K accounts","slug":"ralphlauren-data-breach","stacks":[],"startedAt":"2026-06-18","status":"closed","summary":"In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups. Exposed data: age groups, email addresses, genders, names, phone numbers. The breach dates from Jun 11, 2026; Have I Been Pwned loaded it on Jun 18, 2026.","tags":["data-breach","hibp","age-groups","email-addresses","genders","names","phone-numbers"],"title":"Ralph Lauren data breach: 139K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ralphlauren-data-breach","vendor":"Ralph Lauren"},{"auto":true,"category":"patch","closedAt":"2026-06-30","cveIds":["CVE-2026-48907"],"exploited":"in-the-wild","identifiers":["CVE-2026-48907"],"json":"https://helix.ml/threat-watch/i/widget-factory-joomla-content-editor-cve-2026-48907.json","latestUpdate":{"date":"2026-06-16","title":"CISA added CVE-2026-48907 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 19, 2026)"},"patchStatus":"unknown","product":"Joomla Content Editor ","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"widget-factory-joomla-content-editor-cve-2026-48907","stacks":["php"],"startedAt":"2026-06-16","status":"closed","summary":"Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog on Jun 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Widget Factory Joomla Content Editor Improper Access Control Vulnerability (CVE-2026-48907)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/widget-factory-joomla-content-editor-cve-2026-48907","vendor":"Widget Factory"},{"auto":true,"category":"patch","closedAt":"2026-06-29","cveIds":["CVE-2026-54420"],"exploited":"in-the-wild","identifiers":["CVE-2026-54420"],"json":"https://helix.ml/threat-watch/i/litespeed-cpanel-plugin-cve-2026-54420.json","latestUpdate":{"date":"2026-06-15","title":"CISA added CVE-2026-54420 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 18, 2026)"},"patchStatus":"unknown","product":"cPanel Plugin","severity":"high","severityNote":"CVSS 8.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"litespeed-cpanel-plugin-cve-2026-54420","stacks":["hosting"],"startedAt":"2026-06-15","status":"closed","summary":"LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS. CISA added CVE-2026-54420 to its Known Exploited Vulnerabilities catalog on Jun 15, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-61"],"title":"LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability (CVE-2026-54420)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/litespeed-cpanel-plugin-cve-2026-54420","vendor":"LiteSpeed"},{"auto":true,"category":"patch","closedAt":"2026-06-29","cveIds":["CVE-2026-20262"],"exploited":"in-the-wild","identifiers":["CVE-2026-20262"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262.json","latestUpdate":{"date":"2026-06-15","title":"CISA added CVE-2026-20262 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 29, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN Manager","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-manager-cve-2026-20262","stacks":["network"],"startedAt":"2026-06-15","status":"closed","summary":"Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. CISA added CVE-2026-20262 to its Known Exploited Vulnerabilities catalog on Jun 15, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability (CVE-2026-20262)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-06-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INFINITECAMPUS"],"json":"https://helix.ml/threat-watch/i/infinitecampus-data-breach.json","latestUpdate":{"date":"2026-06-15","title":"Have I Been Pwned loaded 137K breached Infinite Campus accounts"},"patchStatus":"no-fix-needed","product":"infinitecampus.com","severity":"medium","severityNote":"137K accounts","slug":"infinitecampus-data-breach","stacks":[],"startedAt":"2026-06-15","status":"closed","summary":"In March 2026, the student information system Infinite Campus was targeted in a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets. Infinite Campus subsequently sent notifications, advising that the exposed data largely consisted of \"names and contact information for school staff\" and that \"the majority is directory information commonly found on school websites\". Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, support tickets, usernames. The breach dates from Mar 18, 2026; Have I Been Pwned loaded it on Jun 15, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","support-tickets","usernames"],"title":"Infinite Campus data breach: 137K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/infinitecampus-data-breach","vendor":"Infinite Campus"},{"auto":true,"category":"breach","closedAt":"2026-06-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BERKADIA"],"json":"https://helix.ml/threat-watch/i/berkadia-data-breach.json","latestUpdate":{"date":"2026-06-15","title":"Have I Been Pwned loaded 305K breached Berkadia accounts"},"patchStatus":"no-fix-needed","product":"berkadia.com","severity":"medium","severityNote":"305K accounts","slug":"berkadia-data-breach","stacks":[],"startedAt":"2026-06-15","status":"closed","summary":"In March 2026, the commercial real estate finance company Berkadia was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data. Exposed data: email addresses, employers, names, phone numbers, physical addresses. The breach dates from Mar 19, 2026; Have I Been Pwned loaded it on Jun 15, 2026.","tags":["data-breach","hibp","email-addresses","employers","names","phone-numbers","physical-addresses"],"title":"Berkadia data breach: 305K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/berkadia-data-breach","vendor":"Berkadia"},{"auto":true,"category":"breach","closedAt":"2026-06-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JUNE2026STEALERLOGS"],"json":"https://helix.ml/threat-watch/i/june2026stealerlogs-data-breach.json","latestUpdate":{"date":"2026-06-15","title":"Have I Been Pwned loaded 56.3M breached June 2026 Stealer Logs accounts"},"patchStatus":"no-fix-needed","product":"June 2026 Stealer Logs","severity":"high","severityNote":"56.3M accounts · passwords exposed · infostealer logs","slug":"june2026stealerlogs-data-breach","stacks":[],"startedAt":"2026-06-15","status":"closed","summary":"In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashboard. Organisations can see logs affecting their domain via the stealer logs API. Exposed data: email addresses, passwords. The breach dates from Jun 15, 2026; Have I Been Pwned loaded it on Jun 15, 2026.","tags":["data-breach","hibp","stealer-log","email-addresses","passwords"],"title":"June 2026 Stealer Logs data breach: 56.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/june2026stealerlogs-data-breach","vendor":"June 2026 Stealer Logs"},{"auto":true,"category":"patch","closedAt":"2026-06-26","cveIds":["CVE-2026-35273"],"exploited":"in-the-wild","identifiers":["CVE-2026-35273"],"json":"https://helix.ml/threat-watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273.json","latestUpdate":{"date":"2026-06-12","title":"CISA added CVE-2026-35273 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2026)"},"patchStatus":"unknown","product":" PeopleSoft Enterprise PeopleTools","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-peoplesoft-enterprise-peopletools-cve-2026-35273","stacks":[],"startedAt":"2026-06-12","status":"closed","summary":"Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. CISA added CVE-2026-35273 to its Known Exploited Vulnerabilities catalog on Jun 12, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-306"],"title":"Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability (CVE-2026-35273)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2026-06-25","cveIds":["CVE-2026-10520"],"exploited":"in-the-wild","identifiers":["CVE-2026-10520"],"json":"https://helix.ml/threat-watch/i/ivanti-sentry-cve-2026-10520.json","latestUpdate":{"date":"2026-06-11","title":"CISA added CVE-2026-10520 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2026)"},"patchStatus":"patched","product":"Sentry","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-sentry-cve-2026-10520","stacks":[],"startedAt":"2026-06-11","status":"closed","summary":"Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. CISA added CVE-2026-10520 to its Known Exploited Vulnerabilities catalog on Jun 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Ivanti Sentry OS Command Injection Vulnerability (CVE-2026-10520)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ivanti-sentry-cve-2026-10520","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2026-06-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNIVERSITYOFNOTTINGHAM"],"json":"https://helix.ml/threat-watch/i/universityofnottingham-data-breach.json","latestUpdate":{"date":"2026-06-10","title":"Have I Been Pwned loaded 454K breached University of Nottingham accounts"},"patchStatus":"no-fix-needed","product":"nottingham.ac.uk","severity":"medium","severityNote":"454K accounts","slug":"universityofnottingham-data-breach","stacks":[],"startedAt":"2026-06-10","status":"closed","summary":"In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters \"pay or leak\" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident, the university advised that the breach affected both \"current students, and alumni\". Exposed data: academic records, citizenship statuses, dates of birth, disabilities, email addresses, ethnicities, genders, ip addresses, names, passport numbers, phone numbers, physical addresses, purchases, salutations, usernames. The breach dates from Jun 9, 2026; Have I Been Pwned loaded it on Jun 10, 2026.","tags":["data-breach","hibp","academic-records","citizenship-statuses","dates-of-birth","disabilities","email-addresses","ethnicities","genders","ip-addresses","names","passport-numbers","phone-numbers","physical-addresses"],"title":"University of Nottingham data breach: 454K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/universityofnottingham-data-breach","vendor":"University of Nottingham"},{"auto":true,"category":"patch","closedAt":"2026-06-23","cveIds":["CVE-2026-11645"],"exploited":"in-the-wild","identifiers":["CVE-2026-11645"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-11645.json","latestUpdate":{"date":"2026-06-09","title":"CISA added CVE-2026-11645 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2026)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2026-11645","stacks":["browser"],"startedAt":"2026-06-09","status":"closed","summary":"Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog on Jun 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787","cwe-125"],"title":"Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (CVE-2026-11645)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-11645","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2026-06-23","cveIds":["CVE-2026-7473"],"exploited":"in-the-wild","identifiers":["CVE-2026-7473"],"json":"https://helix.ml/threat-watch/i/arista-extensible-operating-system-cve-2026-7473.json","latestUpdate":{"date":"2026-06-09","title":"CISA added CVE-2026-7473 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2026)"},"patchStatus":"unknown","product":"Extensible Operating System","severity":"medium","severityNote":"CVSS 5.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arista-extensible-operating-system-cve-2026-7473","stacks":["network"],"startedAt":"2026-06-09","status":"closed","summary":"Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. CISA added CVE-2026-7473 to its Known Exploited Vulnerabilities catalog on Jun 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1023"],"title":"Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability (CVE-2026-7473)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/arista-extensible-operating-system-cve-2026-7473","vendor":"Arista"},{"auto":true,"category":"patch","closedAt":"2026-06-23","cveIds":["CVE-2026-20245"],"exploited":"in-the-wild","identifiers":["CVE-2026-20245"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245.json","latestUpdate":{"date":"2026-06-09","title":"CISA added CVE-2026-20245 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN Manager","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-manager-cve-2026-20245","stacks":["network"],"startedAt":"2026-06-09","status":"closed","summary":"Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. CISA added CVE-2026-20245 to its Known Exploited Vulnerabilities catalog on Jun 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-116"],"title":"Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability (CVE-2026-20245)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-06-22","cveIds":["CVE-2026-42271"],"exploited":"in-the-wild","identifiers":["CVE-2026-42271"],"json":"https://helix.ml/threat-watch/i/berriai-litellm-cve-2026-42271.json","latestUpdate":{"date":"2026-06-08","title":"CISA added CVE-2026-42271 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2026)"},"patchStatus":"patched","product":"LiteLLM","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"berriai-litellm-cve-2026-42271","stacks":["ai"],"startedAt":"2026-06-08","status":"closed","summary":"BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog on Jun 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-77"],"title":"BerriAI LiteLLM Command Injection Vulnerability (CVE-2026-42271)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/berriai-litellm-cve-2026-42271","vendor":"BerriAI"},{"auto":true,"category":"patch","closedAt":"2026-06-22","cveIds":["CVE-2026-50751"],"exploited":"in-the-wild","identifiers":["CVE-2026-50751"],"json":"https://helix.ml/threat-watch/i/check-point-security-gateway-cve-2026-50751.json","latestUpdate":{"date":"2026-06-08","title":"CISA added CVE-2026-50751 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 11, 2026)"},"patchStatus":"patched","product":"Security Gateway","severity":"critical","severityNote":"CVSS 9.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"check-point-security-gateway-cve-2026-50751","stacks":["network"],"startedAt":"2026-06-08","status":"closed","summary":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. CISA added CVE-2026-50751 to its Known Exploited Vulnerabilities catalog on Jun 8, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-287"],"title":"Check Point Security Gateway Improper Authentication Vulnerability (CVE-2026-50751)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/check-point-security-gateway-cve-2026-50751","vendor":"Check Point"},{"auto":true,"category":"breach","closedAt":"2026-06-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BAKERDISTRIBUTING"],"json":"https://helix.ml/threat-watch/i/bakerdistributing-data-breach.json","latestUpdate":{"date":"2026-06-07","title":"Have I Been Pwned loaded 102K breached Baker Distributing accounts"},"patchStatus":"no-fix-needed","product":"bakerdist.com","severity":"medium","severityNote":"102K accounts","slug":"bakerdistributing-data-breach","stacks":[],"startedAt":"2026-06-07","status":"closed","summary":"In May 2026, the HVAC/R wholesale distributor Baker Distributing Company was added to the ShinyHunters data extortion group's \"pay or leak\" site. In early June, the group publicly published data they claimed had been obtained from Baker's SharePoint and Salesforce infrastructure including 103k unique email addresses along with names, physical addresses, phone numbers and tickets relating to the company's HVAC contractor customer base. The exposed data was largely corporate contact and support information with limited sensitivity. Exposed data: email addresses, names, phone numbers, physical addresses, support tickets. The breach dates from May 23, 2026; Have I Been Pwned loaded it on Jun 7, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","support-tickets"],"title":"Baker Distributing data breach: 102K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bakerdistributing-data-breach","vendor":"Baker Distributing"},{"auto":true,"category":"patch","closedAt":"2026-06-19","cveIds":["CVE-2026-28318"],"exploited":"in-the-wild","identifiers":["CVE-2026-28318"],"json":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2026-28318.json","latestUpdate":{"date":"2026-06-05","title":"CISA added CVE-2026-28318 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 19, 2026)"},"patchStatus":"unknown","product":"Serv-U","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-serv-u-cve-2026-28318","stacks":[],"startedAt":"2026-06-05","status":"closed","summary":"SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities catalog on Jun 5, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-400"],"title":"SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability (CVE-2026-28318)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2026-28318","vendor":"SolarWinds"},{"auto":true,"category":"breach","closedAt":"2026-06-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BCDTRAVEL"],"json":"https://helix.ml/threat-watch/i/bcdtravel-data-breach.json","latestUpdate":{"date":"2026-06-05","title":"Have I Been Pwned loaded 396K breached BCD Travel accounts"},"patchStatus":"no-fix-needed","product":"bcdtravel.com","severity":"medium","severityNote":"396K accounts","slug":"bcdtravel-data-breach","stacks":[],"startedAt":"2026-06-05","status":"closed","summary":"In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters \"pay or leak\" extortion campaign. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, internal staff and support tickets. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, support tickets. The breach dates from May 29, 2026; Have I Been Pwned loaded it on Jun 5, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","support-tickets"],"title":"BCD Travel data breach: 396K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bcdtravel-data-breach","vendor":"BCD Travel"},{"auto":true,"category":"patch","closedAt":"2026-06-17","cveIds":["CVE-2026-45247"],"exploited":"in-the-wild","identifiers":["CVE-2026-45247"],"json":"https://helix.ml/threat-watch/i/mirasvit-mirasvit-full-page-cache-warmer-cve-2026-45247.json","latestUpdate":{"date":"2026-06-03","title":"CISA added CVE-2026-45247 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 6, 2026)"},"patchStatus":"unknown","product":"Mirasvit Full Page Cache Warmer","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mirasvit-mirasvit-full-page-cache-warmer-cve-2026-45247","stacks":["rust"],"startedAt":"2026-06-03","status":"closed","summary":"Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog on Jun 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability (CVE-2026-45247)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/mirasvit-mirasvit-full-page-cache-warmer-cve-2026-45247","vendor":"Mirasvit"},{"auto":true,"category":"breach","closedAt":"2026-06-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DENTAQUEST"],"json":"https://helix.ml/threat-watch/i/dentaquest-data-breach.json","latestUpdate":{"date":"2026-06-03","title":"Have I Been Pwned loaded 2.6M breached DentaQuest accounts"},"patchStatus":"no-fix-needed","product":"dentaquest.com","severity":"medium","severityNote":"2.6M accounts","slug":"dentaquest-data-breach","stacks":[],"startedAt":"2026-06-03","status":"closed","summary":"In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters \"pay or leak\" extortion campaign that resulted in the group publicly publishing hundreds of gigabytes of data allegedly obtained from the company. The data included 2.6M unique email addresses along with names, addresses and phone numbers. Much of the data appeared in healthcare enrollment files ( ASC X12 transaction sets ) with some containing Medicaid IDs, while additional data appeared in member records and related files. DentaQuest acknowledged \"a cybersecurity incident involving unauthorized access to a limited portion of our network\", and advised they had contained the attack and mitigated the threat. Exposed data: dates of birth, email addresses, genders, government issued ids, health insurance information, names, phone numbers, physical addresses. The breach dates from May 23, 2026; Have I Been Pwned loaded it on Jun 3, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","government-issued-ids","health-insurance-information","names","phone-numbers","physical-addresses"],"title":"DentaQuest data breach: 2.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/dentaquest-data-breach","vendor":"DentaQuest"},{"auto":true,"category":"patch","closedAt":"2026-06-16","cveIds":["CVE-2022-0492"],"exploited":"in-the-wild","identifiers":["CVE-2022-0492"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0492.json","latestUpdate":{"date":"2026-06-02","title":"CISA added CVE-2022-0492 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 5, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2022-0492","stacks":["linux"],"startedAt":"2026-06-02","status":"closed","summary":"Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature. CISA added CVE-2022-0492 to its Known Exploited Vulnerabilities catalog on Jun 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","privilege-escalation","cwe-287","cwe-862"],"title":"Linux Kernel Improper Authentication Vulnerability (CVE-2022-0492)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0492","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2026-06-16","cveIds":["CVE-2025-48595"],"exploited":"in-the-wild","identifiers":["CVE-2025-48595"],"json":"https://helix.ml/threat-watch/i/android-framework-cve-2025-48595.json","latestUpdate":{"date":"2026-06-02","title":"CISA added CVE-2025-48595 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 5, 2026)"},"patchStatus":"unknown","product":"Framework","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-framework-cve-2025-48595","stacks":["android"],"startedAt":"2026-06-02","status":"closed","summary":"Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. CISA added CVE-2025-48595 to its Known Exploited Vulnerabilities catalog on Jun 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-190"],"title":"Android Framework Integer Overflow Vulnerability (CVE-2025-48595)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/android-framework-cve-2025-48595","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2026-06-15","cveIds":["CVE-2024-21182"],"exploited":"in-the-wild","identifiers":["CVE-2024-21182"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2024-21182.json","latestUpdate":{"date":"2026-06-01","title":"CISA added CVE-2024-21182 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 4, 2026)"},"patchStatus":"unknown","product":"WebLogic Server","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2024-21182","stacks":["java"],"startedAt":"2026-06-01","status":"closed","summary":"Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CISA added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog on Jun 1, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle WebLogic Server Unspecified Vulnerability (CVE-2024-21182)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2024-21182","vendor":"Oracle"},{"auto":true,"category":"breach","closedAt":"2026-06-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EDMUNDS"],"json":"https://helix.ml/threat-watch/i/edmunds-data-breach.json","latestUpdate":{"date":"2026-06-01","title":"Have I Been Pwned loaded 177K breached Edmunds accounts"},"patchStatus":"no-fix-needed","product":"edmunds.com","severity":"high","severityNote":"177K accounts · passwords exposed","slug":"edmunds-data-breach","stacks":[],"startedAt":"2026-06-01","status":"closed","summary":"In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached. Data purportedly obtained in the incident was later published publicly and included 178k unique email addresses, usernames, passwords, IP addresses, phone numbers and vehicle-related records. Exposed data: device information, email addresses, ip addresses, passwords, phone numbers, usernames. The breach dates from Jan 24, 2026; Have I Been Pwned loaded it on Jun 1, 2026.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","passwords","phone-numbers","usernames"],"title":"Edmunds data breach: 177K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/edmunds-data-breach","vendor":"Edmunds"},{"auto":true,"category":"breach","closedAt":"2026-06-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ATLASMENU"],"json":"https://helix.ml/threat-watch/i/atlasmenu-data-breach.json","latestUpdate":{"date":"2026-05-30","title":"Have I Been Pwned loaded 63K breached Atlas Menu accounts"},"patchStatus":"no-fix-needed","product":"atlasmenu.net","severity":"high","severityNote":"63K accounts · passwords exposed","slug":"atlasmenu-data-breach","stacks":[],"startedAt":"2026-05-30","status":"closed","summary":"In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, support tickets, usernames. The breach dates from May 30, 2026; Have I Been Pwned loaded it on May 30, 2026.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","support-tickets","usernames"],"title":"Atlas Menu data breach: 63K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/atlasmenu-data-breach","vendor":"Atlas Menu"},{"auto":true,"category":"patch","closedAt":"2026-06-12","cveIds":["CVE-2026-0257"],"exploited":"in-the-wild","identifiers":["CVE-2026-0257"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0257.json","latestUpdate":{"date":"2026-05-29","title":"CISA added CVE-2026-0257 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 1, 2026)"},"patchStatus":"unknown","product":"PAN-OS","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2026-0257","stacks":["network"],"startedAt":"2026-05-29","status":"closed","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-565"],"title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CVE-2026-0257)","updatedAt":"2026-10-25T09:51:01Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0257","vendor":"Palo Alto Networks"},{"auto":true,"category":"breach","closedAt":"2026-06-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KEMPER"],"json":"https://helix.ml/threat-watch/i/kemper-data-breach.json","latestUpdate":{"date":"2026-05-28","title":"Have I Been Pwned loaded 269K breached Kemper accounts"},"patchStatus":"no-fix-needed","product":"kemper.com","severity":"high","severityNote":"269K accounts · financial data exposed","slug":"kemper-data-breach","stacks":[],"startedAt":"2026-05-28","status":"closed","summary":"In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a \"pay or leak\" extortion campaign. The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data they claimed included internal directory data, Salesforce records and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses and partial payment card data including the last 4 digits, expiry dates and card brands. Kemper confirmed the incident and stated they had engaged third-party cybersecurity experts and notified law enforcement. Exposed data: email addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Apr 15, 2026; Have I Been Pwned loaded it on May 28, 2026.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"Kemper data breach: 269K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/kemper-data-breach","vendor":"Kemper"},{"auto":true,"category":"breach","closedAt":"2026-06-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHARTER"],"json":"https://helix.ml/threat-watch/i/charter-data-breach.json","latestUpdate":{"date":"2026-05-28","title":"Have I Been Pwned loaded 4.9M breached Charter accounts"},"patchStatus":"no-fix-needed","product":"charter.com","severity":"medium","severityNote":"4.9M accounts","slug":"charter-data-breach","stacks":[],"startedAt":"2026-05-28","status":"closed","summary":"In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a \"pay or leak\" extortion campaign. The group later published the data, which exposed 4.9M unique email addresses along with names, phone numbers and physical addresses. A subset of approximately 85k records originating from an internal employee directory also included job titles. Charter confirmed the incident, but stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated. Exposed data: email addresses, job titles, names, phone numbers, physical addresses. The breach dates from May 23, 2026; Have I Been Pwned loaded it on May 28, 2026.","tags":["data-breach","hibp","email-addresses","job-titles","names","phone-numbers","physical-addresses"],"title":"Charter data breach: 4.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/charter-data-breach","vendor":"Charter"},{"auto":true,"category":"patch","closedAt":"2026-06-10","cveIds":["CVE-2026-48027"],"exploited":"in-the-wild","identifiers":["CVE-2026-48027"],"json":"https://helix.ml/threat-watch/i/nx-nx-console-cve-2026-48027.json","latestUpdate":{"date":"2026-05-27","title":"CISA added CVE-2026-48027 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2026)"},"patchStatus":"unknown","product":"Nx Console","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nx-nx-console-cve-2026-48027","stacks":[],"startedAt":"2026-05-27","status":"closed","summary":"Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. CISA added CVE-2026-48027 to its Known Exploited Vulnerabilities catalog on May 27, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-506"],"title":"Nx Console Embedded Malicious Code Vulnerability (CVE-2026-48027)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/nx-nx-console-cve-2026-48027","vendor":"Nx"},{"auto":true,"category":"patch","closedAt":"2026-06-10","cveIds":["CVE-2026-45321"],"exploited":"in-the-wild","identifiers":["CVE-2026-45321"],"json":"https://helix.ml/threat-watch/i/tanstack-tanstack-cve-2026-45321.json","latestUpdate":{"date":"2026-05-27","title":"CISA added CVE-2026-45321 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2026)"},"patchStatus":"unknown","product":"TanStack","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"tanstack-tanstack-cve-2026-45321","stacks":[],"startedAt":"2026-05-27","status":"closed","summary":"TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. CISA added CVE-2026-45321 to its Known Exploited Vulnerabilities catalog on May 27, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"TanStack Unspecified Vulnerability (CVE-2026-45321)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/tanstack-tanstack-cve-2026-45321","vendor":"TanStack"},{"auto":true,"category":"patch","closedAt":"2026-06-10","cveIds":["CVE-2026-8398"],"exploited":"in-the-wild","identifiers":["CVE-2026-8398"],"json":"https://helix.ml/threat-watch/i/daemon-daemon-tools-lite-cve-2026-8398.json","latestUpdate":{"date":"2026-05-27","title":"CISA added CVE-2026-8398 to the Known Exploited Vulnerabilities catalog (federal remediation due May 30, 2026)"},"patchStatus":"unknown","product":"Daemon Tools Lite","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"daemon-daemon-tools-lite-cve-2026-8398","stacks":[],"startedAt":"2026-05-27","status":"closed","summary":"Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability. CISA added CVE-2026-8398 to its Known Exploited Vulnerabilities catalog on May 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-506"],"title":"Daemon Tools Lite Embedded Malicious Code Vulnerability (CVE-2026-8398)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/daemon-daemon-tools-lite-cve-2026-8398","vendor":"Daemon"},{"auto":true,"category":"breach","closedAt":"2026-06-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYTHERESA"],"json":"https://helix.ml/threat-watch/i/mytheresa-data-breach.json","latestUpdate":{"date":"2026-05-27","title":"Have I Been Pwned loaded 84K breached Mytheresa accounts"},"patchStatus":"no-fix-needed","product":"mytheresa.com","severity":"high","severityNote":"84K accounts · financial data exposed","slug":"mytheresa-data-breach","stacks":[],"startedAt":"2026-05-27","status":"closed","summary":"In April 2026, the luxury fashion e-commerce platform Mytheresa was listed as a victim of the ShinyHunters \"pay or leak\" extortion group. After the ransom deadline passed, the group publicly released the data which contained 84k unique email addresses. The exposed data also included names, phone numbers, physical addresses, purchases and partial credit card data including card type, last 4 digits and expiry date. Exposed data: email addresses, names, partial credit card data, phone numbers, physical addresses, purchases, salutations. The breach dates from Apr 12, 2026; Have I Been Pwned loaded it on May 27, 2026.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases","salutations"],"title":"Mytheresa data breach: 84K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mytheresa-data-breach","vendor":"Mytheresa"},{"auto":true,"category":"patch","closedAt":"2026-06-09","cveIds":["CVE-2026-48172"],"exploited":"in-the-wild","identifiers":["CVE-2026-48172"],"json":"https://helix.ml/threat-watch/i/litespeed-cpanel-plugin-cve-2026-48172.json","latestUpdate":{"date":"2026-05-26","title":"CISA added CVE-2026-48172 to the Known Exploited Vulnerabilities catalog (federal remediation due May 29, 2026)"},"patchStatus":"unknown","product":"cPanel Plugin","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"litespeed-cpanel-plugin-cve-2026-48172","stacks":["hosting"],"startedAt":"2026-05-26","status":"closed","summary":"LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges. CISA added CVE-2026-48172 to its Known Exploited Vulnerabilities catalog on May 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-266"],"title":"LiteSpeed cPanel Plugin Privilege Escalation Vulnerability (CVE-2026-48172)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/litespeed-cpanel-plugin-cve-2026-48172","vendor":"LiteSpeed"},{"auto":true,"category":"breach","closedAt":"2026-06-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AMERIPRISE"],"json":"https://helix.ml/threat-watch/i/ameriprise-data-breach.json","latestUpdate":{"date":"2026-05-26","title":"Have I Been Pwned loaded 502K breached Ameriprise accounts"},"patchStatus":"no-fix-needed","product":"ameriprise.com","severity":"medium","severityNote":"502K accounts","slug":"ameriprise-data-breach","stacks":[],"startedAt":"2026-05-26","status":"closed","summary":"In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a \"pay or leak\" extortion campaign. The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, and subsequently published the data after negotiations allegedly failed. The published data contained 500k unique email addresses as well as names, phone numbers, physical addresses and employer information. In their disclosure to state attorneys general, Ameriprise reported 47,876 affected people; the larger email address population represents contacts from Ameriprise's broader operational systems, including internal staff. Ameriprise further advised that they have \"implemented heightened monitoring of your account(s) to include enhanced identity verification procedures\". Exposed data: email addresses, employers, financial transactions, job titles, names, phone numbers, physical addresses. The breach dates from Mar 2, 2026; Have I Been Pwned loaded it on May 26, 2026.","tags":["data-breach","hibp","email-addresses","employers","financial-transactions","job-titles","names","phone-numbers","physical-addresses"],"title":"Ameriprise data breach: 502K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ameriprise-data-breach","vendor":"Ameriprise"},{"auto":true,"category":"breach","closedAt":"2026-06-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:7-ELEVEN"],"json":"https://helix.ml/threat-watch/i/7-eleven-data-breach.json","latestUpdate":{"date":"2026-05-24","title":"Have I Been Pwned loaded 185K breached 7-Eleven accounts"},"patchStatus":"no-fix-needed","product":"7-eleven.com","severity":"medium","severityNote":"185K accounts","slug":"7-eleven-data-breach","stacks":[],"startedAt":"2026-05-24","status":"closed","summary":"In April 2026, 7-Eleven was the victim of a \"pay or leak\" extortion campaign by ShinyHunters, with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained additional exposed data fields. The company later advised the breach was limited to \"certain 7-Eleven systems used to store franchisee documents\", a statement consistent with the exposed data. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Apr 8, 2026; Have I Been Pwned loaded it on May 24, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses"],"title":"7-Eleven data breach: 185K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/7-eleven-data-breach","vendor":"7-Eleven"},{"auto":true,"category":"patch","closedAt":"2026-06-05","cveIds":["CVE-2026-9082"],"exploited":"in-the-wild","identifiers":["CVE-2026-9082"],"json":"https://helix.ml/threat-watch/i/drupal-core-cve-2026-9082.json","latestUpdate":{"date":"2026-05-22","title":"CISA added CVE-2026-9082 to the Known Exploited Vulnerabilities catalog (federal remediation due May 27, 2026)"},"patchStatus":"patched","product":"Core","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"drupal-core-cve-2026-9082","stacks":["php"],"startedAt":"2026-05-22","status":"closed","summary":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalog on May 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","privilege-escalation","sql-injection","cwe-89"],"title":"Drupal Core SQL Injection Vulnerability (CVE-2026-9082)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/drupal-core-cve-2026-9082","vendor":"Drupal"},{"auto":true,"category":"patch","closedAt":"2026-06-04","cveIds":["CVE-2025-34291"],"exploited":"in-the-wild","identifiers":["CVE-2025-34291"],"json":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2025-34291.json","latestUpdate":{"date":"2026-05-21","title":"CISA added CVE-2025-34291 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 4, 2026)"},"patchStatus":"unknown","product":"Langflow","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"langflow-langflow-cve-2025-34291","stacks":[],"startedAt":"2026-05-21","status":"closed","summary":"Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. CISA added CVE-2025-34291 to its Known Exploited Vulnerabilities catalog on May 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-346"],"title":"Langflow Origin Validation Error Vulnerability (CVE-2025-34291)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2025-34291","vendor":"Langflow"},{"auto":true,"category":"patch","closedAt":"2026-06-04","cveIds":["CVE-2026-34926"],"exploited":"in-the-wild","identifiers":["CVE-2026-34926"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-cve-2026-34926.json","latestUpdate":{"date":"2026-05-21","title":"CISA added CVE-2026-34926 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 4, 2026)"},"patchStatus":"unknown","product":"Apex One","severity":"medium","severityNote":"CVSS 6.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-cve-2026-34926","stacks":[],"startedAt":"2026-05-21","status":"closed","summary":"Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. CISA added CVE-2026-34926 to its Known Exploited Vulnerabilities catalog on May 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-23"],"title":"Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability (CVE-2026-34926)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-cve-2026-34926","vendor":"Trend Micro"},{"auto":true,"category":"breach","closedAt":"2026-06-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WINDOWS93"],"json":"https://helix.ml/threat-watch/i/windows93-data-breach.json","latestUpdate":{"date":"2026-05-21","title":"Have I Been Pwned loaded 46K breached Windows93 / Myspace93 accounts"},"patchStatus":"no-fix-needed","product":"windows93.net","severity":"high","severityNote":"46K accounts · passwords exposed","slug":"windows93-data-breach","stacks":[],"startedAt":"2026-05-21","status":"closed","summary":"In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files. The compromised data was later leaked in June and included 46k Myspace93 accounts containing email and IP addresses, usernames and passwords stored in plain text. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2021; Have I Been Pwned loaded it on May 21, 2026.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Windows93 / Myspace93 data breach: 46K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/windows93-data-breach","vendor":"Windows93 / Myspace93"},{"auto":true,"category":"breach","closedAt":"2026-06-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DRAGONICA"],"json":"https://helix.ml/threat-watch/i/dragonica-data-breach.json","latestUpdate":{"date":"2026-05-21","title":"Have I Been Pwned loaded 126K breached Dragonica Lunaris accounts"},"patchStatus":"no-fix-needed","product":"playdragonica.eu","severity":"high","severityNote":"126K accounts · passwords exposed","slug":"dragonica-data-breach","stacks":[],"startedAt":"2026-05-21","status":"closed","summary":"In December 2025, the European Dragonica private server Dragonica Lunaris suffered a data breach. The incident exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. The service operator confirmed the breach and advised it has since been fixed. Exposed data: dates of birth, email addresses, names, passwords, spoken languages, usernames. The breach dates from Dec 6, 2025; Have I Been Pwned loaded it on May 21, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","spoken-languages","usernames"],"title":"Dragonica Lunaris data breach: 126K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/dragonica-data-breach","vendor":"Dragonica Lunaris"},{"auto":true,"category":"patch","closedAt":"2026-06-03","cveIds":["CVE-2008-4250"],"exploited":"in-the-wild","identifiers":["CVE-2008-4250"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2008-4250.json","latestUpdate":{"date":"2026-05-20","title":"CISA added CVE-2008-4250 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2026)"},"patchStatus":"patched","product":"Windows","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2008-4250","stacks":["windows"],"startedAt":"2026-05-20","status":"closed","summary":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. CISA added CVE-2008-4250 to its Known Exploited Vulnerabilities catalog on May 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-94"],"title":"Microsoft Windows Buffer Overflow Vulnerability (CVE-2008-4250)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2008-4250","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-06-03","cveIds":["CVE-2009-1537"],"exploited":"in-the-wild","identifiers":["CVE-2009-1537"],"json":"https://helix.ml/threat-watch/i/microsoft-directx-cve-2009-1537.json","latestUpdate":{"date":"2026-05-20","title":"CISA added CVE-2009-1537 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2026)"},"patchStatus":"patched","product":"DirectX","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-directx-cve-2009-1537","stacks":[],"startedAt":"2026-05-20","status":"closed","summary":"Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. CISA added CVE-2009-1537 to its Known Exploited Vulnerabilities catalog on May 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft DirectX NULL Byte Overwrite Vulnerability (CVE-2009-1537)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-directx-cve-2009-1537","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-06-03","cveIds":["CVE-2009-3459"],"exploited":"in-the-wild","identifiers":["CVE-2009-3459"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2009-3459.json","latestUpdate":{"date":"2026-05-20","title":"CISA added CVE-2009-3459 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2026)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2009-3459","stacks":[],"startedAt":"2026-05-20","status":"closed","summary":"Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. CISA added CVE-2009-3459 to its Known Exploited Vulnerabilities catalog on May 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (CVE-2009-3459)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2009-3459","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2026-06-03","cveIds":["CVE-2010-0249"],"exploited":"in-the-wild","identifiers":["CVE-2010-0249"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2010-0249.json","latestUpdate":{"date":"2026-05-20","title":"CISA added CVE-2010-0249 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2026)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2010-0249","stacks":["browser","windows"],"startedAt":"2026-05-20","status":"closed","summary":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2010-0249 to its Known Exploited Vulnerabilities catalog on May 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2010-0249)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2010-0249","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-06-03","cveIds":["CVE-2010-0806"],"exploited":"in-the-wild","identifiers":["CVE-2010-0806"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2010-0806.json","latestUpdate":{"date":"2026-05-20","title":"CISA added CVE-2010-0806 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2026)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2010-0806","stacks":["browser","windows"],"startedAt":"2026-05-20","status":"closed","summary":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2010-0806 to its Known Exploited Vulnerabilities catalog on May 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-399"],"title":"Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2010-0806)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2010-0806","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-06-03","cveIds":["CVE-2026-41091"],"exploited":"in-the-wild","identifiers":["CVE-2026-41091"],"json":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2026-41091.json","latestUpdate":{"date":"2026-05-20","title":"CISA added CVE-2026-41091 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2026)"},"patchStatus":"unknown","product":"Defender","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-defender-cve-2026-41091","stacks":[],"startedAt":"2026-05-20","status":"closed","summary":"Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2026-41091 to its Known Exploited Vulnerabilities catalog on May 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-59"],"title":"Microsoft Defender Link Following Vulnerability (CVE-2026-41091)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2026-41091","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-06-03","cveIds":["CVE-2026-45498"],"exploited":"in-the-wild","identifiers":["CVE-2026-45498"],"json":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2026-45498.json","latestUpdate":{"date":"2026-05-20","title":"CISA added CVE-2026-45498 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2026)"},"patchStatus":"unknown","product":"Defender","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-defender-cve-2026-45498","stacks":[],"startedAt":"2026-05-20","status":"closed","summary":"Microsoft Defender contains an unspecified vulnerability that allows for denial of service. CISA added CVE-2026-45498 to its Known Exploited Vulnerabilities catalog on May 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Microsoft Defender Denial of Service Vulnerability (CVE-2026-45498)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2026-45498","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2026-06-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CTT"],"json":"https://helix.ml/threat-watch/i/ctt-data-breach.json","latestUpdate":{"date":"2026-05-19","title":"Have I Been Pwned loaded 468K breached CTT accounts"},"patchStatus":"no-fix-needed","product":"ctt.pt","severity":"medium","severityNote":"468K accounts","slug":"ctt-data-breach","stacks":[],"startedAt":"2026-05-19","status":"closed","summary":"In April 2026, data allegedly obtained from CTT, Portugal's national postal service, was posted to a public hacking forum. The data included 468k unique email addresses along with names, phone numbers and parcel tracking numbers which can be used to retrieve the tracking history of the parcel. Exposed data: email addresses, names, phone numbers. The breach dates from Apr 26, 2026; Have I Been Pwned loaded it on May 19, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers"],"title":"CTT data breach: 468K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ctt-data-breach","vendor":"CTT"},{"auto":true,"category":"breach","closedAt":"2026-06-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADDI"],"json":"https://helix.ml/threat-watch/i/addi-data-breach.json","latestUpdate":{"date":"2026-05-18","title":"Have I Been Pwned loaded 34.5M breached Addi accounts"},"patchStatus":"no-fix-needed","product":"addi.com","severity":"medium","severityNote":"34.5M accounts","slug":"addi-data-breach","stacks":[],"startedAt":"2026-05-18","status":"closed","summary":"In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that \"it is possible that your personal information may have been compromised\". The \"pay or leak\" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points. Exposed data: age groups, credit scores, device information, email addresses, government issued ids, income levels, ip addresses, latitude and longitude pairs, names, phone numbers, physical addresses, purchases, socioeconomic levels. The breach dates from Mar 25, 2026; Have I Been Pwned loaded it on May 18, 2026.","tags":["data-breach","hibp","age-groups","credit-scores","device-information","email-addresses","government-issued-ids","income-levels","ip-addresses","latitude-and-longitude-pairs","names","phone-numbers","physical-addresses","purchases"],"title":"Addi data breach: 34.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/addi-data-breach","vendor":"Addi"},{"auto":true,"category":"patch","closedAt":"2026-05-29","cveIds":["CVE-2026-42897"],"exploited":"in-the-wild","identifiers":["CVE-2026-42897"],"json":"https://helix.ml/threat-watch/i/microsoft-microsoft-cve-2026-42897.json","latestUpdate":{"date":"2026-05-15","title":"CISA added CVE-2026-42897 to the Known Exploited Vulnerabilities catalog (federal remediation due May 29, 2026)"},"patchStatus":"unknown","product":"Microsoft","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-microsoft-cve-2026-42897","stacks":["windows"],"startedAt":"2026-05-15","status":"closed","summary":"Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. CISA added CVE-2026-42897 to its Known Exploited Vulnerabilities catalog on May 15, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Microsoft Exchange Server Cross-Site Scripting Vulnerability (CVE-2026-42897)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-microsoft-cve-2026-42897","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-05-28","cveIds":["CVE-2026-20182"],"exploited":"in-the-wild","identifiers":["CVE-2026-20182"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json","latestUpdate":{"date":"2026-05-14","title":"CISA added CVE-2026-20182 to the Known Exploited Vulnerabilities catalog (federal remediation due May 17, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-cve-2026-20182","stacks":["network"],"startedAt":"2026-05-14","status":"closed","summary":"Cisco Catalyst SD-WAN Controller \u0026 Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. CISA added CVE-2026-20182 to its Known Exploited Vulnerabilities catalog on May 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (CVE-2026-20182)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-cve-2026-20182","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-05-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ABRIGO"],"json":"https://helix.ml/threat-watch/i/abrigo-data-breach.json","latestUpdate":{"date":"2026-05-14","title":"Have I Been Pwned loaded 711K breached Abrigo accounts"},"patchStatus":"no-fix-needed","product":"abrigo.com","severity":"medium","severityNote":"711K accounts","slug":"abrigo-data-breach","stacks":[],"startedAt":"2026-05-14","status":"closed","summary":"In April 2026, the fintech software company Abrigo was targeted in a \"pay or leak\" extortion attempt by the ShinyHunters group. Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo staff and external contacts. Whilst separate from Abrigo's Salesforce compromise via the Drift application connector the previous year, the data fields described in that incident are consistent with the ShinyHunters data, namely that it was \"business contact information\" including \"institution name, employee name, email addresses, and phone numbers\". Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses. The breach dates from Apr 14, 2026; Have I Been Pwned loaded it on May 14, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses"],"title":"Abrigo data breach: 711K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/abrigo-data-breach","vendor":"Abrigo"},{"auto":true,"category":"breach","closedAt":"2026-05-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CANADALIFE"],"json":"https://helix.ml/threat-watch/i/canadalife-data-breach.json","latestUpdate":{"date":"2026-05-13","title":"Have I Been Pwned loaded 237K breached Canada Life accounts"},"patchStatus":"no-fix-needed","product":"canadalife.com","severity":"medium","severityNote":"237K accounts","slug":"canadalife-data-breach","stacks":[],"startedAt":"2026-05-13","status":"closed","summary":"In April 2026, Canada Life was the victim of a \"pay or leak\" extortion campaign by the ShinyHunters group. The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets. In their disclosure notice, Canada Life advised that \"it is a small proportion of our customers who may have been impacted\". In the wake of the incident, Canada Life also published an alert cautioning customers to be wary of phishing attacks, a pattern often seen after the public release of breached data. Exposed data: email addresses, job titles, names, phone numbers, physical addresses, salutations, support tickets. The breach dates from Apr 20, 2026; Have I Been Pwned loaded it on May 13, 2026.","tags":["data-breach","hibp","email-addresses","job-titles","names","phone-numbers","physical-addresses","salutations","support-tickets"],"title":"Canada Life data breach: 237K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/canadalife-data-breach","vendor":"Canada Life"},{"auto":true,"category":"breach","closedAt":"2026-05-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CUSHMANWAKEFIELD"],"json":"https://helix.ml/threat-watch/i/cushmanwakefield-data-breach.json","latestUpdate":{"date":"2026-05-12","title":"Have I Been Pwned loaded 310K breached Cushman \u0026 Wakefield accounts"},"patchStatus":"no-fix-needed","product":"cushmanwakefield.com","severity":"medium","severityNote":"310K accounts","slug":"cushmanwakefield-data-breach","stacks":[],"startedAt":"2026-05-12","status":"closed","summary":"In May 2026, the real estate services firm Cushman \u0026 Wakefield was the target of a \"pay or leak\" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C\u0026W email addresses along with tens of thousands of external email addresses and corporate contact records. The exposed data was primarily business information, including names, job titles, company addresses and phone numbers. Exposed data: email addresses, job titles, names, phone numbers, physical addresses, salutations. The breach dates from May 5, 2026; Have I Been Pwned loaded it on May 12, 2026.","tags":["data-breach","hibp","email-addresses","job-titles","names","phone-numbers","physical-addresses","salutations"],"title":"Cushman \u0026 Wakefield data breach: 310K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cushmanwakefield-data-breach","vendor":"Cushman \u0026 Wakefield"},{"auto":true,"category":"patch","closedAt":"2026-05-22","cveIds":["CVE-2026-42208"],"exploited":"in-the-wild","identifiers":["CVE-2026-42208"],"json":"https://helix.ml/threat-watch/i/berriai-litellm-cve-2026-42208.json","latestUpdate":{"date":"2026-05-08","title":"CISA added CVE-2026-42208 to the Known Exploited Vulnerabilities catalog (federal remediation due May 11, 2026)"},"patchStatus":"patched","product":"LiteLLM","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"berriai-litellm-cve-2026-42208","stacks":["ai"],"startedAt":"2026-05-08","status":"closed","summary":"BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. CISA added CVE-2026-42208 to its Known Exploited Vulnerabilities catalog on May 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"BerriAI LiteLLM SQL Injection Vulnerability (CVE-2026-42208)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/berriai-litellm-cve-2026-42208","vendor":"BerriAI"},{"auto":true,"category":"breach","closedAt":"2026-05-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZARA"],"json":"https://helix.ml/threat-watch/i/zara-data-breach.json","latestUpdate":{"date":"2026-05-08","title":"Have I Been Pwned loaded 197K breached Zara accounts"},"patchStatus":"no-fix-needed","product":"zara.com","severity":"medium","severityNote":"197K accounts","slug":"zara-data-breach","stacks":[],"startedAt":"2026-05-08","status":"closed","summary":"In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their \"pay or leak\" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information. Exposed data: email addresses, geographic locations, purchases, support tickets. The breach dates from Apr 15, 2026; Have I Been Pwned loaded it on May 8, 2026.","tags":["data-breach","hibp","email-addresses","geographic-locations","purchases","support-tickets"],"title":"Zara data breach: 197K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/zara-data-breach","vendor":"Zara"},{"auto":true,"category":"patch","closedAt":"2026-05-21","cveIds":["CVE-2026-6973"],"exploited":"in-the-wild","identifiers":["CVE-2026-6973"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973.json","latestUpdate":{"date":"2026-05-07","title":"CISA added CVE-2026-6973 to the Known Exploited Vulnerabilities catalog (federal remediation due May 10, 2026)"},"patchStatus":"unknown","product":"Endpoint Manager Mobile (EPMM)","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-cve-2026-6973","stacks":[],"startedAt":"2026-05-07","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. CISA added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog on May 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (CVE-2026-6973)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2026-05-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WOFLOW"],"json":"https://helix.ml/threat-watch/i/woflow-data-breach.json","latestUpdate":{"date":"2026-05-07","title":"Have I Been Pwned loaded 447K breached Woflow accounts"},"patchStatus":"no-fix-needed","product":"woflow.com","severity":"medium","severityNote":"447K accounts","slug":"woflow-data-breach","stacks":[],"startedAt":"2026-05-07","status":"closed","summary":"In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group. The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data. The trove included hundreds of thousands of email addresses, names, phone numbers and physical addresses, with the data indicating it related to Woflow customers and, in turn, the customers of merchants using their platform. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Mar 4, 2026; Have I Been Pwned loaded it on May 7, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Woflow data breach: 447K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/woflow-data-breach","vendor":"Woflow"},{"auto":true,"category":"patch","closedAt":"2026-05-20","cveIds":["CVE-2026-0300"],"exploited":"in-the-wild","identifiers":["CVE-2026-0300"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0300.json","latestUpdate":{"date":"2026-05-06","title":"CISA added CVE-2026-0300 to the Known Exploited Vulnerabilities catalog (federal remediation due May 9, 2026)"},"patchStatus":"unknown","product":"PAN-OS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2026-0300","stacks":["network"],"startedAt":"2026-05-06","status":"closed","summary":"Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities catalog on May 6, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability (CVE-2026-0300)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0300","vendor":"Palo Alto Networks"},{"auto":true,"category":"breach","closedAt":"2026-05-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEGIONPROXY"],"json":"https://helix.ml/threat-watch/i/legionproxy-data-breach.json","latestUpdate":{"date":"2026-05-06","title":"Have I Been Pwned loaded 10K breached LegionProxy accounts"},"patchStatus":"no-fix-needed","product":"legionproxy.io","severity":"high","severityNote":"10K accounts · passwords exposed","slug":"legionproxy-data-breach","stacks":[],"startedAt":"2026-05-06","status":"closed","summary":"In April 2026, the commercial residential and ISP proxy network LegionProxy suffered a data breach. The incident exposed 10k email addresses, bcrypt password hashes, names and purchases. Exposed data: email addresses, names, passwords, purchases. The breach dates from Apr 6, 2026; Have I Been Pwned loaded it on May 6, 2026.","tags":["data-breach","hibp","email-addresses","names","passwords","purchases"],"title":"LegionProxy data breach: 10K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/legionproxy-data-breach","vendor":"LegionProxy"},{"auto":true,"category":"breach","closedAt":"2026-05-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VIMEO"],"json":"https://helix.ml/threat-watch/i/vimeo-data-breach.json","latestUpdate":{"date":"2026-05-05","title":"Have I Been Pwned loaded 119K breached Vimeo accounts"},"patchStatus":"no-fix-needed","product":"vimeo.com","severity":"medium","severityNote":"119K accounts","slug":"vimeo-data-breach","stacks":[],"startedAt":"2026-05-05","status":"closed","summary":"In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their \"pay or leak\" campaign. They subsequently published hundreds of gigabytes of data, predominantly consisting of video titles, technical data and metadata. The data also included 119k unique email addresses, sometimes accompanied by names. Vimeo attributed the exposure to a breach of Anodot, a third-party analytics vendor, and advised the incident does not include \"Vimeo video content, valid user login credentials, or payment card information\". Exposed data: email addresses, names. The breach dates from Apr 28, 2026; Have I Been Pwned loaded it on May 5, 2026.","tags":["data-breach","hibp","email-addresses","names"],"title":"Vimeo data breach: 119K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/vimeo-data-breach","vendor":"Vimeo"},{"auto":true,"category":"breach","closedAt":"2026-05-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REBORNGAMING"],"json":"https://helix.ml/threat-watch/i/reborngaming-data-breach.json","latestUpdate":{"date":"2026-05-04","title":"Have I Been Pwned loaded 126 breached Reborn Gaming accounts"},"patchStatus":"no-fix-needed","product":"reborngaming.net","severity":"low","severityNote":"126 accounts","slug":"reborngaming-data-breach","stacks":[],"startedAt":"2026-05-04","status":"closed","summary":"In April 2026, the gaming community Reborn Gaming suffered a data breach due to a vulnerability in cPanel and WebHost Manager (WHM). The breach exposed 126 unique email addresses along with IP addresses and Steam IDs. Reborn Gaming self-submitted the data to Have I Been Pwned. Exposed data: email addresses, ip addresses. The breach dates from Apr 30, 2026; Have I Been Pwned loaded it on May 4, 2026.","tags":["data-breach","hibp","email-addresses","ip-addresses"],"title":"Reborn Gaming data breach: 126 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/reborngaming-data-breach","vendor":"Reborn Gaming"},{"auto":true,"category":"breach","closedAt":"2026-05-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MARCUSMILLICHAP"],"json":"https://helix.ml/threat-watch/i/marcusmillichap-data-breach.json","latestUpdate":{"date":"2026-05-03","title":"Have I Been Pwned loaded 1.8M breached Marcus \u0026 Millichap accounts"},"patchStatus":"no-fix-needed","product":"marcusmillichap.com","severity":"medium","severityNote":"1.8M accounts","slug":"marcusmillichap-data-breach","stacks":[],"startedAt":"2026-05-03","status":"closed","summary":"In April 2026, the commercial real estate brokerage firm Marcus \u0026 Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group. Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice, Marcus \u0026 Millichap advised that data which may have been accessed appeared limited to \"company forms, templates, marketing materials, and general contact information\". Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses. The breach dates from Apr 12, 2026; Have I Been Pwned loaded it on May 3, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses"],"title":"Marcus \u0026 Millichap data breach: 1.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/marcusmillichap-data-breach","vendor":"Marcus \u0026 Millichap"},{"auto":true,"category":"breach","closedAt":"2026-05-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZENBUSINESS"],"json":"https://helix.ml/threat-watch/i/zenbusiness-data-breach.json","latestUpdate":{"date":"2026-05-02","title":"Have I Been Pwned loaded 5.1M breached ZenBusiness accounts"},"patchStatus":"no-fix-needed","product":"zenbusiness.com","severity":"medium","severityNote":"5.1M accounts","slug":"zenbusiness-data-breach","stacks":[],"startedAt":"2026-05-02","status":"closed","summary":"In March 2026, the hacker and extortion group \"ShinyHunters\" claimed to have obtained a substantial corpus of data from ZenBusiness, a business formation and compliance platform. The group claimed the data had been exfiltrated from platforms including Snowflake, Mixpanel and Salesforce, and threatened to publish it if a ransom was not paid. The following month, after claiming payment had not been made, ShinyHunters publicly released the data. The collection amounted to many terabytes across thousands of files that appeared to originate from multiple systems and business functions, including leads, support records and other CRM-related data. The data contained approximately 5M unique email addresses, often accompanied by name and phone number depending on the source file. Exposed data: email addresses, names, phone numbers. The breach dates from Mar 27, 2026; Have I Been Pwned loaded it on May 2, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers"],"title":"ZenBusiness data breach: 5.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/zenbusiness-data-breach","vendor":"ZenBusiness"},{"auto":true,"category":"patch","closedAt":"2026-05-15","cveIds":["CVE-2026-31431"],"exploited":"in-the-wild","identifiers":["CVE-2026-31431"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2026-31431.json","latestUpdate":{"date":"2026-05-01","title":"CISA added CVE-2026-31431 to the Known Exploited Vulnerabilities catalog (federal remediation due May 15, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2026-31431","stacks":["linux"],"startedAt":"2026-05-01","status":"closed","summary":"Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog on May 1, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-669"],"title":"Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability (CVE-2026-31431)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2026-31431","vendor":"Linux"},{"auto":true,"category":"breach","closedAt":"2026-05-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AMAN"],"json":"https://helix.ml/threat-watch/i/aman-data-breach.json","latestUpdate":{"date":"2026-05-01","title":"Have I Been Pwned loaded 215K breached Aman accounts"},"patchStatus":"no-fix-needed","product":"aman.com","severity":"medium","severityNote":"215K accounts","slug":"aman-data-breach","stacks":[],"startedAt":"2026-05-01","status":"closed","summary":"In April 2026, the ultra-luxury hotel brand Aman was named by ShinyHunters as the target of a \"pay or leak\" extortion campaign, with the data allegedly obtained from their Salesforce CRM. The data was subsequently leaked publicly and contained over 200k unique email addresses. Whilst not present on all records, the data also included genders, physical addresses, phone numbers, nationalities, dates of birth, spouse names and VIP status codes. Exposed data: dates of birth, email addresses, genders, language preferences, names, nationalities, phone numbers, physical addresses, spouses names, vip statuses. The breach dates from Apr 20, 2026; Have I Been Pwned loaded it on May 1, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","language-preferences","names","nationalities","phone-numbers","physical-addresses","spouses-names","vip-statuses"],"title":"Aman data breach: 215K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/aman-data-breach","vendor":"Aman"},{"auto":true,"category":"patch","closedAt":"2026-05-14","cveIds":["CVE-2026-41940"],"exploited":"in-the-wild","identifiers":["CVE-2026-41940"],"json":"https://helix.ml/threat-watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json","latestUpdate":{"date":"2026-04-30","title":"CISA added CVE-2026-41940 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2026)"},"patchStatus":"unknown","product":"cPanel \u0026 WHM and WP2 (WordPress Squared)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940","stacks":["hosting","wordpress"],"startedAt":"2026-04-30","status":"closed","summary":"WebPros cPanel \u0026 WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog on Apr 30, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-306"],"title":"WebPros cPanel \u0026 WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability (CVE-2026-41940)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940","vendor":"WebPros"},{"auto":true,"category":"patch","closedAt":"2026-05-12","cveIds":["CVE-2024-1708"],"exploited":"in-the-wild","identifiers":["CVE-2024-1708"],"json":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2024-1708.json","latestUpdate":{"date":"2026-04-28","title":"CISA added CVE-2024-1708 to the Known Exploited Vulnerabilities catalog (federal remediation due May 12, 2026)"},"patchStatus":"unknown","product":"ScreenConnect","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"connectwise-screenconnect-cve-2024-1708","stacks":[],"startedAt":"2026-04-28","status":"closed","summary":"ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems. CISA added CVE-2024-1708 to its Known Exploited Vulnerabilities catalog on Apr 28, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"ConnectWise ScreenConnect Path Traversal Vulnerability (CVE-2024-1708)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2024-1708","vendor":"ConnectWise"},{"auto":true,"category":"patch","closedAt":"2026-05-12","cveIds":["CVE-2026-32202"],"exploited":"in-the-wild","identifiers":["CVE-2026-32202"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-32202.json","latestUpdate":{"date":"2026-04-28","title":"CISA added CVE-2026-32202 to the Known Exploited Vulnerabilities catalog (federal remediation due May 12, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-32202","stacks":["windows"],"startedAt":"2026-04-28","status":"closed","summary":"Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. CISA added CVE-2026-32202 to its Known Exploited Vulnerabilities catalog on Apr 28, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"Microsoft Windows Protection Mechanism Failure Vulnerability (CVE-2026-32202)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-32202","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2026-05-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADT"],"json":"https://helix.ml/threat-watch/i/adt-data-breach.json","latestUpdate":{"date":"2026-04-27","title":"Have I Been Pwned loaded 5.5M breached ADT accounts"},"patchStatus":"no-fix-needed","product":"adt.com","severity":"medium","severityNote":"5.5M accounts","slug":"adt-data-breach","stacks":[],"startedAt":"2026-04-27","status":"closed","summary":"In April 2026, home security firm ADT confirmed a data breach by ShinyHunters, which listed the company on its website as part of a \"pay or leak\" extortion attempt. The breach impacted 5.5M unique email addresses along with names, phone numbers and physical addresses. ADT also advised that \"in a small percentage of cases, dates of birth and the last four digits of Social Security numbers or Tax IDs were included\" and that it had contacted all affected people. Exposed data: dates of birth, email addresses, names, partial government issued ids, phone numbers, physical addresses. The breach dates from Apr 20, 2026; Have I Been Pwned loaded it on Apr 27, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","partial-government-issued-ids","phone-numbers","physical-addresses"],"title":"ADT data breach: 5.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/adt-data-breach","vendor":"ADT"},{"auto":true,"category":"breach","closedAt":"2026-05-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PITNEYBOWES"],"json":"https://helix.ml/threat-watch/i/pitneybowes-data-breach.json","latestUpdate":{"date":"2026-04-27","title":"Have I Been Pwned loaded 8.2M breached Pitney Bowes accounts"},"patchStatus":"no-fix-needed","product":"pitneybowes.com","severity":"medium","severityNote":"8.2M accounts","slug":"pitneybowes-data-breach","stacks":[],"startedAt":"2026-04-27","status":"closed","summary":"In April 2026, the hacking collective ShinyHunters claimed to have obtained data from Pitney Bowes as part of a broader extortion campaign that also named several other organisations. After negotiations allegedly failed, the group publicly released the data which included 8.2M unique email addresses, along with names, phone numbers and physical addresses. A subset of the data also included Pitney Bowes employee records with job titles. Exposed data: email addresses, job titles, names, phone numbers, physical addresses. The breach dates from Apr 20, 2026; Have I Been Pwned loaded it on Apr 27, 2026.","tags":["data-breach","hibp","email-addresses","job-titles","names","phone-numbers","physical-addresses"],"title":"Pitney Bowes data breach: 8.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/pitneybowes-data-breach","vendor":"Pitney Bowes"},{"auto":true,"category":"breach","closedAt":"2026-05-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UDEMY"],"json":"https://helix.ml/threat-watch/i/udemy-data-breach.json","latestUpdate":{"date":"2026-04-26","title":"Have I Been Pwned loaded 1.4M breached Udemy accounts"},"patchStatus":"no-fix-needed","product":"udemy.com","severity":"medium","severityNote":"1.4M accounts","slug":"udemy-data-breach","stacks":[],"startedAt":"2026-04-26","status":"closed","summary":"In April 2026, online training company Udemy was the victim of a “pay or leak” extortion attempt perpetrated by the ShinyHunters group. The data was subsequently leaked publicly and contained 1.4M unique email addresses belonging to customers and instructors. The data also included names, physical addresses, phone numbers, employer information and instructor payout methods including PayPal, cheque and bank transfer. Exposed data: email addresses, employers, job titles, names, payment methods, phone numbers, physical addresses. The breach dates from Apr 24, 2026; Have I Been Pwned loaded it on Apr 26, 2026.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","payment-methods","phone-numbers","physical-addresses"],"title":"Udemy data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/udemy-data-breach","vendor":"Udemy"},{"auto":true,"category":"patch","closedAt":"2026-05-08","cveIds":["CVE-2025-29635"],"exploited":"in-the-wild","identifiers":["CVE-2025-29635"],"json":"https://helix.ml/threat-watch/i/d-link-dir-823x-cve-2025-29635.json","latestUpdate":{"date":"2026-04-24","title":"CISA added CVE-2025-29635 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2026)"},"patchStatus":"unknown","product":"DIR-823X","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-823x-cve-2025-29635","stacks":["network"],"startedAt":"2026-04-24","status":"closed","summary":"D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2025-29635 to its Known Exploited Vulnerabilities catalog on Apr 24, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"D-Link DIR-823X Command Injection Vulnerability (CVE-2025-29635)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/d-link-dir-823x-cve-2025-29635","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2026-05-08","cveIds":["CVE-2024-7399"],"exploited":"in-the-wild","identifiers":["CVE-2024-7399"],"json":"https://helix.ml/threat-watch/i/samsung-magicinfo-9-server-cve-2024-7399.json","latestUpdate":{"date":"2026-04-24","title":"CISA added CVE-2024-7399 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2026)"},"patchStatus":"unknown","product":"MagicINFO 9 Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-magicinfo-9-server-cve-2024-7399","stacks":[],"startedAt":"2026-04-24","status":"closed","summary":"Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority. CISA added CVE-2024-7399 to its Known Exploited Vulnerabilities catalog on Apr 24, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22","cwe-434"],"title":"Samsung MagicINFO 9 Server Path Traversal Vulnerability (CVE-2024-7399)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/samsung-magicinfo-9-server-cve-2024-7399","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2026-05-08","cveIds":["CVE-2024-57728"],"exploited":"in-the-wild","identifiers":["CVE-2024-57728"],"json":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2024-57728.json","latestUpdate":{"date":"2026-04-24","title":"CISA added CVE-2024-57728 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2026)"},"patchStatus":"unknown","product":"SimpleHelp","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"simplehelp-simplehelp-cve-2024-57728","stacks":[],"startedAt":"2026-04-24","status":"closed","summary":"SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. CISA added CVE-2024-57728 to its Known Exploited Vulnerabilities catalog on Apr 24, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-22"],"title":"SimpleHelp Path Traversal Vulnerability (CVE-2024-57728)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2024-57728","vendor":"SimpleHelp "},{"auto":true,"category":"patch","closedAt":"2026-05-08","cveIds":["CVE-2024-57726"],"exploited":"in-the-wild","identifiers":["CVE-2024-57726"],"json":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2024-57726.json","latestUpdate":{"date":"2026-04-24","title":"CISA added CVE-2024-57726 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2026)"},"patchStatus":"unknown","product":"SimpleHelp","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"simplehelp-simplehelp-cve-2024-57726","stacks":[],"startedAt":"2026-04-24","status":"closed","summary":"SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. CISA added CVE-2024-57726 to its Known Exploited Vulnerabilities catalog on Apr 24, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-862"],"title":"SimpleHelp Missing Authorization Vulnerability (CVE-2024-57726)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2024-57726","vendor":"SimpleHelp "},{"auto":true,"category":"breach","closedAt":"2026-05-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CARNIVAL"],"json":"https://helix.ml/threat-watch/i/carnival-data-breach.json","latestUpdate":{"date":"2026-04-24","title":"Have I Been Pwned loaded 7.5M breached Carnival accounts"},"patchStatus":"no-fix-needed","product":"carnivalcorp.com","severity":"medium","severityNote":"7.5M accounts","slug":"carnival-data-breach","stacks":[],"startedAt":"2026-04-24","status":"closed","summary":"In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. The following week, the group published the data publicly, which contained 8.7M records with 7.5M unique email addresses. The data contained fields indicating it related to the Mariner Society loyalty program run by Holland America, a cruise line brand under Carnival, and included names, dates of birth, genders and data relating to status within the loyalty program. Carnival acknowledged a phishing incident involving a single user account and advised they were working to better understand the scope of the unauthorised activity. Exposed data: dates of birth, email addresses, genders, geographic locations, loyalty program details, names, salutations. The breach dates from Apr 18, 2026; Have I Been Pwned loaded it on Apr 24, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","loyalty-program-details","names","salutations"],"title":"Carnival data breach: 7.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/carnival-data-breach","vendor":"Carnival"},{"auto":true,"category":"patch","closedAt":"2026-05-07","cveIds":["CVE-2026-39987"],"exploited":"in-the-wild","identifiers":["CVE-2026-39987"],"json":"https://helix.ml/threat-watch/i/marimo-marimo-cve-2026-39987.json","latestUpdate":{"date":"2026-04-23","title":"CISA added CVE-2026-39987 to the Known Exploited Vulnerabilities catalog (federal remediation due May 7, 2026)"},"patchStatus":"patched","product":"Marimo","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"marimo-marimo-cve-2026-39987","stacks":[],"startedAt":"2026-04-23","status":"closed","summary":"Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands. CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog on Apr 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-306"],"title":"Marimo Remote Code Execution Vulnerability (CVE-2026-39987)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/marimo-marimo-cve-2026-39987","vendor":"Marimo"},{"auto":true,"category":"patch","closedAt":"2026-05-06","cveIds":["CVE-2026-33825"],"exploited":"in-the-wild","identifiers":["CVE-2026-33825"],"json":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2026-33825.json","latestUpdate":{"date":"2026-04-22","title":"CISA added CVE-2026-33825 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2026)"},"patchStatus":"unknown","product":"Defender","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-defender-cve-2026-33825","stacks":[],"startedAt":"2026-04-22","status":"closed","summary":"Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. CISA added CVE-2026-33825 to its Known Exploited Vulnerabilities catalog on Apr 22, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-1220"],"title":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability (CVE-2026-33825)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2026-33825","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2026-20122"],"exploited":"in-the-wild","identifiers":["CVE-2026-20122"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2026-20122 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 23, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN Manger","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-manger-cve-2026-20122","stacks":["network"],"startedAt":"2026-04-20","status":"closed","summary":"Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. CISA added CVE-2026-20122 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-648"],"title":"Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability (CVE-2026-20122)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2026-20133"],"exploited":"in-the-wild","identifiers":["CVE-2026-20133"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2026-20133 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 23, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN Manager","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-manager-cve-2026-20133","stacks":["network"],"startedAt":"2026-04-20","status":"closed","summary":"Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. CISA added CVE-2026-20133 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-20133)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2025-2749"],"exploited":"in-the-wild","identifiers":["CVE-2025-2749"],"json":"https://helix.ml/threat-watch/i/kentico-kentico-xperience-cve-2025-2749.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2025-2749 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2026)"},"patchStatus":"patched","product":"Kentico Xperience","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"kentico-kentico-xperience-cve-2025-2749","stacks":[],"startedAt":"2026-04-20","status":"closed","summary":"Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations. CISA added CVE-2025-2749 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22","cwe-434"],"title":"Kentico Xperience Path Traversal Vulnerability (CVE-2025-2749)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/kentico-kentico-xperience-cve-2025-2749","vendor":"Kentico"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2023-27351"],"exploited":"in-the-wild","identifiers":["CVE-2023-27351"],"json":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2023-27351.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2023-27351 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2026)"},"patchStatus":"unknown","product":"NG/MF","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"papercut-ng-mf-cve-2023-27351","stacks":[],"startedAt":"2026-04-20","status":"closed","summary":"PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class. CISA added CVE-2023-27351 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-287"],"title":"PaperCut NG/MF Improper Authentication Vulnerability (CVE-2023-27351)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2023-27351","vendor":"PaperCut"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2025-48700"],"exploited":"in-the-wild","identifiers":["CVE-2025-48700"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-48700.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2025-48700 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 23, 2026)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2025-48700","stacks":[],"startedAt":"2026-04-20","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. CISA added CVE-2025-48700 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (CVE-2025-48700)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-48700","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2026-20128"],"exploited":"in-the-wild","identifiers":["CVE-2026-20128"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20128.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2026-20128 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 23, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN Manager","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-manager-cve-2026-20128","stacks":["network"],"startedAt":"2026-04-20","status":"closed","summary":"Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user. CISA added CVE-2026-20128 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-257"],"title":"Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability (CVE-2026-20128)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20128","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2025-32975"],"exploited":"in-the-wild","identifiers":["CVE-2025-32975"],"json":"https://helix.ml/threat-watch/i/quest-kace-systems-management-appliance-sma-cve-2025-32975.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2025-32975 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2026)"},"patchStatus":"unknown","product":"KACE Systems Management Appliance (SMA)","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"quest-kace-systems-management-appliance-sma-cve-2025-32975","stacks":[],"startedAt":"2026-04-20","status":"closed","summary":"Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials. CISA added CVE-2025-32975 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability (CVE-2025-32975)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/quest-kace-systems-management-appliance-sma-cve-2025-32975","vendor":"Quest"},{"auto":true,"category":"patch","closedAt":"2026-05-04","cveIds":["CVE-2024-27199"],"exploited":"in-the-wild","identifiers":["CVE-2024-27199"],"json":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2024-27199.json","latestUpdate":{"date":"2026-04-20","title":"CISA added CVE-2024-27199 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2026)"},"patchStatus":"unknown","product":"TeamCity","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"jetbrains-teamcity-cve-2024-27199","stacks":["devtools"],"startedAt":"2026-04-20","status":"closed","summary":"JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. CISA added CVE-2024-27199 to its Known Exploited Vulnerabilities catalog on Apr 20, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-23"],"title":"JetBrains TeamCity Relative Path Traversal Vulnerability (CVE-2024-27199)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2024-27199","vendor":"JetBrains"},{"auto":true,"category":"breach","closedAt":"2026-05-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AMTRAK"],"json":"https://helix.ml/threat-watch/i/amtrak-data-breach.json","latestUpdate":{"date":"2026-04-17","title":"Have I Been Pwned loaded 2.1M breached Amtrak accounts"},"patchStatus":"no-fix-needed","product":"amtrak.com","severity":"medium","severityNote":"2.1M accounts","slug":"amtrak-data-breach","stacks":[],"startedAt":"2026-04-17","status":"closed","summary":"In April 2026, the hacking group ShinyHunters claimed they had breached Amtrak. The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly. They subsequently published the alleged data which contained over 2M unique email addresses along with names, physical addresses and customer support records. Exposed data: email addresses, names, physical addresses, support tickets. The breach dates from Apr 3, 2026; Have I Been Pwned loaded it on Apr 17, 2026.","tags":["data-breach","hibp","email-addresses","names","physical-addresses","support-tickets"],"title":"Amtrak data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/amtrak-data-breach","vendor":"Amtrak"},{"auto":true,"category":"patch","closedAt":"2026-04-30","cveIds":["CVE-2026-34197"],"exploited":"in-the-wild","identifiers":["CVE-2026-34197"],"json":"https://helix.ml/threat-watch/i/apache-activemq-cve-2026-34197.json","latestUpdate":{"date":"2026-04-16","title":"CISA added CVE-2026-34197 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 30, 2026)"},"patchStatus":"unknown","product":"ActiveMQ","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-activemq-cve-2026-34197","stacks":[],"startedAt":"2026-04-16","status":"closed","summary":"Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog on Apr 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20","cwe-94"],"title":"Apache ActiveMQ Improper Input Validation Vulnerability (CVE-2026-34197)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apache-activemq-cve-2026-34197","vendor":"Apache"},{"auto":true,"category":"breach","closedAt":"2026-04-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MCGRAWHILL"],"json":"https://helix.ml/threat-watch/i/mcgrawhill-data-breach.json","latestUpdate":{"date":"2026-04-16","title":"Have I Been Pwned loaded 13.5M breached McGraw Hill accounts"},"patchStatus":"no-fix-needed","product":"mheducation.com","severity":"medium","severityNote":"13.5M accounts","slug":"mcgrawhill-data-breach","stacks":[],"startedAt":"2026-04-16","status":"closed","summary":"In April 2026, education company McGraw Hill confirmed a data breach following an extortion attempt. Attributed to a Salesforce misconfiguration, the company stated the incident exposed \"a limited set of data from a webpage hosted by Salesforce on its platform\". More than 100GB of data was later publicly distributed, containing 13.5M unique email addresses across multiple files, with additional fields such as name, physical address and phone number appearing inconsistently across some records. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Apr 10, 2026; Have I Been Pwned loaded it on Apr 16, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"McGraw Hill data breach: 13.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mcgrawhill-data-breach","vendor":"McGraw Hill"},{"auto":true,"category":"patch","closedAt":"2026-04-28","cveIds":["CVE-2009-0238"],"exploited":"in-the-wild","identifiers":["CVE-2009-0238"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0238.json","latestUpdate":{"date":"2026-04-14","title":"CISA added CVE-2009-0238 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2026)"},"patchStatus":"unknown","product":"Office","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2009-0238","stacks":["windows"],"startedAt":"2026-04-14","status":"closed","summary":"Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object. CISA added CVE-2009-0238 to its Known Exploited Vulnerabilities catalog on Apr 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Microsoft Office Remote Code Execution (CVE-2009-0238)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0238","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-04-28","cveIds":["CVE-2026-32201"],"exploited":"in-the-wild","identifiers":["CVE-2026-32201"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2026-32201.json","latestUpdate":{"date":"2026-04-14","title":"CISA added CVE-2026-32201 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2026)"},"patchStatus":"unknown","product":"SharePoint Server","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-server-cve-2026-32201","stacks":["windows"],"startedAt":"2026-04-14","status":"closed","summary":"Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. CISA added CVE-2026-32201 to its Known Exploited Vulnerabilities catalog on Apr 14, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Microsoft SharePoint Server Improper Input Validation Vulnerability (CVE-2026-32201)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2026-32201","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-04-27","cveIds":["CVE-2012-1854"],"exploited":"in-the-wild","identifiers":["CVE-2012-1854"],"json":"https://helix.ml/threat-watch/i/microsoft-visual-basic-for-applications-vba-cve-2012-1854.json","latestUpdate":{"date":"2026-04-13","title":"CISA added CVE-2012-1854 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2026)"},"patchStatus":"unknown","product":"Visual Basic for Applications (VBA)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-visual-basic-for-applications-vba-cve-2012-1854","stacks":[],"startedAt":"2026-04-13","status":"closed","summary":"Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution. CISA added CVE-2012-1854 to its Known Exploited Vulnerabilities catalog on Apr 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-426"],"title":"Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability (CVE-2012-1854)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-visual-basic-for-applications-vba-cve-2012-1854","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-04-27","cveIds":["CVE-2025-60710"],"exploited":"in-the-wild","identifiers":["CVE-2025-60710"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-60710.json","latestUpdate":{"date":"2026-04-13","title":"CISA added CVE-2025-60710 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-60710","stacks":["windows"],"startedAt":"2026-04-13","status":"closed","summary":"Microsoft Windows contains a link following vulnerability that allows for privilege escalation. CISA added CVE-2025-60710 to its Known Exploited Vulnerabilities catalog on Apr 13, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows Link Following Vulnerability (CVE-2025-60710)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-60710","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-04-27","cveIds":["CVE-2023-21529"],"exploited":"in-the-wild","identifiers":["CVE-2023-21529"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2023-21529.json","latestUpdate":{"date":"2026-04-13","title":"CISA added CVE-2023-21529 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2026)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2023-21529","stacks":["rust","windows"],"startedAt":"2026-04-13","status":"closed","summary":"Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution. CISA added CVE-2023-21529 to its Known Exploited Vulnerabilities catalog on Apr 13, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502"],"title":"Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability (CVE-2023-21529)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2023-21529","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-04-27","cveIds":["CVE-2023-36424"],"exploited":"in-the-wild","identifiers":["CVE-2023-36424"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36424.json","latestUpdate":{"date":"2026-04-13","title":"CISA added CVE-2023-36424 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2026)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-36424","stacks":["windows"],"startedAt":"2026-04-13","status":"closed","summary":"Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation. CISA added CVE-2023-36424 to its Known Exploited Vulnerabilities catalog on Apr 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Microsoft Windows Out-of-Bounds Read Vulnerability (CVE-2023-36424)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36424","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-04-27","cveIds":["CVE-2020-9715"],"exploited":"in-the-wild","identifiers":["CVE-2020-9715"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-cve-2020-9715.json","latestUpdate":{"date":"2026-04-13","title":"CISA added CVE-2020-9715 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2026)"},"patchStatus":"patched","product":"Acrobat","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-cve-2020-9715","stacks":[],"startedAt":"2026-04-13","status":"closed","summary":"Adobe Acrobat contains a use-after-free vulnerability that allows for code execution. CISA added CVE-2020-9715 to its Known Exploited Vulnerabilities catalog on Apr 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Acrobat Use-After-Free Vulnerability (CVE-2020-9715)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-cve-2020-9715","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2026-04-27","cveIds":["CVE-2026-21643"],"exploited":"in-the-wild","identifiers":["CVE-2026-21643"],"json":"https://helix.ml/threat-watch/i/fortinet-forticlient-ems-cve-2026-21643.json","latestUpdate":{"date":"2026-04-13","title":"CISA added CVE-2026-21643 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 16, 2026)"},"patchStatus":"unknown","product":"FortiClient EMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-forticlient-ems-cve-2026-21643","stacks":["network"],"startedAt":"2026-04-13","status":"closed","summary":"Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. CISA added CVE-2026-21643 to its Known Exploited Vulnerabilities catalog on Apr 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Fortinet FortiClient EMS SQL Injection Vulnerability (CVE-2026-21643)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-forticlient-ems-cve-2026-21643","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2026-04-27","cveIds":["CVE-2026-34621"],"exploited":"in-the-wild","identifiers":["CVE-2026-34621"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2026-34621.json","latestUpdate":{"date":"2026-04-13","title":"CISA added CVE-2026-34621 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2026)"},"patchStatus":"unknown","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2026-34621","stacks":[],"startedAt":"2026-04-13","status":"closed","summary":"Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution. CISA added CVE-2026-34621 to its Known Exploited Vulnerabilities catalog on Apr 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-1321"],"title":"Adobe Acrobat and Reader Prototype Pollution Vulnerability (CVE-2026-34621)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2026-34621","vendor":"Adobe"},{"auto":true,"category":"breach","closedAt":"2026-04-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HALLMARK"],"json":"https://helix.ml/threat-watch/i/hallmark-data-breach.json","latestUpdate":{"date":"2026-04-12","title":"Have I Been Pwned loaded 1.7M breached Hallmark accounts"},"patchStatus":"no-fix-needed","product":"hallmark.com","severity":"medium","severityNote":"1.7M accounts","slug":"hallmark-data-breach","stacks":[],"startedAt":"2026-04-12","status":"closed","summary":"In March 2026, Hallmark suffered an alleged breach and subsequent extortion after attackers gained access to data stored within Salesforce. The data was later published after the extortion deadline passed, exposing 1.7M unique email addresses across both Hallmark and the Hallmark+ streaming service, along with names, phone numbers, physical addresses and support tickets. Exposed data: email addresses, names, phone numbers, physical addresses, support tickets. The breach dates from Mar 31, 2026; Have I Been Pwned loaded it on Apr 12, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","support-tickets"],"title":"Hallmark data breach: 1.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/hallmark-data-breach","vendor":"Hallmark"},{"auto":true,"category":"patch","closedAt":"2026-04-22","cveIds":["CVE-2026-1340"],"exploited":"in-the-wild","identifiers":["CVE-2026-1340"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1340.json","latestUpdate":{"date":"2026-04-08","title":"CISA added CVE-2026-1340 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 11, 2026)"},"patchStatus":"unknown","product":"Endpoint Manager Mobile (EPMM)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-cve-2026-1340","stacks":[],"startedAt":"2026-04-08","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. CISA added CVE-2026-1340 to its Known Exploited Vulnerabilities catalog on Apr 8, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (CVE-2026-1340)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1340","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2026-04-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYLOVELYAI"],"json":"https://helix.ml/threat-watch/i/mylovelyai-data-breach.json","latestUpdate":{"date":"2026-04-08","title":"Have I Been Pwned loaded 106K breached My Lovely AI accounts"},"patchStatus":"no-fix-needed","product":"mylovely.ai","severity":"high","severityNote":"106K accounts","slug":"mylovelyai-data-breach","stacks":[],"startedAt":"2026-04-08","status":"closed","summary":"In April 2026, the NSFW AI girlfriend platform My Lovely AI suffered a data breach that exposed over 100k users. The data included user-created prompts and links to the resulting AI-generated images, along with a small number of Discord and X usernames. Exposed data: email addresses, social media profiles. The breach dates from Apr 7, 2026; Have I Been Pwned loaded it on Apr 8, 2026.","tags":["data-breach","hibp","email-addresses","social-media-profiles"],"title":"My Lovely AI data breach: 106K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mylovelyai-data-breach","vendor":"My Lovely AI"},{"auto":true,"category":"patch","closedAt":"2026-04-20","cveIds":["CVE-2026-35616"],"exploited":"in-the-wild","identifiers":["CVE-2026-35616"],"json":"https://helix.ml/threat-watch/i/fortinet-forticlient-ems-cve-2026-35616.json","latestUpdate":{"date":"2026-04-06","title":"CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 9, 2026)"},"patchStatus":"patched","product":"FortiClient EMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-forticlient-ems-cve-2026-35616","stacks":["network"],"startedAt":"2026-04-06","status":"closed","summary":"Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. CISA added CVE-2026-35616 to its Known Exploited Vulnerabilities catalog on Apr 6, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Fortinet FortiClient EMS Improper Access Control Vulnerability (CVE-2026-35616)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-forticlient-ems-cve-2026-35616","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2026-04-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SONGTRIVIA2"],"json":"https://helix.ml/threat-watch/i/songtrivia2-data-breach.json","latestUpdate":{"date":"2026-04-04","title":"Have I Been Pwned loaded 291K breached SongTrivia2 accounts"},"patchStatus":"no-fix-needed","product":"songtrivia2.io","severity":"high","severityNote":"291K accounts · passwords exposed","slug":"songtrivia2-data-breach","stacks":[],"startedAt":"2026-04-04","status":"closed","summary":"In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum. The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt password hashes. The data also included names, usernames and avatars. Exposed data: auth tokens, avatars, email addresses, names, passwords, usernames. The breach dates from Apr 2, 2026; Have I Been Pwned loaded it on Apr 4, 2026.","tags":["data-breach","hibp","auth-tokens","avatars","email-addresses","names","passwords","usernames"],"title":"SongTrivia2 data breach: 291K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/songtrivia2-data-breach","vendor":"SongTrivia2"},{"auto":true,"category":"breach","closedAt":"2026-04-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CRUNCHYROLL"],"json":"https://helix.ml/threat-watch/i/crunchyroll-data-breach.json","latestUpdate":{"date":"2026-04-04","title":"Have I Been Pwned loaded 1.2M breached Crunchyroll accounts"},"patchStatus":"no-fix-needed","product":"crunchyroll.com","severity":"medium","severityNote":"1.2M accounts","slug":"crunchyroll-data-breach","stacks":[],"startedAt":"2026-04-04","status":"closed","summary":"In March 2026, the anime streaming service Crunchyroll suffered a data breach alleged to have impacted 6.8M users. The exposed data is reported to have originated from the company's Zendesk support system where \"name, login name, email address, IP address, general geographic location and the contents of the support tickets\" were exposed. A subset of 1.2M email addresses from an alleged 2M record dataset being sold was later provided to HIBP. Exposed data: email addresses. The breach dates from Mar 12, 2026; Have I Been Pwned loaded it on Apr 4, 2026.","tags":["data-breach","hibp","email-addresses"],"title":"Crunchyroll data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/crunchyroll-data-breach","vendor":"Crunchyroll"},{"auto":true,"category":"patch","closedAt":"2026-04-16","cveIds":["CVE-2026-3502"],"exploited":"in-the-wild","identifiers":["CVE-2026-3502"],"json":"https://helix.ml/threat-watch/i/trueconf-client-cve-2026-3502.json","latestUpdate":{"date":"2026-04-02","title":"CISA added CVE-2026-3502 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 16, 2026)"},"patchStatus":"unknown","product":"Client","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trueconf-client-cve-2026-3502","stacks":[],"startedAt":"2026-04-02","status":"closed","summary":"TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user. CISA added CVE-2026-3502 to its Known Exploited Vulnerabilities catalog on Apr 2, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-494"],"title":"TrueConf Client Download of Code Without Integrity Check Vulnerability (CVE-2026-3502)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/trueconf-client-cve-2026-3502","vendor":"TrueConf"},{"auto":true,"category":"patch","closedAt":"2026-04-15","cveIds":["CVE-2026-5281"],"exploited":"in-the-wild","identifiers":["CVE-2026-5281"],"json":"https://helix.ml/threat-watch/i/google-dawn-cve-2026-5281.json","latestUpdate":{"date":"2026-04-01","title":"CISA added CVE-2026-5281 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2026)"},"patchStatus":"unknown","product":"Dawn","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-dawn-cve-2026-5281","stacks":[],"startedAt":"2026-04-01","status":"closed","summary":"Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2026-5281 to its Known Exploited Vulnerabilities catalog on Apr 1, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Google Dawn Use-After-Free Vulnerability (CVE-2026-5281)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-dawn-cve-2026-5281","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2026-04-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUCCESS"],"json":"https://helix.ml/threat-watch/i/success-data-breach.json","latestUpdate":{"date":"2026-04-01","title":"Have I Been Pwned loaded 253K breached SUCCESS accounts"},"patchStatus":"no-fix-needed","product":"success.com","severity":"high","severityNote":"253K accounts · passwords exposed","slug":"success-data-breach","stacks":[],"startedAt":"2026-04-01","status":"closed","summary":"In March 2026, the personal development and achievement media brand SUCCESS suffered a data breach. The incident exposed 250k unique email addresses along with names, IP addresses, phone numbers and, for a limited number of staff members, bcrypt password hashes. The data also included orders containing physical addresses and the payment method used. In SUCCESS' disclosure notice, they advised their system had also been abused to send offensive newsletters with quotes falsely attributed to contributors. Exposed data: device information, email addresses, ip addresses, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Mar 4, 2026; Have I Been Pwned loaded it on Apr 1, 2026.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","purchases"],"title":"SUCCESS data breach: 253K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/success-data-breach","vendor":"SUCCESS"},{"auto":true,"category":"breach","closedAt":"2026-04-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CUTIESAI"],"json":"https://helix.ml/threat-watch/i/cutiesai-data-breach.json","latestUpdate":{"date":"2026-03-31","title":"Have I Been Pwned loaded 144K breached Cuties AI accounts"},"patchStatus":"no-fix-needed","product":"cuties.ai","severity":"high","severityNote":"144K accounts","slug":"cutiesai-data-breach","stacks":[],"startedAt":"2026-03-31","status":"closed","summary":"In March 2026, the NSFW AI companion platform Cuties AI suffered a data breach that was subsequently published to a public hacking forum. The incident exposed 144k unique email addresses along with display names, avatars, prompts and descriptions used to generate AI adult images, as well as URLs to the generated content. The data also included the account that created the content and a stated \"preference\" of either female or trans. Exposed data: avatars, display names, email addresses. The breach dates from Mar 21, 2025; Have I Been Pwned loaded it on Mar 31, 2026.","tags":["data-breach","hibp","avatars","display-names","email-addresses"],"title":"Cuties AI data breach: 144K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cutiesai-data-breach","vendor":"Cuties AI"},{"auto":true,"category":"patch","closedAt":"2026-04-13","cveIds":["CVE-2026-3055"],"exploited":"in-the-wild","identifiers":["CVE-2026-3055"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-3055.json","latestUpdate":{"date":"2026-03-30","title":"CISA added CVE-2026-3055 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 2, 2026)"},"patchStatus":"unknown","product":"NetScaler","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-cve-2026-3055","stacks":["cloud","vpn"],"startedAt":"2026-03-30","status":"closed","summary":"Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread. CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities catalog on Mar 30, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Citrix NetScaler Out-of-Bounds Read Vulnerability (CVE-2026-3055)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-3055","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2026-04-10","cveIds":["CVE-2025-53521"],"exploited":"in-the-wild","identifiers":["CVE-2025-53521"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-cve-2025-53521.json","latestUpdate":{"date":"2026-03-27","title":"CISA added CVE-2025-53521 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 30, 2026)"},"patchStatus":"unknown","product":"BIG-IP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-cve-2025-53521","stacks":["network"],"startedAt":"2026-03-27","status":"closed","summary":"F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog on Mar 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-121"],"title":"F5 BIG-IP Stack-Based Buffer Overflow Vulnerability (CVE-2025-53521)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-cve-2025-53521","vendor":"F5"},{"auto":true,"category":"breach","closedAt":"2026-04-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BREACHFORUMSV5"],"json":"https://helix.ml/threat-watch/i/breachforumsv5-data-breach.json","latestUpdate":{"date":"2026-03-27","title":"Have I Been Pwned loaded 339K breached BreachForums Version 5 accounts"},"patchStatus":"no-fix-needed","product":"breachforums.bf","severity":"high","severityNote":"339K accounts · passwords exposed","slug":"breachforumsv5-data-breach","stacks":[],"startedAt":"2026-03-27","status":"closed","summary":"In March 2026, a breach of one of the many iterations of the BreachForums hacking forum known as \"Version 5\" was publicly disclosed. The incident exposed 340k unique email addresses along with usernames and argon2 password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Mar 26, 2026; Have I Been Pwned loaded it on Mar 27, 2026.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"BreachForums Version 5 data breach: 339K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/breachforumsv5-data-breach","vendor":"BreachForums Version 5"},{"auto":true,"category":"patch","closedAt":"2026-04-09","cveIds":["CVE-2026-33634"],"exploited":"in-the-wild","identifiers":["CVE-2026-33634"],"json":"https://helix.ml/threat-watch/i/aquasecurity-trivy-cve-2026-33634.json","latestUpdate":{"date":"2026-03-26","title":"CISA added CVE-2026-33634 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 9, 2026)"},"patchStatus":"unknown","product":"Trivy","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"aquasecurity-trivy-cve-2026-33634","stacks":[],"startedAt":"2026-03-26","status":"closed","summary":"Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory. CISA added CVE-2026-33634 to its Known Exploited Vulnerabilities catalog on Mar 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-506"],"title":"Aquasecurity Trivy Embedded Malicious Code Vulnerability (CVE-2026-33634)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/aquasecurity-trivy-cve-2026-33634","vendor":"Aquasecurity"},{"auto":true,"category":"breach","closedAt":"2026-04-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SOUNDRADIX"],"json":"https://helix.ml/threat-watch/i/soundradix-data-breach.json","latestUpdate":{"date":"2026-03-26","title":"Have I Been Pwned loaded 292K breached Sound Radix accounts"},"patchStatus":"no-fix-needed","product":"soundradix.com","severity":"high","severityNote":"292K accounts · passwords exposed","slug":"soundradix-data-breach","stacks":[],"startedAt":"2026-03-26","status":"closed","summary":"In March 2026, the audio production tools company Sound Radix disclosed a data breach that they subsequently self-submitted to HIBP. The incident impacted 293k unique email addresses and names. Sound Radix advised that it is possible that additional data including hashed passwords may have been exposed, and that no financial or credit card information was impacted. Exposed data: email addresses, names, passwords. The breach dates from Mar 25, 2026; Have I Been Pwned loaded it on Mar 26, 2026.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"Sound Radix data breach: 292K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/soundradix-data-breach","vendor":"Sound Radix"},{"auto":true,"category":"breach","closedAt":"2026-04-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SCUFGAMING"],"json":"https://helix.ml/threat-watch/i/scufgaming-data-breach.json","latestUpdate":{"date":"2026-03-26","title":"Have I Been Pwned loaded 128K breached Scuf Gaming accounts"},"patchStatus":"no-fix-needed","product":"scufgaming.com","severity":"high","severityNote":"128K accounts · passwords exposed","slug":"scufgaming-data-breach","stacks":[],"startedAt":"2026-03-26","status":"closed","summary":"In June 2015, custom gaming controller maker Scuf Gaming suffered a data breach. The incident exposed 129k unique email addresses along with usernames, display names, IP addresses and password hashes. Exposed data: display names, email addresses, ip addresses, passwords, usernames. The breach dates from Jun 5, 2015; Have I Been Pwned loaded it on Mar 26, 2026.","tags":["data-breach","hibp","display-names","email-addresses","ip-addresses","passwords","usernames"],"title":"Scuf Gaming data breach: 128K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/scufgaming-data-breach","vendor":"Scuf Gaming"},{"auto":true,"category":"patch","closedAt":"2026-04-08","cveIds":["CVE-2026-33017"],"exploited":"in-the-wild","identifiers":["CVE-2026-33017"],"json":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2026-33017.json","latestUpdate":{"date":"2026-03-25","title":"CISA added CVE-2026-33017 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 8, 2026)"},"patchStatus":"patched","product":"Langflow","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"langflow-langflow-cve-2026-33017","stacks":[],"startedAt":"2026-03-25","status":"closed","summary":"Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. CISA added CVE-2026-33017 to its Known Exploited Vulnerabilities catalog on Mar 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94","cwe-95","cwe-306"],"title":"Langflow Code Injection Vulnerability (CVE-2026-33017)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2026-33017","vendor":"Langflow"},{"auto":true,"category":"breach","closedAt":"2026-04-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RSBOARDS"],"json":"https://helix.ml/threat-watch/i/rsboards-data-breach.json","latestUpdate":{"date":"2026-03-23","title":"Have I Been Pwned loaded 222K breached RuneScape Boards accounts"},"patchStatus":"no-fix-needed","product":"rsboards.com","severity":"high","severityNote":"222K accounts · passwords exposed","slug":"rsboards-data-breach","stacks":[],"startedAt":"2026-03-23","status":"closed","summary":"In around 2011, the now defunct RuneScape Boards forum (also known as RSBoards) suffered a data breach that was later redistributed as part of a larger corpus of data. The vBulletin-based service exposed 223k unique email addresses along with usernames, IP addresses and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 26, 2011; Have I Been Pwned loaded it on Mar 23, 2026.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"RuneScape Boards data breach: 222K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/rsboards-data-breach","vendor":"RuneScape Boards"},{"auto":true,"category":"patch","closedAt":"2026-04-03","cveIds":["CVE-2025-32432"],"exploited":"in-the-wild","identifiers":["CVE-2025-32432"],"json":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2025-32432.json","latestUpdate":{"date":"2026-03-20","title":"CISA added CVE-2025-32432 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 3, 2026)"},"patchStatus":"patched","product":"Craft CMS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"craft-cms-craft-cms-cve-2025-32432","stacks":[],"startedAt":"2026-03-20","status":"closed","summary":"Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities catalog on Mar 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Craft CMS Code Injection Vulnerability (CVE-2025-32432)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2025-32432","vendor":"Craft CMS"},{"auto":true,"category":"patch","closedAt":"2026-04-03","cveIds":["CVE-2025-54068"],"exploited":"in-the-wild","identifiers":["CVE-2025-54068"],"json":"https://helix.ml/threat-watch/i/laravel-livewire-cve-2025-54068.json","latestUpdate":{"date":"2026-03-20","title":"CISA added CVE-2025-54068 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 3, 2026)"},"patchStatus":"patched","product":"Livewire","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"laravel-livewire-cve-2025-54068","stacks":["php"],"startedAt":"2026-03-20","status":"closed","summary":"Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. CISA added CVE-2025-54068 to its Known Exploited Vulnerabilities catalog on Mar 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Laravel Livewire Code Injection Vulnerability (CVE-2025-54068)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/laravel-livewire-cve-2025-54068","vendor":"Laravel"},{"auto":true,"category":"patch","closedAt":"2026-04-03","cveIds":["CVE-2025-43510"],"exploited":"in-the-wild","identifiers":["CVE-2025-43510"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43510.json","latestUpdate":{"date":"2026-03-20","title":"CISA added CVE-2025-43510 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 3, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-43510","stacks":[],"startedAt":"2026-03-20","status":"closed","summary":"Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CISA added CVE-2025-43510 to its Known Exploited Vulnerabilities catalog on Mar 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-667"],"title":"Apple Multiple Products Improper Locking Vulnerability (CVE-2025-43510)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43510","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-04-03","cveIds":["CVE-2025-43520"],"exploited":"in-the-wild","identifiers":["CVE-2025-43520"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43520.json","latestUpdate":{"date":"2026-03-20","title":"CISA added CVE-2025-43520 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 3, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-43520","stacks":[],"startedAt":"2026-03-20","status":"closed","summary":"Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory. CISA added CVE-2025-43520 to its Known Exploited Vulnerabilities catalog on Mar 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-120"],"title":"Apple Multiple Products Classic Buffer Overflow Vulnerability (CVE-2025-43520)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43520","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-04-03","cveIds":["CVE-2025-31277"],"exploited":"in-the-wild","identifiers":["CVE-2025-31277"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-31277.json","latestUpdate":{"date":"2026-03-20","title":"CISA added CVE-2025-31277 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 3, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-31277","stacks":[],"startedAt":"2026-03-20","status":"closed","summary":"Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption. CISA added CVE-2025-31277 to its Known Exploited Vulnerabilities catalog on Mar 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Apple Multiple Products Buffer Overflow Vulnerability (CVE-2025-31277)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-31277","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-04-02","cveIds":["CVE-2026-20131"],"exploited":"in-the-wild","identifiers":["CVE-2026-20131"],"json":"https://helix.ml/threat-watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131.json","latestUpdate":{"date":"2026-03-19","title":"CISA added CVE-2026-20131 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 22, 2026)"},"patchStatus":"unknown","product":"Secure Firewall Management Center (FMC)","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-firewall-management-center-fmc-cve-2026-20131","stacks":["network","rust"],"startedAt":"2026-03-19","status":"closed","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. CISA added CVE-2026-20131 to its Known Exploited Vulnerabilities catalog on Mar 19, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability (CVE-2026-20131)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-04-01","cveIds":["CVE-2025-66376"],"exploited":"in-the-wild","identifiers":["CVE-2025-66376"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-66376.json","latestUpdate":{"date":"2026-03-18","title":"CISA added CVE-2025-66376 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 1, 2026)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2025-66376","stacks":[],"startedAt":"2026-03-18","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog on Mar 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability (CVE-2025-66376)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-66376","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2026-04-01","cveIds":["CVE-2026-20963"],"exploited":"in-the-wild","identifiers":["CVE-2026-20963"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-20963.json","latestUpdate":{"date":"2026-03-18","title":"CISA added CVE-2026-20963 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 21, 2026)"},"patchStatus":"unknown","product":"SharePoint","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2026-20963","stacks":["rust","windows"],"startedAt":"2026-03-18","status":"closed","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. CISA added CVE-2026-20963 to its Known Exploited Vulnerabilities catalog on Mar 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-20963)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-20963","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2026-04-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AURA"],"json":"https://helix.ml/threat-watch/i/aura-data-breach.json","latestUpdate":{"date":"2026-03-18","title":"Have I Been Pwned loaded 903K breached Aura accounts"},"patchStatus":"no-fix-needed","product":"aura.com","severity":"medium","severityNote":"903K accounts","slug":"aura-data-breach","stacks":[],"startedAt":"2026-03-18","status":"closed","summary":"In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses. The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised. Exposed data: customer service records, email addresses, ip addresses, names, phone numbers, physical addresses. The breach dates from Mar 6, 2026; Have I Been Pwned loaded it on Mar 18, 2026.","tags":["data-breach","hibp","customer-service-records","email-addresses","ip-addresses","names","phone-numbers","physical-addresses"],"title":"Aura data breach: 903K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/aura-data-breach","vendor":"Aura"},{"auto":true,"category":"patch","closedAt":"2026-03-30","cveIds":["CVE-2025-47813"],"exploited":"in-the-wild","identifiers":["CVE-2025-47813"],"json":"https://helix.ml/threat-watch/i/wing-ftp-server-wing-ftp-server-cve-2025-47813.json","latestUpdate":{"date":"2026-03-16","title":"CISA added CVE-2025-47813 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 30, 2026)"},"patchStatus":"unknown","product":"Wing FTP Server","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"wing-ftp-server-wing-ftp-server-cve-2025-47813","stacks":[],"startedAt":"2026-03-16","status":"closed","summary":"Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie. CISA added CVE-2025-47813 to its Known Exploited Vulnerabilities catalog on Mar 16, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-209"],"title":"Wing FTP Server Information Disclosure Vulnerability (CVE-2025-47813)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/wing-ftp-server-wing-ftp-server-cve-2025-47813","vendor":"Wing FTP Server"},{"auto":true,"category":"breach","closedAt":"2026-03-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BAYDONER"],"json":"https://helix.ml/threat-watch/i/baydoner-data-breach.json","latestUpdate":{"date":"2026-03-15","title":"Have I Been Pwned loaded 1.3M breached Baydöner accounts"},"patchStatus":"no-fix-needed","product":"baydoner.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"baydoner-data-breach","stacks":[],"startedAt":"2026-03-15","status":"closed","summary":"In March 2026, the Turkish restaurant chain Baydöner suffered a data breach which was subsequently published to a public hacking forum. The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords. A small number of records also included Turkish national ID number and date of birth. In their disclosure notice, Baydöner stated that payment and financial data was not affected. Exposed data: dates of birth, email addresses, genders, geographic locations, government issued ids, names, passwords, phone numbers, purchases. The breach dates from Mar 8, 2026; Have I Been Pwned loaded it on Mar 15, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","government-issued-ids","names","passwords","phone-numbers","purchases"],"title":"Baydöner data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/baydoner-data-breach","vendor":"Baydöner"},{"auto":true,"category":"breach","closedAt":"2026-03-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DIVINESKINS"],"json":"https://helix.ml/threat-watch/i/divineskins-data-breach.json","latestUpdate":{"date":"2026-03-15","title":"Have I Been Pwned loaded 105K breached Divine Skins accounts"},"patchStatus":"no-fix-needed","product":"divineskins.gg","severity":"medium","severityNote":"105K accounts","slug":"divineskins-data-breach","stacks":[],"startedAt":"2026-03-15","status":"closed","summary":"In March 2026, the League of Legends custom skins service Divine Skins suffered a data breach. The incident was disclosed via the service's Discord server, where Divine Skins stated that an unauthorised third party accessed part of its systems, deleted all skins from the database and exposed email addresses and usernames. The data also contained a history of purchases made by users. Exposed data: email addresses, purchases, usernames. The breach dates from Mar 13, 2026; Have I Been Pwned loaded it on Mar 15, 2026.","tags":["data-breach","hibp","email-addresses","purchases","usernames"],"title":"Divine Skins data breach: 105K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/divineskins-data-breach","vendor":"Divine Skins"},{"auto":true,"category":"patch","closedAt":"2026-03-27","cveIds":["CVE-2026-3910"],"exploited":"in-the-wild","identifiers":["CVE-2026-3910"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-3910.json","latestUpdate":{"date":"2026-03-13","title":"CISA added CVE-2026-3910 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 27, 2026)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2026-3910","stacks":["browser"],"startedAt":"2026-03-13","status":"closed","summary":"Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2026-3910 to its Known Exploited Vulnerabilities catalog on Mar 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability (CVE-2026-3910)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2026-3910","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2026-03-27","cveIds":["CVE-2026-3909"],"exploited":"in-the-wild","identifiers":["CVE-2026-3909"],"json":"https://helix.ml/threat-watch/i/google-skia-cve-2026-3909.json","latestUpdate":{"date":"2026-03-13","title":"CISA added CVE-2026-3909 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 27, 2026)"},"patchStatus":"unknown","product":"Skia","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-skia-cve-2026-3909","stacks":[],"startedAt":"2026-03-13","status":"closed","summary":"Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. CISA added CVE-2026-3909 to its Known Exploited Vulnerabilities catalog on Mar 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Skia Out-of-Bounds Write Vulnerability (CVE-2026-3909)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-skia-cve-2026-3909","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2026-03-25","cveIds":["CVE-2025-68613"],"exploited":"in-the-wild","identifiers":["CVE-2025-68613"],"json":"https://helix.ml/threat-watch/i/n8n-n8n-cve-2025-68613.json","latestUpdate":{"date":"2026-03-11","title":"CISA added CVE-2025-68613 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 25, 2026)"},"patchStatus":"patched","product":"n8n","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"n8n-n8n-cve-2025-68613","stacks":[],"startedAt":"2026-03-11","status":"closed","summary":"n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution. CISA added CVE-2025-68613 to its Known Exploited Vulnerabilities catalog on Mar 11, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-913"],"title":"n8n Improper Control of Dynamically-Managed Code Resources Vulnerability (CVE-2025-68613)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/n8n-n8n-cve-2025-68613","vendor":"n8n"},{"auto":true,"category":"patch","closedAt":"2026-03-23","cveIds":["CVE-2021-22054"],"exploited":"in-the-wild","identifiers":["CVE-2021-22054"],"json":"https://helix.ml/threat-watch/i/omnissa-workspace-one-uem-cve-2021-22054.json","latestUpdate":{"date":"2026-03-09","title":"CISA added CVE-2021-22054 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 23, 2026)"},"patchStatus":"patched","product":"Workspace One UEM","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"omnissa-workspace-one-uem-cve-2021-22054","stacks":[],"startedAt":"2026-03-09","status":"closed","summary":"Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. CISA added CVE-2021-22054 to its Known Exploited Vulnerabilities catalog on Mar 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"Omnissa Workspace ONE Server-Side Request Forgery (CVE-2021-22054)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/omnissa-workspace-one-uem-cve-2021-22054","vendor":"Omnissa"},{"auto":true,"category":"patch","closedAt":"2026-03-23","cveIds":["CVE-2025-26399"],"exploited":"in-the-wild","identifiers":["CVE-2025-26399"],"json":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2025-26399.json","latestUpdate":{"date":"2026-03-09","title":"CISA added CVE-2025-26399 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 12, 2026)"},"patchStatus":"patched","product":"Web Help Desk","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-web-help-desk-cve-2025-26399","stacks":["rust"],"startedAt":"2026-03-09","status":"closed","summary":"SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. CISA added CVE-2025-26399 to its Known Exploited Vulnerabilities catalog on Mar 9, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (CVE-2025-26399)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2025-26399","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2026-03-23","cveIds":["CVE-2026-1603"],"exploited":"in-the-wild","identifiers":["CVE-2026-1603"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2026-1603.json","latestUpdate":{"date":"2026-03-09","title":"CISA added CVE-2026-1603 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 23, 2026)"},"patchStatus":"unknown","product":" Endpoint Manager (EPM)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-epm-cve-2026-1603","stacks":[],"startedAt":"2026-03-09","status":"closed","summary":"Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. CISA added CVE-2026-1603 to its Known Exploited Vulnerabilities catalog on Mar 9, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability (CVE-2026-1603)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2026-1603","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2026-03-19","cveIds":["CVE-2017-7921"],"exploited":"in-the-wild","identifiers":["CVE-2017-7921"],"json":"https://helix.ml/threat-watch/i/hikvision-multiple-products-cve-2017-7921.json","latestUpdate":{"date":"2026-03-05","title":"CISA added CVE-2017-7921 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 26, 2026)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"hikvision-multiple-products-cve-2017-7921","stacks":[],"startedAt":"2026-03-05","status":"closed","summary":"Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information. CISA added CVE-2017-7921 to its Known Exploited Vulnerabilities catalog on Mar 5, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","privilege-escalation","cwe-287"],"title":"Hikvision Multiple Products Improper Authentication Vulnerability (CVE-2017-7921)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/hikvision-multiple-products-cve-2017-7921","vendor":"Hikvision"},{"auto":true,"category":"patch","closedAt":"2026-03-19","cveIds":["CVE-2021-22681"],"exploited":"in-the-wild","identifiers":["CVE-2021-22681"],"json":"https://helix.ml/threat-watch/i/rockwell-multiple-products-cve-2021-22681.json","latestUpdate":{"date":"2026-03-05","title":"CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 26, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"rockwell-multiple-products-cve-2021-22681","stacks":[],"startedAt":"2026-03-05","status":"closed","summary":"Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller. CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities catalog on Mar 5, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-522"],"title":"Rockwell Multiple Products Insufficient Protected Credentials Vulnerability (CVE-2021-22681)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/rockwell-multiple-products-cve-2021-22681","vendor":"Rockwell"},{"auto":true,"category":"patch","closedAt":"2026-03-19","cveIds":["CVE-2023-43000"],"exploited":"in-the-wild","identifiers":["CVE-2023-43000"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-43000.json","latestUpdate":{"date":"2026-03-05","title":"CISA added CVE-2023-43000 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 26, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-43000","stacks":[],"startedAt":"2026-03-05","status":"closed","summary":"Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption. CISA added CVE-2023-43000 to its Known Exploited Vulnerabilities catalog on Mar 5, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple Multiple products Use-After-Free Vulnerability (CVE-2023-43000)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-43000","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-03-19","cveIds":["CVE-2021-30952"],"exploited":"in-the-wild","identifiers":["CVE-2021-30952"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30952.json","latestUpdate":{"date":"2026-03-05","title":"CISA added CVE-2021-30952 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 26, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-30952","stacks":[],"startedAt":"2026-03-05","status":"closed","summary":"Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution. CISA added CVE-2021-30952 to its Known Exploited Vulnerabilities catalog on Mar 5, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-190"],"title":"Apple Multiple Products Integer Overflow or Wraparound Vulnerability (CVE-2021-30952)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30952","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-03-19","cveIds":["CVE-2023-41974"],"exploited":"in-the-wild","identifiers":["CVE-2023-41974"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2023-41974.json","latestUpdate":{"date":"2026-03-05","title":"CISA added CVE-2023-41974 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 26, 2026)"},"patchStatus":"unknown","product":"iOS and iPadOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-ipados-cve-2023-41974","stacks":["ios"],"startedAt":"2026-03-05","status":"closed","summary":"Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges. CISA added CVE-2023-41974 to its Known Exploited Vulnerabilities catalog on Mar 5, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Apple iOS and iPadOS Use-After-Free Vulnerability (CVE-2023-41974)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2023-41974","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-03-17","cveIds":["CVE-2026-22719"],"exploited":"in-the-wild","identifiers":["CVE-2026-22719"],"json":"https://helix.ml/threat-watch/i/broadcom-vmware-aria-operations-cve-2026-22719.json","latestUpdate":{"date":"2026-03-03","title":"CISA added CVE-2026-22719 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2026)"},"patchStatus":"patched","product":"VMware Aria Operations","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"broadcom-vmware-aria-operations-cve-2026-22719","stacks":["cloud"],"startedAt":"2026-03-03","status":"closed","summary":"Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. CISA added CVE-2026-22719 to its Known Exploited Vulnerabilities catalog on Mar 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Broadcom VMware Aria Operations Command Injection Vulnerability (CVE-2026-22719)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/broadcom-vmware-aria-operations-cve-2026-22719","vendor":"Broadcom"},{"auto":true,"category":"patch","closedAt":"2026-03-17","cveIds":["CVE-2026-21385"],"exploited":"in-the-wild","identifiers":["CVE-2026-21385"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2026-21385.json","latestUpdate":{"date":"2026-03-03","title":"CISA added CVE-2026-21385 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2026)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2026-21385","stacks":[],"startedAt":"2026-03-03","status":"closed","summary":"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation. CISA added CVE-2026-21385 to its Known Exploited Vulnerabilities catalog on Mar 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-190"],"title":"Qualcomm Multiple Chipsets Memory Corruption Vulnerability (CVE-2026-21385)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2026-21385","vendor":"Qualcomm"},{"auto":true,"category":"breach","closedAt":"2026-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROVECHO"],"json":"https://helix.ml/threat-watch/i/provecho-data-breach.json","latestUpdate":{"date":"2026-03-03","title":"Have I Been Pwned loaded 712K breached Provecho accounts"},"patchStatus":"no-fix-needed","product":"provecho.bio","severity":"medium","severityNote":"712K accounts","slug":"provecho-data-breach","stacks":[],"startedAt":"2026-03-03","status":"closed","summary":"In early 2026, data purportedly sourced from the recipe and meal planning service Provecho was alleged to have been obtained in a breach. The exposed data included 713k unique email address along with username and the creator account holders followed. Provecho has been notified and is aware of the claims surrounding the incident. Exposed data: email addresses, usernames. The breach dates from Jan 30, 2026; Have I Been Pwned loaded it on Mar 3, 2026.","tags":["data-breach","hibp","email-addresses","usernames"],"title":"Provecho data breach: 712K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/provecho-data-breach","vendor":"Provecho"},{"auto":true,"category":"breach","closedAt":"2026-03-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KOMIKOAI"],"json":"https://helix.ml/threat-watch/i/komikoai-data-breach.json","latestUpdate":{"date":"2026-03-02","title":"Have I Been Pwned loaded 1.1M breached KomikoAI accounts"},"patchStatus":"no-fix-needed","product":"komiko.app","severity":"medium","severityNote":"1.1M accounts","slug":"komikoai-data-breach","stacks":[],"startedAt":"2026-03-02","status":"closed","summary":"In February, the AI-powered comic generation platform KomikoAI suffered a data breach. The incident exposed 1M unique email addresses along with names, user posts and the AI prompts used to generate content. The exposed data enables the mapping of individual AI prompts to specific email addresses. Exposed data: ai prompts, email addresses, forum posts, names. The breach dates from Feb 25, 2026; Have I Been Pwned loaded it on Mar 2, 2026.","tags":["data-breach","hibp","ai-prompts","email-addresses","forum-posts","names"],"title":"KomikoAI data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/komikoai-data-breach","vendor":"KomikoAI"},{"auto":true,"category":"breach","closedAt":"2026-03-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QUITBRO"],"json":"https://helix.ml/threat-watch/i/quitbro-data-breach.json","latestUpdate":{"date":"2026-03-02","title":"Have I Been Pwned loaded 22K breached Quitbro accounts"},"patchStatus":"no-fix-needed","product":"quitbro.app","severity":"high","severityNote":"22K accounts","slug":"quitbro-data-breach","stacks":[],"startedAt":"2026-03-02","status":"closed","summary":"In February 2026, the porn addiction app Quitbro allegedly suffered a data breach that exposed 23k unique email addresses. The data also included users’ years of birth, responses to questions within the app and their last recorded relapse time. The app’s maker, Plantake, did not respond to multiple attempts to contact them about the incident. Exposed data: email addresses, partial dates of birth, usernames. The breach dates from Feb 17, 2026; Have I Been Pwned loaded it on Mar 2, 2026.","tags":["data-breach","hibp","email-addresses","partial-dates-of-birth","usernames"],"title":"Quitbro data breach: 22K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/quitbro-data-breach","vendor":"Quitbro"},{"auto":true,"category":"breach","closedAt":"2026-03-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LOVORA"],"json":"https://helix.ml/threat-watch/i/lovora-data-breach.json","latestUpdate":{"date":"2026-03-02","title":"Have I Been Pwned loaded 495K breached Lovora accounts"},"patchStatus":"no-fix-needed","product":"Lovora","severity":"medium","severityNote":"495K accounts","slug":"lovora-data-breach","stacks":[],"startedAt":"2026-03-02","status":"closed","summary":"In February 2026, the couples and relationship app Lovora allegedly suffered a data breach that exposed 496k unique email addresses. The data also included users’ display names and profile photos, along with other personal information collected through use of the app. The app’s maker, Plantake, did not respond to multiple attempts to contact them about the incident. Exposed data: display names, email addresses, profile photos. The breach dates from Feb 25, 2026; Have I Been Pwned loaded it on Mar 2, 2026.","tags":["data-breach","hibp","display-names","email-addresses","profile-photos"],"title":"Lovora data breach: 495K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/lovora-data-breach","vendor":"Lovora"},{"auto":true,"category":"breach","closedAt":"2026-03-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ODIDO"],"json":"https://helix.ml/threat-watch/i/odido-data-breach.json","latestUpdate":{"date":"2026-02-26","title":"Have I Been Pwned loaded 6.1M breached Odido accounts"},"patchStatus":"no-fix-needed","product":"odido.nl","severity":"high","severityNote":"6.1M accounts · financial data exposed","slug":"odido-data-breach","stacks":[],"startedAt":"2026-02-26","status":"closed","summary":"In February 2026, Dutch telco Odido was the victim of a data breach and subsequent extortion attempt. Shortly after, a total of 6M unique email addresses were published across four separate data releases over consecutive days. The exposed data includes names, physical addresses, phone numbers, bank account numbers, dates of birth, customer service notes and passport, driver’s licence and European national ID numbers. Odido has published a disclosure notice including an FAQ to support affected customers. Exposed data: bank account numbers, customer service records, dates of birth, driver's licenses, email addresses, genders, government issued ids, names, passport numbers, phone numbers, physical addresses. The breach dates from Feb 12, 2026; Have I Been Pwned loaded it on Feb 26, 2026.","tags":["data-breach","hibp","bank-account-numbers","customer-service-records","dates-of-birth","driver-s-licenses","email-addresses","genders","government-issued-ids","names","passport-numbers","phone-numbers","physical-addresses"],"title":"Odido data breach: 6.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/odido-data-breach","vendor":"Odido"},{"auto":true,"category":"patch","closedAt":"2026-03-11","cveIds":["CVE-2022-20775"],"exploited":"in-the-wild","identifiers":["CVE-2022-20775"],"json":"https://helix.ml/threat-watch/i/cisco-sd-wan-cve-2022-20775.json","latestUpdate":{"date":"2026-02-25","title":"CISA added CVE-2022-20775 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2026)"},"patchStatus":"unknown","product":"SD-WAN","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-sd-wan-cve-2022-20775","stacks":["network"],"startedAt":"2026-02-25","status":"closed","summary":"Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. CISA added CVE-2022-20775 to its Known Exploited Vulnerabilities catalog on Feb 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-25","cwe-282"],"title":"Cisco SD-WAN Path Traversal Vulnerability (CVE-2022-20775)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-sd-wan-cve-2022-20775","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2026-03-11","cveIds":["CVE-2026-20127"],"exploited":"in-the-wild","identifiers":["CVE-2026-20127"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json","latestUpdate":{"date":"2026-02-25","title":"CISA added CVE-2026-20127 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2026)"},"patchStatus":"unknown","product":"Catalyst SD-WAN Controller and Manager","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127","stacks":["network"],"startedAt":"2026-02-25","status":"closed","summary":"Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. CISA added CVE-2026-20127 to its Known Exploited Vulnerabilities catalog on Feb 25, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability (CVE-2026-20127)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-03-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CANADIANTIRE"],"json":"https://helix.ml/threat-watch/i/canadiantire-data-breach.json","latestUpdate":{"date":"2026-02-25","title":"Have I Been Pwned loaded 38.3M breached Canadian Tire accounts"},"patchStatus":"no-fix-needed","product":"canadiantire.ca","severity":"high","severityNote":"38.3M accounts · passwords exposed · financial data exposed","slug":"canadiantire-data-breach","stacks":[],"startedAt":"2026-02-25","status":"closed","summary":"In October 2025, retailer Canadian Tire was the victim of a data breach that exposed almost 42M records. The data contained 38M unique email addresses along with names, phone numbers and physical addresses. Passwords were stored as PBKDF2 hashes and for a subset of records, dates of birth and partial credit card data were also included (card type, expiry and masked card number). In its disclosure notice, Canadian Tire advised that the incident did not impact bank account information or loyalty program data. Exposed data: dates of birth, email addresses, genders, names, partial credit card data, passwords, phone numbers, physical addresses. The breach dates from Oct 2, 2025; Have I Been Pwned loaded it on Feb 25, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","partial-credit-card-data","passwords","phone-numbers","physical-addresses"],"title":"Canadian Tire data breach: 38.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/canadiantire-data-breach","vendor":"Canadian Tire"},{"auto":true,"category":"patch","closedAt":"2026-03-10","cveIds":["CVE-2026-25108"],"exploited":"in-the-wild","identifiers":["CVE-2026-25108"],"json":"https://helix.ml/threat-watch/i/soliton-systems-k-k-filezen-cve-2026-25108.json","latestUpdate":{"date":"2026-02-24","title":"CISA added CVE-2026-25108 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2026)"},"patchStatus":"unknown","product":"FileZen","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"soliton-systems-k-k-filezen-cve-2026-25108","stacks":[],"startedAt":"2026-02-24","status":"closed","summary":"Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request. CISA added CVE-2026-25108 to its Known Exploited Vulnerabilities catalog on Feb 24, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Soliton Systems K.K FileZen OS Command Injection Vulnerability (CVE-2026-25108)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/soliton-systems-k-k-filezen-cve-2026-25108","vendor":"Soliton Systems K.K"},{"auto":true,"category":"breach","closedAt":"2026-03-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CARGURUS"],"json":"https://helix.ml/threat-watch/i/cargurus-data-breach.json","latestUpdate":{"date":"2026-02-22","title":"Have I Been Pwned loaded 12.5M breached CarGurus accounts"},"patchStatus":"no-fix-needed","product":"cargurus.com","severity":"medium","severityNote":"12.5M accounts","slug":"cargurus-data-breach","stacks":[],"startedAt":"2026-02-22","status":"closed","summary":"In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters. Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings, finance pre-qualification application data and dealer account and subscription information. Impacted data also included names, phone numbers, physical and IP addresses, and auto finance application outcomes. Exposed data: email addresses, ip addresses, names, phone numbers, physical addresses. The breach dates from Feb 14, 2026; Have I Been Pwned loaded it on Feb 22, 2026.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","phone-numbers","physical-addresses"],"title":"CarGurus data breach: 12.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cargurus-data-breach","vendor":"CarGurus"},{"auto":true,"category":"patch","closedAt":"2026-03-06","cveIds":["CVE-2025-49113"],"exploited":"in-the-wild","identifiers":["CVE-2025-49113"],"json":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2025-49113.json","latestUpdate":{"date":"2026-02-20","title":"CISA added CVE-2025-49113 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 13, 2026)"},"patchStatus":"patched","product":"Webmail","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-webmail-cve-2025-49113","stacks":["rust"],"startedAt":"2026-02-20","status":"closed","summary":"RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. CISA added CVE-2025-49113 to its Known Exploited Vulnerabilities catalog on Feb 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"RoundCube Webmail Deserialization of Untrusted Data Vulnerability (CVE-2025-49113)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2025-49113","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2026-03-06","cveIds":["CVE-2025-68461"],"exploited":"in-the-wild","identifiers":["CVE-2025-68461"],"json":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2025-68461.json","latestUpdate":{"date":"2026-02-20","title":"CISA added CVE-2025-68461 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 13, 2026)"},"patchStatus":"patched","product":"Webmail","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-webmail-cve-2025-68461","stacks":[],"startedAt":"2026-02-20","status":"closed","summary":"RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document. CISA added CVE-2025-68461 to its Known Exploited Vulnerabilities catalog on Feb 20, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"RoundCube Webmail Cross-site Scripting Vulnerability (CVE-2025-68461)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2025-68461","vendor":"Roundcube"},{"auto":true,"category":"breach","closedAt":"2026-03-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CARMAX"],"json":"https://helix.ml/threat-watch/i/carmax-data-breach.json","latestUpdate":{"date":"2026-02-20","title":"Have I Been Pwned loaded 431K breached CarMax accounts"},"patchStatus":"no-fix-needed","product":"carmax.com","severity":"medium","severityNote":"431K accounts","slug":"carmax-data-breach","stacks":[],"startedAt":"2026-02-20","status":"closed","summary":"In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jan 24, 2026; Have I Been Pwned loaded it on Feb 20, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"CarMax data breach: 431K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/carmax-data-breach","vendor":"CarMax"},{"auto":true,"category":"patch","closedAt":"2026-03-04","cveIds":["CVE-2021-22175"],"exploited":"in-the-wild","identifiers":["CVE-2021-22175"],"json":"https://helix.ml/threat-watch/i/gitlab-gitlab-cve-2021-22175.json","latestUpdate":{"date":"2026-02-18","title":"CISA added CVE-2021-22175 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 11, 2026)"},"patchStatus":"unknown","product":"GitLab","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gitlab-gitlab-cve-2021-22175","stacks":["devtools"],"startedAt":"2026-02-18","status":"closed","summary":"GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. CISA added CVE-2021-22175 to its Known Exploited Vulnerabilities catalog on Feb 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"GitLab Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-22175)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gitlab-gitlab-cve-2021-22175","vendor":"GitLab"},{"auto":true,"category":"patch","closedAt":"2026-03-04","cveIds":["CVE-2026-22769"],"exploited":"in-the-wild","identifiers":["CVE-2026-22769"],"json":"https://helix.ml/threat-watch/i/dell-recoverpoint-for-virtual-machines-rp4vms-cve-2026-22769.json","latestUpdate":{"date":"2026-02-18","title":"CISA added CVE-2026-22769 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 21, 2026)"},"patchStatus":"patched","product":"RecoverPoint for Virtual Machines (RP4VMs)","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"dell-recoverpoint-for-virtual-machines-rp4vms-cve-2026-22769","stacks":[],"startedAt":"2026-02-18","status":"closed","summary":"Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence. CISA added CVE-2026-22769 to its Known Exploited Vulnerabilities catalog on Feb 18, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","hard-coded-credentials","cwe-798"],"title":"Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability (CVE-2026-22769)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/dell-recoverpoint-for-virtual-machines-rp4vms-cve-2026-22769","vendor":"Dell"},{"auto":true,"category":"breach","closedAt":"2026-03-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FIGURE"],"json":"https://helix.ml/threat-watch/i/figure-data-breach.json","latestUpdate":{"date":"2026-02-18","title":"Have I Been Pwned loaded 967K breached Figure accounts"},"patchStatus":"no-fix-needed","product":"figure.com","severity":"medium","severityNote":"967K accounts","slug":"figure-data-breach","stacks":[],"startedAt":"2026-02-18","status":"closed","summary":"In February 2026, data obtained from the fintech lending platform Figure was publicly posted online. The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Jan 28, 2026; Have I Been Pwned loaded it on Feb 18, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses"],"title":"Figure data breach: 967K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/figure-data-breach","vendor":"Figure"},{"auto":true,"category":"patch","closedAt":"2026-03-03","cveIds":["CVE-2020-7796"],"exploited":"in-the-wild","identifiers":["CVE-2020-7796"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-cve-2020-7796.json","latestUpdate":{"date":"2026-02-17","title":"CISA added CVE-2020-7796 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 10, 2026)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-cve-2020-7796","stacks":[],"startedAt":"2026-02-17","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled. CISA added CVE-2020-7796 to its Known Exploited Vulnerabilities catalog on Feb 17, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability (CVE-2020-7796)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-cve-2020-7796","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2026-03-03","cveIds":["CVE-2024-7694"],"exploited":"in-the-wild","identifiers":["CVE-2024-7694"],"json":"https://helix.ml/threat-watch/i/teamt5-threatsonar-anti-ransomware-cve-2024-7694.json","latestUpdate":{"date":"2026-02-17","title":"CISA added CVE-2024-7694 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 10, 2026)"},"patchStatus":"unknown","product":"ThreatSonar Anti-Ransomware","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"teamt5-threatsonar-anti-ransomware-cve-2024-7694","stacks":[],"startedAt":"2026-02-17","status":"closed","summary":"TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server. CISA added CVE-2024-7694 to its Known Exploited Vulnerabilities catalog on Feb 17, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ransomware","cwe-434"],"title":"TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2024-7694)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/teamt5-threatsonar-anti-ransomware-cve-2024-7694","vendor":"TeamT5"},{"auto":true,"category":"patch","closedAt":"2026-03-03","cveIds":["CVE-2008-0015"],"exploited":"in-the-wild","identifiers":["CVE-2008-0015"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2008-0015.json","latestUpdate":{"date":"2026-02-17","title":"CISA added CVE-2008-0015 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 10, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2008-0015","stacks":["windows"],"startedAt":"2026-02-17","status":"closed","summary":"Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. CISA added CVE-2008-0015 to its Known Exploited Vulnerabilities catalog on Feb 17, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability (CVE-2008-0015)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2008-0015","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-03-03","cveIds":["CVE-2026-2441"],"exploited":"in-the-wild","identifiers":["CVE-2026-2441"],"json":"https://helix.ml/threat-watch/i/google-chromium-cve-2026-2441.json","latestUpdate":{"date":"2026-02-17","title":"CISA added CVE-2026-2441 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 10, 2026)"},"patchStatus":"unknown","product":"Chromium","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-cve-2026-2441","stacks":["browser"],"startedAt":"2026-02-17","status":"closed","summary":"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2026-2441 to its Known Exploited Vulnerabilities catalog on Feb 17, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium CSS Use-After-Free Vulnerability (CVE-2026-2441)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-chromium-cve-2026-2441","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2026-03-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CANADAGOOSE"],"json":"https://helix.ml/threat-watch/i/canadagoose-data-breach.json","latestUpdate":{"date":"2026-02-17","title":"Have I Been Pwned loaded 581K breached Canada Goose accounts"},"patchStatus":"no-fix-needed","product":"canadagoose.com","severity":"high","severityNote":"581K accounts · financial data exposed","slug":"canadagoose-data-breach","stacks":[],"startedAt":"2026-02-17","status":"closed","summary":"In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly. The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card type and last 4 digits. Canada Goose advised that the data \"appears to relate to past customer transactions\" and stated that it originated from a breach at a third party in August 2025. The most recent transaction date in the data is July 2025. Exposed data: device information, email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Jul 4, 2025; Have I Been Pwned loaded it on Feb 17, 2026.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"Canada Goose data breach: 581K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/canadagoose-data-breach","vendor":"Canada Goose"},{"auto":true,"category":"breach","closedAt":"2026-03-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:APOIASE"],"json":"https://helix.ml/threat-watch/i/apoiase-data-breach.json","latestUpdate":{"date":"2026-02-16","title":"Have I Been Pwned loaded 450K breached APOIA.se accounts"},"patchStatus":"no-fix-needed","product":"apoia.se","severity":"medium","severityNote":"450K accounts","slug":"apoiase-data-breach","stacks":[],"startedAt":"2026-02-16","status":"closed","summary":"In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum. In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses. Exposed data: email addresses, names, physical addresses. The breach dates from Dec 16, 2025; Have I Been Pwned loaded it on Feb 16, 2026.","tags":["data-breach","hibp","email-addresses","names","physical-addresses"],"title":"APOIA.se data breach: 450K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/apoiase-data-breach","vendor":"APOIA.se"},{"auto":true,"category":"breach","closedAt":"2026-03-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNIVERSITYOFPENNSYLVANIA"],"json":"https://helix.ml/threat-watch/i/universityofpennsylvania-data-breach.json","latestUpdate":{"date":"2026-02-16","title":"Have I Been Pwned loaded 623K breached University of Pennsylvania accounts"},"patchStatus":"no-fix-needed","product":"upenn.edu","severity":"medium","severityNote":"623K accounts","slug":"universityofpennsylvania-data-breach","stacks":[],"startedAt":"2026-02-16","status":"closed","summary":"In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand, largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was exposed, including gender and date of birth. A small subset of records also contained religion, spouse name, estimated income and donation history. Exposed data: charitable donations, dates of birth, email addresses, genders, income levels, job titles, names, physical addresses, religions, salutations, spouses names. The breach dates from Oct 30, 2025; Have I Been Pwned loaded it on Feb 16, 2026.","tags":["data-breach","hibp","charitable-donations","dates-of-birth","email-addresses","genders","income-levels","job-titles","names","physical-addresses","religions","salutations","spouses-names"],"title":"University of Pennsylvania data breach: 623K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/universityofpennsylvania-data-breach","vendor":"University of Pennsylvania"},{"auto":true,"category":"patch","closedAt":"2026-02-27","cveIds":["CVE-2026-1731"],"exploited":"in-the-wild","identifiers":["CVE-2026-1731"],"json":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json","latestUpdate":{"date":"2026-02-13","title":"CISA added CVE-2026-1731 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2026)"},"patchStatus":"unknown","product":"Remote Support (RS) and Privileged Remote Access (PRA)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731","stacks":["rust"],"startedAt":"2026-02-13","status":"closed","summary":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalog on Feb 13, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability (CVE-2026-1731)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731","vendor":"BeyondTrust"},{"auto":true,"category":"patch","closedAt":"2026-02-26","cveIds":["CVE-2026-20700"],"exploited":"in-the-wild","identifiers":["CVE-2026-20700"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2026-20700.json","latestUpdate":{"date":"2026-02-12","title":"CISA added CVE-2026-20700 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 5, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2026-20700","stacks":[],"startedAt":"2026-02-12","status":"closed","summary":"Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. CISA added CVE-2026-20700 to its Known Exploited Vulnerabilities catalog on Feb 12, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Apple Multiple Buffer Overflow Vulnerability (CVE-2026-20700)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2026-20700","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2026-02-26","cveIds":["CVE-2024-43468"],"exploited":"in-the-wild","identifiers":["CVE-2024-43468"],"json":"https://helix.ml/threat-watch/i/microsoft-configuration-manager-cve-2024-43468.json","latestUpdate":{"date":"2026-02-12","title":"CISA added CVE-2024-43468 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 5, 2026)"},"patchStatus":"unknown","product":"Configuration Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-configuration-manager-cve-2024-43468","stacks":[],"startedAt":"2026-02-12","status":"closed","summary":"Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database. CISA added CVE-2024-43468 to its Known Exploited Vulnerabilities catalog on Feb 12, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Microsoft Configuration Manager SQL Injection Vulnerability (CVE-2024-43468)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-configuration-manager-cve-2024-43468","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-02-26","cveIds":["CVE-2025-15556"],"exploited":"in-the-wild","identifiers":["CVE-2025-15556"],"json":"https://helix.ml/threat-watch/i/notepad-notepad-cve-2025-15556.json","latestUpdate":{"date":"2026-02-12","title":"CISA added CVE-2025-15556 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 5, 2026)"},"patchStatus":"patched","product":"Notepad++","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"notepad-notepad-cve-2025-15556","stacks":[],"startedAt":"2026-02-12","status":"closed","summary":"Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user. CISA added CVE-2025-15556 to its Known Exploited Vulnerabilities catalog on Feb 12, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-494"],"title":"Notepad++ Download of Code Without Integrity Check Vulnerability (CVE-2025-15556)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/notepad-notepad-cve-2025-15556","vendor":"Notepad++"},{"auto":true,"category":"patch","closedAt":"2026-02-26","cveIds":["CVE-2025-40536"],"exploited":"in-the-wild","identifiers":["CVE-2025-40536"],"json":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2025-40536.json","latestUpdate":{"date":"2026-02-12","title":"CISA added CVE-2025-40536 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 15, 2026)"},"patchStatus":"unknown","product":"Web Help Desk","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-web-help-desk-cve-2025-40536","stacks":[],"startedAt":"2026-02-12","status":"closed","summary":"SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. CISA added CVE-2025-40536 to its Known Exploited Vulnerabilities catalog on Feb 12, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"SolarWinds Web Help Desk Security Control Bypass Vulnerability (CVE-2025-40536)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2025-40536","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2026-02-24","cveIds":["CVE-2026-21513"],"exploited":"in-the-wild","identifiers":["CVE-2026-21513"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21513.json","latestUpdate":{"date":"2026-02-10","title":"CISA added CVE-2026-21513 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-21513","stacks":["windows"],"startedAt":"2026-02-10","status":"closed","summary":"Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. CISA added CVE-2026-21513 to its Known Exploited Vulnerabilities catalog on Feb 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability (CVE-2026-21513)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21513","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-02-24","cveIds":["CVE-2026-21525"],"exploited":"in-the-wild","identifiers":["CVE-2026-21525"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21525.json","latestUpdate":{"date":"2026-02-10","title":"CISA added CVE-2026-21525 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"medium","severityNote":"CVSS 6.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-21525","stacks":["windows"],"startedAt":"2026-02-10","status":"closed","summary":"Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally. CISA added CVE-2026-21525 to its Known Exploited Vulnerabilities catalog on Feb 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-476"],"title":"Microsoft Windows NULL Pointer Dereference Vulnerability (CVE-2026-21525)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21525","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-02-24","cveIds":["CVE-2026-21510"],"exploited":"in-the-wild","identifiers":["CVE-2026-21510"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21510.json","latestUpdate":{"date":"2026-02-10","title":"CISA added CVE-2026-21510 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-21510","stacks":["windows"],"startedAt":"2026-02-10","status":"closed","summary":"Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. CISA added CVE-2026-21510 to its Known Exploited Vulnerabilities catalog on Feb 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"Microsoft Windows Shell Protection Mechanism Failure Vulnerability (CVE-2026-21510)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21510","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-02-24","cveIds":["CVE-2026-21533"],"exploited":"in-the-wild","identifiers":["CVE-2026-21533"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21533.json","latestUpdate":{"date":"2026-02-10","title":"CISA added CVE-2026-21533 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-21533","stacks":["windows"],"startedAt":"2026-02-10","status":"closed","summary":"Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally. CISA added CVE-2026-21533 to its Known Exploited Vulnerabilities catalog on Feb 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-269"],"title":"Microsoft Windows Improper Privilege Management Vulnerability (CVE-2026-21533)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21533","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-02-24","cveIds":["CVE-2026-21519"],"exploited":"in-the-wild","identifiers":["CVE-2026-21519"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21519.json","latestUpdate":{"date":"2026-02-10","title":"CISA added CVE-2026-21519 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-21519","stacks":["windows"],"startedAt":"2026-02-10","status":"closed","summary":"Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally. CISA added CVE-2026-21519 to its Known Exploited Vulnerabilities catalog on Feb 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Microsoft Windows Type Confusion Vulnerability (CVE-2026-21519)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-21519","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-02-24","cveIds":["CVE-2026-21514"],"exploited":"in-the-wild","identifiers":["CVE-2026-21514"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2026-21514.json","latestUpdate":{"date":"2026-02-10","title":"CISA added CVE-2026-21514 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2026)"},"patchStatus":"unknown","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2026-21514","stacks":["rust","windows"],"startedAt":"2026-02-10","status":"closed","summary":"Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally. CISA added CVE-2026-21514 to its Known Exploited Vulnerabilities catalog on Feb 10, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-807"],"title":"Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability (CVE-2026-21514)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2026-21514","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2026-02-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANPS"],"json":"https://helix.ml/threat-watch/i/anps-data-breach.json","latestUpdate":{"date":"2026-02-10","title":"Have I Been Pwned loaded 5600 breached Association Nationale des Premiers Secours accounts"},"patchStatus":"no-fix-needed","product":"anps.fr","severity":"low","severityNote":"5600 accounts","slug":"anps-data-breach","stacks":[],"startedAt":"2026-02-10","status":"closed","summary":"In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords. Exposed data: dates of birth, email addresses, names, places of birth, salutations. The breach dates from Jan 30, 2026; Have I Been Pwned loaded it on Feb 10, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","places-of-birth","salutations"],"title":"Association Nationale des Premiers Secours data breach: 5600 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/anps-data-breach","vendor":"Association Nationale des Premiers Secours"},{"auto":true,"category":"breach","closedAt":"2026-02-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TOYBATTLES"],"json":"https://helix.ml/threat-watch/i/toybattles-data-breach.json","latestUpdate":{"date":"2026-02-10","title":"Have I Been Pwned loaded 1017 breached Toy Battles accounts"},"patchStatus":"no-fix-needed","product":"toybattles.net","severity":"low","severityNote":"1017 accounts","slug":"toybattles-data-breach","stacks":[],"startedAt":"2026-02-10","status":"closed","summary":"In February 2026, the online gaming community Toy Battles suffered a data breach. The incident exposed 1k unique email addresses alongside usernames, IP addresses and chat logs. Following the breach, Toy Battles self-submitted the data to Have I Been Pwned. Exposed data: chat logs, email addresses, ip addresses, usernames. The breach dates from Feb 6, 2026; Have I Been Pwned loaded it on Feb 10, 2026.","tags":["data-breach","hibp","chat-logs","email-addresses","ip-addresses","usernames"],"title":"Toy Battles data breach: 1017 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/toybattles-data-breach","vendor":"Toy Battles"},{"auto":true,"category":"breach","closedAt":"2026-02-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUBSTACK"],"json":"https://helix.ml/threat-watch/i/substack-data-breach.json","latestUpdate":{"date":"2026-02-06","title":"Have I Been Pwned loaded 663K breached Substack accounts"},"patchStatus":"no-fix-needed","product":"substack.com","severity":"medium","severityNote":"663K accounts","slug":"substack-data-breach","stacks":[],"startedAt":"2026-02-06","status":"closed","summary":"In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers. Exposed data: email addresses, phone numbers. The breach dates from Oct 23, 2025; Have I Been Pwned loaded it on Feb 6, 2026.","tags":["data-breach","hibp","email-addresses","phone-numbers"],"title":"Substack data breach: 663K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/substack-data-breach","vendor":"Substack"},{"auto":true,"category":"patch","closedAt":"2026-02-19","cveIds":["CVE-2025-11953"],"exploited":"in-the-wild","identifiers":["CVE-2025-11953"],"json":"https://helix.ml/threat-watch/i/react-native-community-cli-cve-2025-11953.json","latestUpdate":{"date":"2026-02-05","title":"CISA added CVE-2025-11953 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 26, 2026)"},"patchStatus":"patched","product":"CLI","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"react-native-community-cli-cve-2025-11953","stacks":[],"startedAt":"2026-02-05","status":"closed","summary":"React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. CISA added CVE-2025-11953 to its Known Exploited Vulnerabilities catalog on Feb 5, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"React Native Community CLI OS Command Injection Vulnerability (CVE-2025-11953)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/react-native-community-cli-cve-2025-11953","vendor":"React Native Community"},{"auto":true,"category":"patch","closedAt":"2026-02-19","cveIds":["CVE-2026-24423"],"exploited":"in-the-wild","identifiers":["CVE-2026-24423"],"json":"https://helix.ml/threat-watch/i/smartertools-smartermail-cve-2026-24423.json","latestUpdate":{"date":"2026-02-05","title":"CISA added CVE-2026-24423 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 26, 2026)"},"patchStatus":"unknown","product":"SmarterMail","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"smartertools-smartermail-cve-2026-24423","stacks":[],"startedAt":"2026-02-05","status":"closed","summary":"SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. CISA added CVE-2026-24423 to its Known Exploited Vulnerabilities catalog on Feb 5, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-306"],"title":"SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability (CVE-2026-24423)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/smartertools-smartermail-cve-2026-24423","vendor":"SmarterTools"},{"auto":true,"category":"breach","closedAt":"2026-02-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BETTERMENT"],"json":"https://helix.ml/threat-watch/i/betterment-data-breach.json","latestUpdate":{"date":"2026-02-05","title":"Have I Been Pwned loaded 1.4M breached Betterment accounts"},"patchStatus":"no-fix-needed","product":"betterment.com","severity":"medium","severityNote":"1.4M accounts","slug":"betterment-data-breach","stacks":[],"startedAt":"2026-02-05","status":"closed","summary":"In January 2026, the automated investment platform Betterment confirmed it had suffered a data breach attributed to a social engineering attack. As part of the incident, Betterment customers received fraudulent crypto-related messages promising high returns if funds were sent to an attacker-controlled cryptocurrency wallet. The breach exposed 1.4M unique email addresses, along with names and geographic location data. A subset of records also included dates of birth, phone numbers, and physical addresses. In its disclosure notice, Betterment stated that the incident did not provide attackers with access to customer accounts and did not expose passwords or other login credentials. Exposed data: dates of birth, device information, email addresses, employers, geographic locations, job titles, names, phone numbers, physical addresses. The breach dates from Jan 9, 2026; Have I Been Pwned loaded it on Feb 5, 2026.","tags":["data-breach","hibp","dates-of-birth","device-information","email-addresses","employers","geographic-locations","job-titles","names","phone-numbers","physical-addresses"],"title":"Betterment data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/betterment-data-breach","vendor":"Betterment"},{"auto":true,"category":"patch","closedAt":"2026-02-17","cveIds":["CVE-2021-39935"],"exploited":"in-the-wild","identifiers":["CVE-2021-39935"],"json":"https://helix.ml/threat-watch/i/gitlab-community-and-enterprise-editions-cve-2021-39935.json","latestUpdate":{"date":"2026-02-03","title":"CISA added CVE-2021-39935 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 24, 2026)"},"patchStatus":"unknown","product":"Community and Enterprise Editions","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"gitlab-community-and-enterprise-editions-cve-2021-39935","stacks":["devtools"],"startedAt":"2026-02-03","status":"closed","summary":"GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. CISA added CVE-2021-39935 to its Known Exploited Vulnerabilities catalog on Feb 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-39935)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gitlab-community-and-enterprise-editions-cve-2021-39935","vendor":"GitLab"},{"auto":true,"category":"patch","closedAt":"2026-02-17","cveIds":["CVE-2025-64328"],"exploited":"in-the-wild","identifiers":["CVE-2025-64328"],"json":"https://helix.ml/threat-watch/i/sangoma-freepbx-cve-2025-64328.json","latestUpdate":{"date":"2026-02-03","title":"CISA added CVE-2025-64328 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 24, 2026)"},"patchStatus":"unknown","product":"FreePBX ","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"sangoma-freepbx-cve-2025-64328","stacks":[],"startedAt":"2026-02-03","status":"closed","summary":"Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -\u003e check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. CISA added CVE-2025-64328 to its Known Exploited Vulnerabilities catalog on Feb 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Sangoma FreePBX OS Command Injection Vulnerability (CVE-2025-64328)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sangoma-freepbx-cve-2025-64328","vendor":"Sangoma"},{"auto":true,"category":"patch","closedAt":"2026-02-17","cveIds":["CVE-2019-19006"],"exploited":"in-the-wild","identifiers":["CVE-2019-19006"],"json":"https://helix.ml/threat-watch/i/sangoma-freepbx-cve-2019-19006.json","latestUpdate":{"date":"2026-02-03","title":"CISA added CVE-2019-19006 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 24, 2026)"},"patchStatus":"unknown","product":"FreePBX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sangoma-freepbx-cve-2019-19006","stacks":[],"startedAt":"2026-02-03","status":"closed","summary":"Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin. CISA added CVE-2019-19006 to its Known Exploited Vulnerabilities catalog on Feb 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Sangoma FreePBX Improper Authentication Vulnerability (CVE-2019-19006)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sangoma-freepbx-cve-2019-19006","vendor":"Sangoma"},{"auto":true,"category":"patch","closedAt":"2026-02-17","cveIds":["CVE-2025-40551"],"exploited":"in-the-wild","identifiers":["CVE-2025-40551"],"json":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2025-40551.json","latestUpdate":{"date":"2026-02-03","title":"CISA added CVE-2025-40551 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 6, 2026)"},"patchStatus":"unknown","product":"Web Help Desk","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-web-help-desk-cve-2025-40551","stacks":["rust"],"startedAt":"2026-02-03","status":"closed","summary":"SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. CISA added CVE-2025-40551 to its Known Exploited Vulnerabilities catalog on Feb 3, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (CVE-2025-40551)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2025-40551","vendor":"SolarWinds"},{"auto":true,"category":"breach","closedAt":"2026-02-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PANERABREAD"],"json":"https://helix.ml/threat-watch/i/panerabread-data-breach.json","latestUpdate":{"date":"2026-01-31","title":"Have I Been Pwned loaded 5.1M breached Panera Bread accounts"},"patchStatus":"no-fix-needed","product":"panerabread.com","severity":"medium","severityNote":"5.1M accounts","slug":"panerabread-data-breach","stacks":[],"startedAt":"2026-01-31","status":"closed","summary":"In January 2026, Panera Bread suffered a data breach that exposed 14M records. After an attempted extortion failed, the attackers published the data publicly, which included 5.1M unique email addresses along with associated account information such as names, phone numbers and physical addresses. Panera Bread subsequently confirmed that \"the data involved is contact information\" and that authorities were notified. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jan 7, 2026; Have I Been Pwned loaded it on Jan 31, 2026.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Panera Bread data breach: 5.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/panerabread-data-breach","vendor":"Panera Bread"},{"auto":true,"category":"patch","closedAt":"2026-02-12","cveIds":["CVE-2026-1281"],"exploited":"in-the-wild","identifiers":["CVE-2026-1281"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281.json","latestUpdate":{"date":"2026-01-29","title":"CISA added CVE-2026-1281 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2026)"},"patchStatus":"patched","product":"Endpoint Manager Mobile (EPMM)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-cve-2026-1281","stacks":[],"startedAt":"2026-01-29","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities catalog on Jan 29, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (CVE-2026-1281)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2026-02-10","cveIds":["CVE-2026-24858"],"exploited":"in-the-wild","identifiers":["CVE-2026-24858"],"json":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2026-24858.json","latestUpdate":{"date":"2026-01-27","title":"CISA added CVE-2026-24858 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 30, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-multiple-products-cve-2026-24858","stacks":["network"],"startedAt":"2026-01-27","status":"closed","summary":"Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. CISA added CVE-2026-24858 to its Known Exploited Vulnerabilities catalog on Jan 27, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-24858)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2026-24858","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2026-02-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SOUNDCLOUD"],"json":"https://helix.ml/threat-watch/i/soundcloud-data-breach.json","latestUpdate":{"date":"2026-01-27","title":"Have I Been Pwned loaded 29.8M breached SoundCloud accounts"},"patchStatus":"no-fix-needed","product":"soundcloud.com","severity":"medium","severityNote":"29.8M accounts","slug":"soundcloud-data-breach","stacks":[],"startedAt":"2026-01-27","status":"closed","summary":"In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform. The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month. Exposed data: avatars, email addresses, geographic locations, names, profile statistics, usernames. The breach dates from Dec 15, 2025; Have I Been Pwned loaded it on Jan 27, 2026.","tags":["data-breach","hibp","avatars","email-addresses","geographic-locations","names","profile-statistics","usernames"],"title":"SoundCloud data breach: 29.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/soundcloud-data-breach","vendor":"SoundCloud"},{"auto":true,"category":"patch","closedAt":"2026-02-09","cveIds":["CVE-2018-14634"],"exploited":"in-the-wild","identifiers":["CVE-2018-14634"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2018-14634.json","latestUpdate":{"date":"2026-01-26","title":"CISA added CVE-2018-14634 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2026)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.0) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2018-14634","stacks":["linux"],"startedAt":"2026-01-26","status":"closed","summary":"Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system. CISA added CVE-2018-14634 to its Known Exploited Vulnerabilities catalog on Jan 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-190"],"title":"Linux Kernel Integer Overflow Vulnerability (CVE-2018-14634)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2018-14634","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2026-02-09","cveIds":["CVE-2025-52691"],"exploited":"in-the-wild","identifiers":["CVE-2025-52691"],"json":"https://helix.ml/threat-watch/i/smartertools-smartermail-cve-2025-52691.json","latestUpdate":{"date":"2026-01-26","title":"CISA added CVE-2025-52691 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2026)"},"patchStatus":"unknown","product":"SmarterMail","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"smartertools-smartermail-cve-2025-52691","stacks":[],"startedAt":"2026-01-26","status":"closed","summary":"SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. CISA added CVE-2025-52691 to its Known Exploited Vulnerabilities catalog on Jan 26, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-434"],"title":"SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2025-52691)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/smartertools-smartermail-cve-2025-52691","vendor":"SmarterTools"},{"auto":true,"category":"patch","closedAt":"2026-02-09","cveIds":["CVE-2026-23760"],"exploited":"in-the-wild","identifiers":["CVE-2026-23760"],"json":"https://helix.ml/threat-watch/i/smartertools-smartermail-cve-2026-23760.json","latestUpdate":{"date":"2026-01-26","title":"CISA added CVE-2026-23760 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2026)"},"patchStatus":"unknown","product":"SmarterMail","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"smartertools-smartermail-cve-2026-23760","stacks":[],"startedAt":"2026-01-26","status":"closed","summary":"SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. CISA added CVE-2026-23760 to its Known Exploited Vulnerabilities catalog on Jan 26, 2026, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-288"],"title":"SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-23760)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/smartertools-smartermail-cve-2026-23760","vendor":"SmarterTools"},{"auto":true,"category":"patch","closedAt":"2026-02-09","cveIds":["CVE-2026-24061"],"exploited":"in-the-wild","identifiers":["CVE-2026-24061"],"json":"https://helix.ml/threat-watch/i/gnu-inetutils-cve-2026-24061.json","latestUpdate":{"date":"2026-01-26","title":"CISA added CVE-2026-24061 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2026)"},"patchStatus":"patched","product":"InetUtils","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gnu-inetutils-cve-2026-24061","stacks":[],"startedAt":"2026-01-26","status":"closed","summary":"GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable. CISA added CVE-2026-24061 to its Known Exploited Vulnerabilities catalog on Jan 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-88"],"title":"GNU InetUtils Argument Injection Vulnerability (CVE-2026-24061)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gnu-inetutils-cve-2026-24061","vendor":"GNU"},{"auto":true,"category":"patch","closedAt":"2026-02-09","cveIds":["CVE-2026-21509"],"exploited":"in-the-wild","identifiers":["CVE-2026-21509"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2026-21509.json","latestUpdate":{"date":"2026-01-26","title":"CISA added CVE-2026-21509 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2026)"},"patchStatus":"unknown","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2026-21509","stacks":["windows"],"startedAt":"2026-01-26","status":"closed","summary":"Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA added CVE-2026-21509 to its Known Exploited Vulnerabilities catalog on Jan 26, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-807"],"title":"Microsoft Office Security Feature Bypass Vulnerability (CVE-2026-21509)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2026-21509","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-02-06","cveIds":["CVE-2024-37079"],"exploited":"in-the-wild","identifiers":["CVE-2024-37079"],"json":"https://helix.ml/threat-watch/i/broadcom-vmware-vcenter-server-cve-2024-37079.json","latestUpdate":{"date":"2026-01-23","title":"CISA added CVE-2024-37079 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 13, 2026)"},"patchStatus":"patched","product":"VMware vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"broadcom-vmware-vcenter-server-cve-2024-37079","stacks":["cloud"],"startedAt":"2026-01-23","status":"closed","summary":"Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution. CISA added CVE-2024-37079 to its Known Exploited Vulnerabilities catalog on Jan 23, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability (CVE-2024-37079)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/broadcom-vmware-vcenter-server-cve-2024-37079","vendor":"Broadcom"},{"auto":true,"category":"patch","closedAt":"2026-02-05","cveIds":["CVE-2025-68645"],"exploited":"in-the-wild","identifiers":["CVE-2025-68645"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-68645.json","latestUpdate":{"date":"2026-01-22","title":"CISA added CVE-2025-68645 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 12, 2026)"},"patchStatus":"unknown","product":" Zimbra Collaboration Suite (ZCS)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2025-68645","stacks":["php"],"startedAt":"2026-01-22","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory. CISA added CVE-2025-68645 to its Known Exploited Vulnerabilities catalog on Jan 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-98"],"title":"Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability (CVE-2025-68645)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-68645","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2026-02-05","cveIds":["CVE-2025-34026"],"exploited":"in-the-wild","identifiers":["CVE-2025-34026"],"json":"https://helix.ml/threat-watch/i/versa-concerto-cve-2025-34026.json","latestUpdate":{"date":"2026-01-22","title":"CISA added CVE-2025-34026 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 12, 2026)"},"patchStatus":"unknown","product":"Concerto","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"versa-concerto-cve-2025-34026","stacks":[],"startedAt":"2026-01-22","status":"closed","summary":"Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs. CISA added CVE-2025-34026 to its Known Exploited Vulnerabilities catalog on Jan 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Versa Concerto Improper Authentication Vulnerability (CVE-2025-34026)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/versa-concerto-cve-2025-34026","vendor":"Versa"},{"auto":true,"category":"patch","closedAt":"2026-02-05","cveIds":["CVE-2025-31125"],"exploited":"in-the-wild","identifiers":["CVE-2025-31125"],"json":"https://helix.ml/threat-watch/i/vite-vitejs-cve-2025-31125.json","latestUpdate":{"date":"2026-01-22","title":"CISA added CVE-2025-31125 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 12, 2026)"},"patchStatus":"patched","product":"Vitejs","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"vite-vitejs-cve-2025-31125","stacks":[],"startedAt":"2026-01-22","status":"closed","summary":"Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline\u0026import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. CISA added CVE-2025-31125 to its Known Exploited Vulnerabilities catalog on Jan 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200","cwe-284"],"title":"Vite Vitejs Improper Access Control Vulnerability (CVE-2025-31125)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/vite-vitejs-cve-2025-31125","vendor":"Vite"},{"auto":true,"category":"patch","closedAt":"2026-02-05","cveIds":["CVE-2025-54313"],"exploited":"in-the-wild","identifiers":["CVE-2025-54313"],"json":"https://helix.ml/threat-watch/i/prettier-eslint-config-prettier-cve-2025-54313.json","latestUpdate":{"date":"2026-01-22","title":"CISA added CVE-2025-54313 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 12, 2026)"},"patchStatus":"unknown","product":"eslint-config-prettier","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"prettier-eslint-config-prettier-cve-2025-54313","stacks":[],"startedAt":"2026-01-22","status":"closed","summary":"Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. CISA added CVE-2025-54313 to its Known Exploited Vulnerabilities catalog on Jan 22, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-506"],"title":"Prettier eslint-config-prettier Embedded Malicious Code Vulnerability (CVE-2025-54313)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/prettier-eslint-config-prettier-cve-2025-54313","vendor":"Prettier"},{"auto":true,"category":"patch","closedAt":"2026-02-04","cveIds":["CVE-2026-20045"],"exploited":"in-the-wild","identifiers":["CVE-2026-20045"],"json":"https://helix.ml/threat-watch/i/cisco-unified-communications-manager-cve-2026-20045.json","latestUpdate":{"date":"2026-01-21","title":"CISA added CVE-2026-20045 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 11, 2026)"},"patchStatus":"unknown","product":"Unified Communications Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-unified-communications-manager-cve-2026-20045","stacks":["network"],"startedAt":"2026-01-21","status":"closed","summary":"Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM \u0026 Presence Service (Unified CM IM\u0026P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities catalog on Jan 21, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Cisco Unified Communications Products Code Injection Vulnerability (CVE-2026-20045)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-unified-communications-manager-cve-2026-20045","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2026-02-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNDERARMOUR"],"json":"https://helix.ml/threat-watch/i/underarmour-data-breach.json","latestUpdate":{"date":"2026-01-21","title":"Have I Been Pwned loaded 72.7M breached Under Armour accounts"},"patchStatus":"no-fix-needed","product":"underarmour.com","severity":"high","severityNote":"72.7M accounts","slug":"underarmour-data-breach","stacks":[],"startedAt":"2026-01-21","status":"closed","summary":"In November 2025, the Everest ransomware group claimed Under Armour as a victim and attempted to extort a ransom, alleging they had obtained access to 343GB of data. In January 2026, customer data from the incident was published publicly on a popular hacking forum, including 72M email addresses. Many records also contained additional personal information such as names, dates of birth, genders, geographic locations and purchase information. Exposed data: dates of birth, email addresses, genders, geographic locations, names, purchases. The breach dates from Nov 17, 2025; Have I Been Pwned loaded it on Jan 21, 2026.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","purchases"],"title":"Under Armour data breach: 72.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/underarmour-data-breach","vendor":"Under Armour"},{"auto":true,"category":"breach","closedAt":"2026-02-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RAAGA"],"json":"https://helix.ml/threat-watch/i/raaga-data-breach.json","latestUpdate":{"date":"2026-01-19","title":"Have I Been Pwned loaded 10.2M breached Raaga accounts"},"patchStatus":"no-fix-needed","product":"raaga.com","severity":"high","severityNote":"10.2M accounts · passwords exposed","slug":"raaga-data-breach","stacks":[],"startedAt":"2026-01-19","status":"closed","summary":"In December 2025, data allegedly breached from the Indian streaming music service \"Raaga\" was posted for sale to a popular hacking forum. The data contained 10M unique email addresses along with names, genders, ages (in some cases, full date of birth), postcodes and passwords stored as unsalted MD5 hashes. Exposed data: ages, dates of birth, email addresses, genders, geographic locations, names, passwords. The breach dates from Dec 15, 2025; Have I Been Pwned loaded it on Jan 19, 2026.","tags":["data-breach","hibp","ages","dates-of-birth","email-addresses","genders","geographic-locations","names","passwords"],"title":"Raaga data breach: 10.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/raaga-data-breach","vendor":"Raaga"},{"auto":true,"category":"breach","closedAt":"2026-02-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PASSSPORT"],"json":"https://helix.ml/threat-watch/i/passsport-data-breach.json","latestUpdate":{"date":"2026-01-18","title":"Have I Been Pwned loaded 6.4M breached Pass'Sport accounts"},"patchStatus":"no-fix-needed","product":"pass.sports.gouv.fr","severity":"medium","severityNote":"6.4M accounts","slug":"passsport-data-breach","stacks":[],"startedAt":"2026-01-18","status":"closed","summary":"In December 2025, data from France's Pass'Sport program was posted to a popular hacking forum. Initially misattributed to CAF (the French family allowance fund), the data contained 6.5M unique email addresses affecting 3.5M households. The data also included names, phone numbers, genders and physical addresses. The Ministry of Sports subsequently released a statement acknowledging the incident. Exposed data: email addresses, genders, names, phone numbers, physical addresses. The breach dates from Dec 17, 2025; Have I Been Pwned loaded it on Jan 18, 2026.","tags":["data-breach","hibp","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"Pass'Sport data breach: 6.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/passsport-data-breach","vendor":"Pass'Sport"},{"auto":true,"category":"patch","closedAt":"2026-01-27","cveIds":["CVE-2026-20805"],"exploited":"in-the-wild","identifiers":["CVE-2026-20805"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-20805.json","latestUpdate":{"date":"2026-01-13","title":"CISA added CVE-2026-20805 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 3, 2026)"},"patchStatus":"unknown","product":"Windows","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2026-20805","stacks":["windows"],"startedAt":"2026-01-13","status":"closed","summary":"Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. CISA added CVE-2026-20805 to its Known Exploited Vulnerabilities catalog on Jan 13, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Microsoft Windows Information Disclosure Vulnerability (CVE-2026-20805)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-20805","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-01-26","cveIds":["CVE-2025-8110"],"exploited":"in-the-wild","identifiers":["CVE-2025-8110"],"json":"https://helix.ml/threat-watch/i/gogs-gogs-cve-2025-8110.json","latestUpdate":{"date":"2026-01-12","title":"CISA added CVE-2025-8110 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 2, 2026)"},"patchStatus":"patched","product":"Gogs","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gogs-gogs-cve-2025-8110","stacks":[],"startedAt":"2026-01-12","status":"closed","summary":"Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution. CISA added CVE-2025-8110 to its Known Exploited Vulnerabilities catalog on Jan 12, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Gogs Path Traversal Vulnerability (CVE-2025-8110)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gogs-gogs-cve-2025-8110","vendor":"Gogs"},{"auto":true,"category":"breach","closedAt":"2026-01-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INSTAGRAM"],"json":"https://helix.ml/threat-watch/i/instagram-data-breach.json","latestUpdate":{"date":"2026-01-11","title":"Have I Been Pwned loaded 6.2M breached Instagram accounts"},"patchStatus":"no-fix-needed","product":"instagram.com","severity":"medium","severityNote":"6.2M accounts","slug":"instagram-data-breach","stacks":[],"startedAt":"2026-01-11","status":"closed","summary":"In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform, despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised. Exposed data: display names, email addresses, geographic locations, phone numbers, usernames. The breach dates from Jan 7, 2026; Have I Been Pwned loaded it on Jan 11, 2026.","tags":["data-breach","hibp","display-names","email-addresses","geographic-locations","phone-numbers","usernames"],"title":"Instagram data breach: 6.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/instagram-data-breach","vendor":"Instagram"},{"auto":true,"category":"breach","closedAt":"2026-01-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BREACHFORUMS2025"],"json":"https://helix.ml/threat-watch/i/breachforums2025-data-breach.json","latestUpdate":{"date":"2026-01-10","title":"Have I Been Pwned loaded 672K breached BreachForums (2025) accounts"},"patchStatus":"no-fix-needed","product":"breachforums.hn","severity":"high","severityNote":"672K accounts · passwords exposed","slug":"breachforums2025-data-breach","stacks":[],"startedAt":"2026-01-10","status":"closed","summary":"In October 2025, a reincarnation of the hacking forum BreachForums, which had previously been shut down multiple times, was taken offline by a coalition of law enforcement agencies. In the months leading up to the takedown, the site itself suffered a data breach that exposed a total of 672k unique email addresses across all tables, including within forum posts and private messages. The users table alone contained 324k unique email addresses, usernames, and Argon2 password hashes. Exposed data: email addresses, forum posts, passwords, private messages, usernames. The breach dates from Aug 11, 2025; Have I Been Pwned loaded it on Jan 10, 2026.","tags":["data-breach","hibp","email-addresses","forum-posts","passwords","private-messages","usernames"],"title":"BreachForums (2025) data breach: 672K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/breachforums2025-data-breach","vendor":"BreachForums (2025)"},{"auto":true,"category":"patch","closedAt":"2026-01-21","cveIds":["CVE-2009-0556"],"exploited":"in-the-wild","identifiers":["CVE-2009-0556"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0556.json","latestUpdate":{"date":"2026-01-07","title":"CISA added CVE-2009-0556 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 28, 2026)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2009-0556","stacks":["windows"],"startedAt":"2026-01-07","status":"closed","summary":"Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption. CISA added CVE-2009-0556 to its Known Exploited Vulnerabilities catalog on Jan 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-94"],"title":"Microsoft Office PowerPoint Code Injection Vulnerability (CVE-2009-0556)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0556","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2026-01-21","cveIds":["CVE-2025-37164"],"exploited":"in-the-wild","identifiers":["CVE-2025-37164"],"json":"https://helix.ml/threat-watch/i/hewlett-packard-enterprise-hpe-oneview-cve-2025-37164.json","latestUpdate":{"date":"2026-01-07","title":"CISA added CVE-2025-37164 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 28, 2026)"},"patchStatus":"unknown","product":"OneView","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"hewlett-packard-enterprise-hpe-oneview-cve-2025-37164","stacks":[],"startedAt":"2026-01-07","status":"closed","summary":"Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution. CISA added CVE-2025-37164 to its Known Exploited Vulnerabilities catalog on Jan 7, 2026, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability (CVE-2025-37164)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/hewlett-packard-enterprise-hpe-oneview-cve-2025-37164","vendor":"Hewlett Packard Enterprise (HPE)"},{"auto":true,"category":"breach","closedAt":"2026-01-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WHITEDATE"],"json":"https://helix.ml/threat-watch/i/whitedate-data-breach.json","latestUpdate":{"date":"2026-01-06","title":"Have I Been Pwned loaded 20K breached WhiteDate accounts"},"patchStatus":"no-fix-needed","product":"whitedate.net","severity":"high","severityNote":"20K accounts · passwords exposed","slug":"whitedate-data-breach","stacks":[],"startedAt":"2026-01-06","status":"closed","summary":"In December 2025, the dating website \"for a Europid vision\" WhiteDate suffered a data breach that was subsequently leaked online, initially exposing 6.1k unique email addresses. The leaked data included extensive personal information such as physical appearance, income, education and IQ. A more comprehensive dataset was later provided to HIBP, containing usernames, IP addresses, private messages, phpBB password hashes and a total of 20k unique email addresses. Exposed data: ages, astrological signs, bios, device information, education levels, email addresses, family structure, forum posts, genders, geographic locations, income levels, ip addresses, iq levels, nicknames, passwords, physical attributes, private messages, profile photos, races, relationship statuses, sexual orientations, usernames. The breach dates from Dec 29, 2025; Have I Been Pwned loaded it on Jan 6, 2026.","tags":["data-breach","hibp","ages","astrological-signs","bios","device-information","education-levels","email-addresses","family-structure","forum-posts","genders","geographic-locations","income-levels","ip-addresses"],"title":"WhiteDate data breach: 20K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/whitedate-data-breach","vendor":"WhiteDate"},{"auto":true,"category":"patch","closedAt":"2026-01-12","cveIds":["CVE-2025-14847"],"exploited":"in-the-wild","identifiers":["CVE-2025-14847"],"json":"https://helix.ml/threat-watch/i/mongodb-mongodb-and-mongodb-server-cve-2025-14847.json","latestUpdate":{"date":"2025-12-29","title":"CISA added CVE-2025-14847 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 19, 2026)"},"patchStatus":"patched","product":"MongoDB and MongoDB Server","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"mongodb-mongodb-and-mongodb-server-cve-2025-14847","stacks":["database"],"startedAt":"2025-12-29","status":"closed","summary":"MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client. CISA added CVE-2025-14847 to its Known Exploited Vulnerabilities catalog on Dec 29, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-130"],"title":"MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability (CVE-2025-14847)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/mongodb-mongodb-and-mongodb-server-cve-2025-14847","vendor":"MongoDB"},{"auto":true,"category":"breach","closedAt":"2026-01-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WIRED"],"json":"https://helix.ml/threat-watch/i/wired-data-breach.json","latestUpdate":{"date":"2025-12-27","title":"Have I Been Pwned loaded 2.4M breached WIRED accounts"},"patchStatus":"no-fix-needed","product":"wired.com","severity":"medium","severityNote":"2.4M accounts","slug":"wired-data-breach","stacks":[],"startedAt":"2025-12-27","status":"closed","summary":"In December 2025, 2.3M records of WIRED magazine users allegedly obtained from parent company Condé Nast were published online. The most recent data dated back to the previous September and exposed email addresses and display names, as well as, for a small number of users, their name, phone number, date of birth, gender, and geographic location or full physical address. The WIRED data allegedly represents a subset of Condé Nast brands the hacker also claims to have obtained. Exposed data: dates of birth, display names, email addresses, genders, geographic locations, names, phone numbers, physical addresses. The breach dates from Sep 8, 2025; Have I Been Pwned loaded it on Dec 27, 2025.","tags":["data-breach","hibp","dates-of-birth","display-names","email-addresses","genders","geographic-locations","names","phone-numbers","physical-addresses"],"title":"WIRED data breach: 2.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/wired-data-breach","vendor":"WIRED"},{"auto":true,"category":"breach","closedAt":"2026-01-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UTAIR"],"json":"https://helix.ml/threat-watch/i/utair-data-breach.json","latestUpdate":{"date":"2025-12-26","title":"Have I Been Pwned loaded 401K breached Utair accounts"},"patchStatus":"no-fix-needed","product":"utair.ru","severity":"medium","severityNote":"401K accounts","slug":"utair-data-breach","stacks":[],"startedAt":"2025-12-26","status":"closed","summary":"In August 2020, news broke of a data breach of Russian airline Utair that dated back to the previous year. The breach contained over 400k unique email addresses along with extensive personal information including names, physical addresses, dates of birth, passport numbers and loyalty program details. Exposed data: dates of birth, email addresses, genders, loyalty program details, names, passport numbers, phone numbers, physical addresses. The breach dates from Mar 21, 2019; Have I Been Pwned loaded it on Dec 26, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","loyalty-program-details","names","passport-numbers","phone-numbers","physical-addresses"],"title":"Utair data breach: 401K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/utair-data-breach","vendor":"Utair"},{"auto":true,"category":"breach","closedAt":"2026-01-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GEMOTEST"],"json":"https://helix.ml/threat-watch/i/gemotest-data-breach.json","latestUpdate":{"date":"2025-12-24","title":"Have I Been Pwned loaded 6.3M breached Медицинская лаборатория Гемотест (Gemotest) accounts"},"patchStatus":"no-fix-needed","product":"gemotest.ru","severity":"high","severityNote":"6.3M accounts","slug":"gemotest-data-breach","stacks":[],"startedAt":"2025-12-24","status":"closed","summary":"In April 2022, Russian pharmaceutical company Gemotest suffered a data breach that exposed 31 million patients. The data contained 6.3 million unique email addresses along with names, physical addresses, dates of birth, passport and insurance numbers. Gemotest was later fined for the breach. Exposed data: dates of birth, email addresses, genders, government issued ids, health insurance information, names, passport numbers, physical addresses. The breach dates from Apr 22, 2022; Have I Been Pwned loaded it on Dec 24, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","government-issued-ids","health-insurance-information","names","passport-numbers","physical-addresses"],"title":"Медицинская лаборатория Гемотест (Gemotest) data breach: 6.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gemotest-data-breach","vendor":"Медицинская лаборатория Гемотест (Gemotest)"},{"auto":true,"category":"patch","closedAt":"2026-01-05","cveIds":["CVE-2023-52163"],"exploited":"in-the-wild","identifiers":["CVE-2023-52163"],"json":"https://helix.ml/threat-watch/i/digiever-ds-2105-pro-cve-2023-52163.json","latestUpdate":{"date":"2025-12-22","title":"CISA added CVE-2023-52163 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 12, 2026)"},"patchStatus":"unknown","product":"DS-2105 Pro","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"digiever-ds-2105-pro-cve-2023-52163","stacks":[],"startedAt":"2025-12-22","status":"closed","summary":"Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi. CISA added CVE-2023-52163 to its Known Exploited Vulnerabilities catalog on Dec 22, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-862"],"title":"Digiever DS-2105 Pro Missing Authorization Vulnerability (CVE-2023-52163)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/digiever-ds-2105-pro-cve-2023-52163","vendor":"Digiever"},{"auto":true,"category":"patch","closedAt":"2026-01-02","cveIds":["CVE-2025-14733"],"exploited":"in-the-wild","identifiers":["CVE-2025-14733"],"json":"https://helix.ml/threat-watch/i/watchguard-firebox-cve-2025-14733.json","latestUpdate":{"date":"2025-12-19","title":"CISA added CVE-2025-14733 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 26, 2025)"},"patchStatus":"unknown","product":"Firebox","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"watchguard-firebox-cve-2025-14733","stacks":[],"startedAt":"2025-12-19","status":"closed","summary":"WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. CISA added CVE-2025-14733 to its Known Exploited Vulnerabilities catalog on Dec 19, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-787"],"title":"WatchGuard Firebox Out of Bounds Write Vulnerability (CVE-2025-14733)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/watchguard-firebox-cve-2025-14733","vendor":"WatchGuard"},{"auto":true,"category":"breach","closedAt":"2026-01-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEBOTTINGNETWORK"],"json":"https://helix.ml/threat-watch/i/thebottingnetwork-data-breach.json","latestUpdate":{"date":"2025-12-18","title":"Have I Been Pwned loaded 96K breached The Botting Network accounts"},"patchStatus":"no-fix-needed","product":"thebotnet.com","severity":"high","severityNote":"96K accounts · passwords exposed","slug":"thebottingnetwork-data-breach","stacks":[],"startedAt":"2025-12-18","status":"closed","summary":"In August 2012, the forum for making money with botting \"The Botting Network\" suffered a data breach that exposed 96k user records. The now defunct vBulletin forum leaked 96k email addresses, usernames, dates of birth and salted MD5 password hashes. Exposed data: dates of birth, email addresses, passwords, usernames. The breach dates from Aug 12, 2012; Have I Been Pwned loaded it on Dec 18, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","passwords","usernames"],"title":"The Botting Network data breach: 96K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/thebottingnetwork-data-breach","vendor":"The Botting Network"},{"auto":true,"category":"breach","closedAt":"2026-01-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AUTOSUR"],"json":"https://helix.ml/threat-watch/i/autosur-data-breach.json","latestUpdate":{"date":"2025-12-18","title":"Have I Been Pwned loaded 487K breached AUTOSUR accounts"},"patchStatus":"no-fix-needed","product":"autosur.fr","severity":"medium","severityNote":"487K accounts","slug":"autosur-data-breach","stacks":[],"startedAt":"2025-12-18","status":"closed","summary":"In March 2025, the French vehicle inspection company AUTOSUR suffered a data breach exposing over 10M customer records, though only 487k unique email addresses were present. The compromised data included names, phone numbers, physical addresses, and vehicle details such as make and model, VIN, and registration plate. AUTOSUR later issued a disclosure notice with further details. Exposed data: email addresses, names, phone numbers, physical addresses, vehicle details, vehicle identification numbers (vins), vehicle registration plates. The breach dates from Mar 16, 2025; Have I Been Pwned loaded it on Dec 18, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","vehicle-details","vehicle-identification-numbers-vins","vehicle-registration-plates"],"title":"AUTOSUR data breach: 487K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/autosur-data-breach","vendor":"AUTOSUR"},{"auto":true,"category":"patch","closedAt":"2025-12-31","cveIds":["CVE-2025-59374"],"exploited":"in-the-wild","identifiers":["CVE-2025-59374"],"json":"https://helix.ml/threat-watch/i/asus-live-update-cve-2025-59374.json","latestUpdate":{"date":"2025-12-17","title":"CISA added CVE-2025-59374 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 7, 2026)"},"patchStatus":"unknown","product":"Live Update","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"asus-live-update-cve-2025-59374","stacks":[],"startedAt":"2025-12-17","status":"closed","summary":"ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2025-59374 to its Known Exploited Vulnerabilities catalog on Dec 17, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-506"],"title":"ASUS Live Update Embedded Malicious Code Vulnerability (CVE-2025-59374)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/asus-live-update-cve-2025-59374","vendor":"ASUS"},{"auto":true,"category":"patch","closedAt":"2025-12-31","cveIds":["CVE-2025-40602"],"exploited":"in-the-wild","identifiers":["CVE-2025-40602"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliance-cve-2025-40602.json","latestUpdate":{"date":"2025-12-17","title":"CISA added CVE-2025-40602 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2025)"},"patchStatus":"unknown","product":"SMA1000 appliance","severity":"medium","severityNote":"CVSS 6.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma1000-appliance-cve-2025-40602","stacks":["vpn"],"startedAt":"2025-12-17","status":"closed","summary":"SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. CISA added CVE-2025-40602 to its Known Exploited Vulnerabilities catalog on Dec 17, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-862","cwe-250"],"title":"SonicWall SMA1000 Missing Authorization Vulnerability (CVE-2025-40602)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliance-cve-2025-40602","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2025-12-31","cveIds":["CVE-2025-20393"],"exploited":"in-the-wild","identifiers":["CVE-2025-20393"],"json":"https://helix.ml/threat-watch/i/cisco-multiple-products-cve-2025-20393.json","latestUpdate":{"date":"2025-12-17","title":"CISA added CVE-2025-20393 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-multiple-products-cve-2025-20393","stacks":["network"],"startedAt":"2025-12-17","status":"closed","summary":"Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. CISA added CVE-2025-20393 to its Known Exploited Vulnerabilities catalog on Dec 17, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco Multiple Products Improper Input Validation Vulnerability (CVE-2025-20393)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cisco-multiple-products-cve-2025-20393","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2025-12-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WEBHOSTINGTALK"],"json":"https://helix.ml/threat-watch/i/webhostingtalk-data-breach.json","latestUpdate":{"date":"2025-12-17","title":"Have I Been Pwned loaded 515K breached Web Hosting Talk accounts"},"patchStatus":"no-fix-needed","product":"webhostingtalk.com","severity":"high","severityNote":"515K accounts · passwords exposed","slug":"webhostingtalk-data-breach","stacks":[],"startedAt":"2025-12-17","status":"closed","summary":"In July 2016, the Web Hosting Talk forum suffered a data breach that was subsequently listed for sale. The breach of the vBulletin based forum exposed 515k user records including usernames, email addresses, IP addresses and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Dec 17, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Web Hosting Talk data breach: 515K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/webhostingtalk-data-breach","vendor":"Web Hosting Talk"},{"auto":true,"category":"patch","closedAt":"2025-12-30","cveIds":["CVE-2025-59718"],"exploited":"in-the-wild","identifiers":["CVE-2025-59718"],"json":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-59718.json","latestUpdate":{"date":"2025-12-16","title":"CISA added CVE-2025-59718 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 23, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-multiple-products-cve-2025-59718","stacks":["network"],"startedAt":"2025-12-16","status":"closed","summary":"Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory. CISA added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog on Dec 16, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-347"],"title":"Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability (CVE-2025-59718)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-59718","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2025-12-29","cveIds":["CVE-2025-14611"],"exploited":"in-the-wild","identifiers":["CVE-2025-14611"],"json":"https://helix.ml/threat-watch/i/gladinet-centrestack-and-triofox-cve-2025-14611.json","latestUpdate":{"date":"2025-12-15","title":"CISA added CVE-2025-14611 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 5, 2026)"},"patchStatus":"unknown","product":"CentreStack and Triofox","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gladinet-centrestack-and-triofox-cve-2025-14611","stacks":[],"startedAt":"2025-12-15","status":"closed","summary":"Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. CISA added CVE-2025-14611 to its Known Exploited Vulnerabilities catalog on Dec 15, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-798"],"title":"Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability (CVE-2025-14611)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gladinet-centrestack-and-triofox-cve-2025-14611","vendor":"Gladinet"},{"auto":true,"category":"patch","closedAt":"2025-12-29","cveIds":["CVE-2025-43529"],"exploited":"in-the-wild","identifiers":["CVE-2025-43529"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43529.json","latestUpdate":{"date":"2025-12-15","title":"CISA added CVE-2025-43529 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 5, 2026)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-43529","stacks":["browser","ios"],"startedAt":"2025-12-15","status":"closed","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2025-43529 to its Known Exploited Vulnerabilities catalog on Dec 15, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple Multiple Products Use-After-Free WebKit Vulnerability (CVE-2025-43529)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43529","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2025-12-26","cveIds":["CVE-2018-4063"],"exploited":"in-the-wild","identifiers":["CVE-2018-4063"],"json":"https://helix.ml/threat-watch/i/sierra-wireless-airlink-aleos-cve-2018-4063.json","latestUpdate":{"date":"2025-12-12","title":"CISA added CVE-2018-4063 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 2, 2026)"},"patchStatus":"unknown","product":"AirLink ALEOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sierra-wireless-airlink-aleos-cve-2018-4063","stacks":[],"startedAt":"2025-12-12","status":"closed","summary":"Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2018-4063 to its Known Exploited Vulnerabilities catalog on Dec 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-4063)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/sierra-wireless-airlink-aleos-cve-2018-4063","vendor":"Sierra Wireless"},{"auto":true,"category":"patch","closedAt":"2025-12-26","cveIds":["CVE-2025-14174"],"exploited":"in-the-wild","identifiers":["CVE-2025-14174"],"json":"https://helix.ml/threat-watch/i/google-chromium-cve-2025-14174.json","latestUpdate":{"date":"2025-12-12","title":"CISA added CVE-2025-14174 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 2, 2026)"},"patchStatus":"unknown","product":"Chromium","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-cve-2025-14174","stacks":["browser"],"startedAt":"2025-12-12","status":"closed","summary":"Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2025-14174 to its Known Exploited Vulnerabilities catalog on Dec 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Google Chromium Out of Bounds Memory Access Vulnerability (CVE-2025-14174)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-chromium-cve-2025-14174","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2025-12-25","cveIds":["CVE-2025-58360"],"exploited":"in-the-wild","identifiers":["CVE-2025-58360"],"json":"https://helix.ml/threat-watch/i/osgeo-geoserver-cve-2025-58360.json","latestUpdate":{"date":"2025-12-11","title":"CISA added CVE-2025-58360 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 1, 2026)"},"patchStatus":"unknown","product":"GeoServer","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"osgeo-geoserver-cve-2025-58360","stacks":[],"startedAt":"2025-12-11","status":"closed","summary":"OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. CISA added CVE-2025-58360 to its Known Exploited Vulnerabilities catalog on Dec 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-611"],"title":"OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability (CVE-2025-58360)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/osgeo-geoserver-cve-2025-58360","vendor":"OSGeo"},{"auto":true,"category":"patch","closedAt":"2025-12-23","cveIds":["CVE-2025-6218"],"exploited":"in-the-wild","identifiers":["CVE-2025-6218"],"json":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2025-6218.json","latestUpdate":{"date":"2025-12-09","title":"CISA added CVE-2025-6218 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 30, 2025)"},"patchStatus":"unknown","product":"WinRAR","severity":"high","severityNote":"CVSS 7.8 (v3.0) · exploited in the wild (CISA KEV)","slug":"rarlab-winrar-cve-2025-6218","stacks":[],"startedAt":"2025-12-09","status":"closed","summary":"RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user. CISA added CVE-2025-6218 to its Known Exploited Vulnerabilities catalog on Dec 9, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"RARLAB WinRAR Path Traversal Vulnerability (CVE-2025-6218)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2025-6218","vendor":"RARLAB"},{"auto":true,"category":"patch","closedAt":"2025-12-23","cveIds":["CVE-2025-62221"],"exploited":"in-the-wild","identifiers":["CVE-2025-62221"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-62221.json","latestUpdate":{"date":"2025-12-09","title":"CISA added CVE-2025-62221 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 30, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-62221","stacks":["windows"],"startedAt":"2025-12-09","status":"closed","summary":"Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally. CISA added CVE-2025-62221 to its Known Exploited Vulnerabilities catalog on Dec 9, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-416"],"title":"Microsoft Windows Use After Free Vulnerability (CVE-2025-62221)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-62221","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-12-22","cveIds":["CVE-2022-37055"],"exploited":"in-the-wild","identifiers":["CVE-2022-37055"],"json":"https://helix.ml/threat-watch/i/d-link-routers-cve-2022-37055.json","latestUpdate":{"date":"2025-12-08","title":"CISA added CVE-2022-37055 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 29, 2025)"},"patchStatus":"patched","product":"Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-routers-cve-2022-37055","stacks":["network"],"startedAt":"2025-12-08","status":"closed","summary":"D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2022-37055 to its Known Exploited Vulnerabilities catalog on Dec 8, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-120"],"title":"D-Link Routers Buffer Overflow Vulnerability (CVE-2022-37055)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/d-link-routers-cve-2022-37055","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2025-12-22","cveIds":["CVE-2025-66644"],"exploited":"in-the-wild","identifiers":["CVE-2025-66644"],"json":"https://helix.ml/threat-watch/i/array-networks-arrayos-ag-cve-2025-66644.json","latestUpdate":{"date":"2025-12-08","title":"CISA added CVE-2025-66644 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 29, 2025)"},"patchStatus":"unknown","product":"ArrayOS AG","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"array-networks-arrayos-ag-cve-2025-66644","stacks":[],"startedAt":"2025-12-08","status":"closed","summary":"Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. CISA added CVE-2025-66644 to its Known Exploited Vulnerabilities catalog on Dec 8, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Array Networks ArrayOS AG OS Command Injection Vulnerability (CVE-2025-66644)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/array-networks-arrayos-ag-cve-2025-66644","vendor":"Array Networks "},{"auto":true,"category":"breach","closedAt":"2025-12-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KINOKONG"],"json":"https://helix.ml/threat-watch/i/kinokong-data-breach.json","latestUpdate":{"date":"2025-12-06","title":"Have I Been Pwned loaded 817K breached KinoKong accounts"},"patchStatus":"no-fix-needed","product":"kinokong.org","severity":"high","severityNote":"817K accounts · passwords exposed","slug":"kinokong-data-breach","stacks":[],"startedAt":"2025-12-06","status":"closed","summary":"In March 2021, the Russian online streaming service KinoKong suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed over 800k unique email addresses along with names, usernames, IP addresses and MD5 password hashes. Exposed data: email addresses, ip addresses, names, passwords, usernames. The breach dates from Mar 25, 2021; Have I Been Pwned loaded it on Dec 6, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","usernames"],"title":"KinoKong data breach: 817K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/kinokong-data-breach","vendor":"KinoKong"},{"auto":true,"category":"patch","closedAt":"2025-12-19","cveIds":["CVE-2025-55182"],"exploited":"in-the-wild","identifiers":["CVE-2025-55182"],"json":"https://helix.ml/threat-watch/i/meta-react-server-components-cve-2025-55182.json","latestUpdate":{"date":"2025-12-05","title":"CISA added CVE-2025-55182 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 12, 2025)"},"patchStatus":"patched","product":"React Server Components","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"meta-react-server-components-cve-2025-55182","stacks":[],"startedAt":"2025-12-05","status":"closed","summary":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog on Dec 5, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Meta React Server Components Remote Code Execution Vulnerability (CVE-2025-55182)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/meta-react-server-components-cve-2025-55182","vendor":"Meta"},{"auto":true,"category":"patch","closedAt":"2025-12-17","cveIds":["CVE-2021-26828"],"exploited":"in-the-wild","identifiers":["CVE-2021-26828"],"json":"https://helix.ml/threat-watch/i/openplc-scadabr-cve-2021-26828.json","latestUpdate":{"date":"2025-12-03","title":"CISA added CVE-2021-26828 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2025)"},"patchStatus":"patched","product":"ScadaBR","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"openplc-scadabr-cve-2021-26828","stacks":[],"startedAt":"2025-12-03","status":"closed","summary":"OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. CISA added CVE-2021-26828 to its Known Exploited Vulnerabilities catalog on Dec 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2021-26828)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/openplc-scadabr-cve-2021-26828","vendor":"OpenPLC"},{"auto":true,"category":"patch","closedAt":"2025-12-16","cveIds":["CVE-2025-48633"],"exploited":"in-the-wild","identifiers":["CVE-2025-48633"],"json":"https://helix.ml/threat-watch/i/android-framework-cve-2025-48633.json","latestUpdate":{"date":"2025-12-02","title":"CISA added CVE-2025-48633 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 23, 2025)"},"patchStatus":"patched","product":"Framework","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-framework-cve-2025-48633","stacks":["android"],"startedAt":"2025-12-02","status":"closed","summary":"Android Framework contains an unspecified vulnerability that allows for information disclosure. CISA added CVE-2025-48633 to its Known Exploited Vulnerabilities catalog on Dec 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Android Framework Information Disclosure Vulnerability (CVE-2025-48633)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/android-framework-cve-2025-48633","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2025-12-16","cveIds":["CVE-2025-48572"],"exploited":"in-the-wild","identifiers":["CVE-2025-48572"],"json":"https://helix.ml/threat-watch/i/android-framework-cve-2025-48572.json","latestUpdate":{"date":"2025-12-02","title":"CISA added CVE-2025-48572 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 23, 2025)"},"patchStatus":"unknown","product":"Framework","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-framework-cve-2025-48572","stacks":["android"],"startedAt":"2025-12-02","status":"closed","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2025-48572 to its Known Exploited Vulnerabilities catalog on Dec 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Android Framework Privilege Escalation Vulnerability (CVE-2025-48572)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/android-framework-cve-2025-48572","vendor":"Android"},{"auto":true,"category":"breach","closedAt":"2025-12-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZILVIA"],"json":"https://helix.ml/threat-watch/i/zilvia-data-breach.json","latestUpdate":{"date":"2025-12-01","title":"Have I Been Pwned loaded 287K breached Zilvia.net accounts"},"patchStatus":"no-fix-needed","product":"zilvia.net","severity":"high","severityNote":"287K accounts · passwords exposed","slug":"zilvia-data-breach","stacks":[],"startedAt":"2025-12-01","status":"closed","summary":"In November 2025, data breached from the Zilvia.net Nissan 240SX Silvia and Z Fairlady car forum was leaked. The breach exposed 288k unique email addresses along with usernames, IP addresses and salted MD5 password hashes sourced from the vBulletin based platform. Attempts to contact Zilvia.net about the incident were unsuccessful. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Nov 6, 2025; Have I Been Pwned loaded it on Dec 1, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Zilvia.net data breach: 287K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/zilvia-data-breach","vendor":"Zilvia.net"},{"auto":true,"category":"patch","closedAt":"2025-12-12","cveIds":["CVE-2021-26829"],"exploited":"in-the-wild","identifiers":["CVE-2021-26829"],"json":"https://helix.ml/threat-watch/i/openplc-scadabr-cve-2021-26829.json","latestUpdate":{"date":"2025-11-28","title":"CISA added CVE-2021-26829 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 19, 2025)"},"patchStatus":"unknown","product":"ScadaBR","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"openplc-scadabr-cve-2021-26829","stacks":[],"startedAt":"2025-11-28","status":"closed","summary":"OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm. CISA added CVE-2021-26829 to its Known Exploited Vulnerabilities catalog on Nov 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"OpenPLC ScadaBR Cross-site Scripting Vulnerability (CVE-2021-26829)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/openplc-scadabr-cve-2021-26829","vendor":"OpenPLC"},{"auto":true,"category":"breach","closedAt":"2025-12-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CSDN"],"json":"https://helix.ml/threat-watch/i/csdn-data-breach.json","latestUpdate":{"date":"2025-11-27","title":"Have I Been Pwned loaded 6.4M breached China Software Developer Network accounts"},"patchStatus":"no-fix-needed","product":"csdn.net","severity":"high","severityNote":"6.4M accounts · passwords exposed","slug":"csdn-data-breach","stacks":[],"startedAt":"2025-11-27","status":"closed","summary":"In 2011, the China Software Developer Network (CSDN) suffered a data breach that exposed over 6M user records. The data included email addresses alongside usernames and plain text passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 21, 2011; Have I Been Pwned loaded it on Nov 27, 2025.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"China Software Developer Network data breach: 6.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/csdn-data-breach","vendor":"China Software Developer Network"},{"auto":true,"category":"breach","closedAt":"2025-12-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADDA"],"json":"https://helix.ml/threat-watch/i/adda-data-breach.json","latestUpdate":{"date":"2025-11-23","title":"Have I Been Pwned loaded 1.8M breached ADDA accounts"},"patchStatus":"no-fix-needed","product":"adda.io","severity":"high","severityNote":"1.8M accounts · passwords exposed","slug":"adda-data-breach","stacks":[],"startedAt":"2025-11-23","status":"closed","summary":"In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum. The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes. Exposed data: email addresses, names, passwords, phone numbers. The breach dates from Mar 24, 2025; Have I Been Pwned loaded it on Nov 23, 2025.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers"],"title":"ADDA data breach: 1.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/adda-data-breach","vendor":"ADDA"},{"auto":true,"category":"breach","closedAt":"2025-12-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CODESTEPBYSTEP"],"json":"https://helix.ml/threat-watch/i/codestepbystep-data-breach.json","latestUpdate":{"date":"2025-11-23","title":"Have I Been Pwned loaded 103K breached CodeStepByStep accounts"},"patchStatus":"no-fix-needed","product":"codestepbystep.com","severity":"medium","severityNote":"103K accounts","slug":"codestepbystep-data-breach","stacks":[],"startedAt":"2025-11-23","status":"closed","summary":"In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records which were subsequently published online. The following month, a further corpus of data was released bringing the total to 103k. The impacted data included names, usernames and email addresses. Exposed data: email addresses, names, usernames. The breach dates from Nov 15, 2025; Have I Been Pwned loaded it on Nov 23, 2025.","tags":["data-breach","hibp","email-addresses","names","usernames"],"title":"CodeStepByStep data breach: 103K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/codestepbystep-data-breach","vendor":"CodeStepByStep"},{"auto":true,"category":"patch","closedAt":"2025-12-05","cveIds":["CVE-2025-61757"],"exploited":"in-the-wild","identifiers":["CVE-2025-61757"],"json":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2025-61757.json","latestUpdate":{"date":"2025-11-21","title":"CISA added CVE-2025-61757 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 12, 2025)"},"patchStatus":"unknown","product":"Fusion Middleware","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-fusion-middleware-cve-2025-61757","stacks":[],"startedAt":"2025-11-21","status":"closed","summary":"Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. CISA added CVE-2025-61757 to its Known Exploited Vulnerabilities catalog on Nov 21, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability (CVE-2025-61757)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2025-61757","vendor":"Oracle"},{"auto":true,"category":"breach","closedAt":"2025-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VULTR"],"json":"https://helix.ml/threat-watch/i/vultr-data-breach.json","latestUpdate":{"date":"2025-11-20","title":"Have I Been Pwned loaded 187K breached Vultr accounts"},"patchStatus":"no-fix-needed","product":"vultr.com","severity":"medium","severityNote":"187K accounts","slug":"vultr-data-breach","stacks":[],"startedAt":"2025-11-20","status":"closed","summary":"In March 2023, the \"AI-first global cloud platform\" Vultr disclosed a security incident at a third-party vendor. Dating back to the previous year, the incident was attributed to the ActiveCampaign email marketing service provider and resulted in the exposure of 188k unique email addresses. A small number of records also included name, IP address and country of origin. No Vultr systems or additional customer data were impacted. Vultr subsequently self-submitted the impacted data to HIBP. Exposed data: email addresses, geographic locations, ip addresses, names. The breach dates from Jul 8, 2022; Have I Been Pwned loaded it on Nov 20, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","names"],"title":"Vultr data breach: 187K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/vultr-data-breach","vendor":"Vultr"},{"auto":true,"category":"breach","closedAt":"2025-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EUROFIBER"],"json":"https://helix.ml/threat-watch/i/eurofiber-data-breach.json","latestUpdate":{"date":"2025-11-20","title":"Have I Been Pwned loaded 10K breached Eurofiber accounts"},"patchStatus":"no-fix-needed","product":"eurofiber.com","severity":"medium","severityNote":"10K accounts","slug":"eurofiber-data-breach","stacks":[],"startedAt":"2025-11-20","status":"closed","summary":"In November 2025, Eurofiber France disclosed a data breach of its ticket management platform. Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the breach alleges to have additional, more sensitive data including screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL backup files. Exposed data: email addresses, names, phone numbers. The breach dates from Nov 13, 2025; Have I Been Pwned loaded it on Nov 20, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers"],"title":"Eurofiber data breach: 10K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/eurofiber-data-breach","vendor":"Eurofiber"},{"auto":true,"category":"breach","closedAt":"2025-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BECKETT"],"json":"https://helix.ml/threat-watch/i/beckett-data-breach.json","latestUpdate":{"date":"2025-11-20","title":"Have I Been Pwned loaded 1.0M breached Beckett Collectibles accounts"},"patchStatus":"no-fix-needed","product":"beckett.com","severity":"medium","severityNote":"1.0M accounts","slug":"beckett-data-breach","stacks":[],"startedAt":"2025-11-20","status":"closed","summary":"In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data initially included more than 500k email addresses reportedly belonging to North American customers, before a larger corpus of over 1M addresses was published the following month. The impacted data included names, usernames, phone numbers and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses, usernames. The breach dates from Nov 9, 2025; Have I Been Pwned loaded it on Nov 20, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","usernames"],"title":"Beckett Collectibles data breach: 1.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/beckett-data-breach","vendor":"Beckett Collectibles"},{"auto":true,"category":"breach","closedAt":"2025-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IKO"],"json":"https://helix.ml/threat-watch/i/iko-data-breach.json","latestUpdate":{"date":"2025-11-20","title":"Have I Been Pwned loaded 340K breached International Kiteboarding Organization accounts"},"patchStatus":"no-fix-needed","product":"ikointl.com","severity":"medium","severityNote":"340K accounts","slug":"iko-data-breach","stacks":[],"startedAt":"2025-11-20","status":"closed","summary":"In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records. The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country. Exposed data: email addresses, geographic locations, names, usernames. The breach dates from Nov 11, 2025; Have I Been Pwned loaded it on Nov 20, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","usernames"],"title":"International Kiteboarding Organization data breach: 340K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/iko-data-breach","vendor":"International Kiteboarding Organization"},{"auto":true,"category":"patch","closedAt":"2025-12-03","cveIds":["CVE-2025-13223"],"exploited":"in-the-wild","identifiers":["CVE-2025-13223"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-13223.json","latestUpdate":{"date":"2025-11-19","title":"CISA added CVE-2025-13223 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 10, 2025)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2025-13223","stacks":["browser"],"startedAt":"2025-11-19","status":"closed","summary":"Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. CISA added CVE-2025-13223 to its Known Exploited Vulnerabilities catalog on Nov 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2025-13223)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-13223","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2025-12-02","cveIds":["CVE-2025-58034"],"exploited":"in-the-wild","identifiers":["CVE-2025-58034"],"json":"https://helix.ml/threat-watch/i/fortinet-fortiweb-cve-2025-58034.json","latestUpdate":{"date":"2025-11-18","title":"CISA added CVE-2025-58034 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 25, 2025)"},"patchStatus":"unknown","product":"FortiWeb","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortiweb-cve-2025-58034","stacks":["network"],"startedAt":"2025-11-18","status":"closed","summary":"Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. CISA added CVE-2025-58034 to its Known Exploited Vulnerabilities catalog on Nov 18, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Fortinet FortiWeb OS Command Injection Vulnerability (CVE-2025-58034)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-fortiweb-cve-2025-58034","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2025-11-28","cveIds":["CVE-2025-64446"],"exploited":"in-the-wild","identifiers":["CVE-2025-64446"],"json":"https://helix.ml/threat-watch/i/fortinet-fortiweb-cve-2025-64446.json","latestUpdate":{"date":"2025-11-14","title":"CISA added CVE-2025-64446 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 21, 2025)"},"patchStatus":"unknown","product":"FortiWeb","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortiweb-cve-2025-64446","stacks":["network"],"startedAt":"2025-11-14","status":"closed","summary":"Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities catalog on Nov 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-23"],"title":"Fortinet FortiWeb Path Traversal Vulnerability (CVE-2025-64446)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/fortinet-fortiweb-cve-2025-64446","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2025-11-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OPERATIONENDGAME3"],"json":"https://helix.ml/threat-watch/i/operationendgame3-data-breach.json","latestUpdate":{"date":"2025-11-13","title":"Have I Been Pwned loaded 2.0M breached Operation Endgame 3.0 accounts"},"patchStatus":"no-fix-needed","product":"Operation Endgame 3.0","severity":"high","severityNote":"2.0M accounts · passwords exposed","slug":"operationendgame3-data-breach","stacks":[],"startedAt":"2025-11-13","status":"closed","summary":"Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email addresses and 7.4 million passwords to HIBP. Exposed data: email addresses, passwords. The breach dates from Nov 13, 2025; Have I Been Pwned loaded it on Nov 13, 2025.","tags":["data-breach","hibp","malware","email-addresses","passwords"],"title":"Operation Endgame 3.0 data breach: 2.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/operationendgame3-data-breach","vendor":"Operation Endgame 3.0"},{"auto":true,"category":"patch","closedAt":"2025-11-26","cveIds":["CVE-2025-12480"],"exploited":"in-the-wild","identifiers":["CVE-2025-12480"],"json":"https://helix.ml/threat-watch/i/gladinet-triofox-cve-2025-12480.json","latestUpdate":{"date":"2025-11-12","title":"CISA added CVE-2025-12480 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2025)"},"patchStatus":"unknown","product":"Triofox","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"gladinet-triofox-cve-2025-12480","stacks":[],"startedAt":"2025-11-12","status":"closed","summary":"Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. CISA added CVE-2025-12480 to its Known Exploited Vulnerabilities catalog on Nov 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Gladinet Triofox Improper Access Control Vulnerability (CVE-2025-12480)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gladinet-triofox-cve-2025-12480","vendor":"Gladinet"},{"auto":true,"category":"patch","closedAt":"2025-11-26","cveIds":["CVE-2025-62215"],"exploited":"in-the-wild","identifiers":["CVE-2025-62215"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-62215.json","latestUpdate":{"date":"2025-11-12","title":"CISA added CVE-2025-62215 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-62215","stacks":["windows"],"startedAt":"2025-11-12","status":"closed","summary":"Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access. CISA added CVE-2025-62215 to its Known Exploited Vulnerabilities catalog on Nov 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-362"],"title":"Microsoft Windows Race Condition Vulnerability (CVE-2025-62215)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-62215","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-11-26","cveIds":["CVE-2025-9242"],"exploited":"in-the-wild","identifiers":["CVE-2025-9242"],"json":"https://helix.ml/threat-watch/i/watchguard-firebox-cve-2025-9242.json","latestUpdate":{"date":"2025-11-12","title":"CISA added CVE-2025-9242 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2025)"},"patchStatus":"unknown","product":"Firebox","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"watchguard-firebox-cve-2025-9242","stacks":[],"startedAt":"2025-11-12","status":"closed","summary":"WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code. CISA added CVE-2025-9242 to its Known Exploited Vulnerabilities catalog on Nov 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"WatchGuard Firebox Out-of-Bounds Write Vulnerability (CVE-2025-9242)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/watchguard-firebox-cve-2025-9242","vendor":"WatchGuard"},{"auto":true,"category":"patch","closedAt":"2025-11-24","cveIds":["CVE-2025-21042"],"exploited":"in-the-wild","identifiers":["CVE-2025-21042"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2025-21042.json","latestUpdate":{"date":"2025-11-10","title":"CISA added CVE-2025-21042 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 1, 2025)"},"patchStatus":"unknown","product":"Mobile Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2025-21042","stacks":[],"startedAt":"2025-11-10","status":"closed","summary":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code. CISA added CVE-2025-21042 to its Known Exploited Vulnerabilities catalog on Nov 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Samsung Mobile Devices Out-of-Bounds Write Vulnerability (CVE-2025-21042)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2025-21042","vendor":"Samsung"},{"auto":true,"category":"breach","closedAt":"2025-11-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TISZA"],"json":"https://helix.ml/threat-watch/i/tisza-data-breach.json","latestUpdate":{"date":"2025-11-08","title":"Have I Been Pwned loaded 198K breached TISZA Világ accounts"},"patchStatus":"no-fix-needed","product":"tiszavilag.hu","severity":"high","severityNote":"198K accounts","slug":"tisza-data-breach","stacks":[],"startedAt":"2025-11-08","status":"closed","summary":"In late October 2025, data breached from the Hungarian political party TISZA was published online before being extensively redistributed. Stemming from a compromise of the TISZA Világ service earlier in the month, the breach exposed 200k records of personal data including email addresses along with names, phone numbers and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses, usernames. The breach dates from Oct 6, 2025; Have I Been Pwned loaded it on Nov 8, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","usernames"],"title":"TISZA Világ data breach: 198K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tisza-data-breach","vendor":"TISZA Világ"},{"auto":true,"category":"breach","closedAt":"2025-11-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SYNTHIENTCREDENTIALSTUFFINGTHREATDATA"],"json":"https://helix.ml/threat-watch/i/synthientcredentialstuffingthreatdata-data-breach.json","latestUpdate":{"date":"2025-11-06","title":"Have I Been Pwned loaded 2.0B breached Synthient Credential Stuffing Threat Data accounts"},"patchStatus":"no-fix-needed","product":"Synthient Credential Stuffing Threat Data","severity":"critical","severityNote":"2.0B accounts · passwords exposed","slug":"synthientcredentialstuffingthreatdata-data-breach","stacks":[],"startedAt":"2025-11-06","status":"closed","summary":"During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. Working to turn breached data into awareness, Synthient partnered with HIBP to help victims of cybercrime understand their exposure. Exposed data: email addresses, passwords. The breach dates from Apr 11, 2025; Have I Been Pwned loaded it on Nov 6, 2025.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Synthient Credential Stuffing Threat Data data breach: 2.0B accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/synthientcredentialstuffingthreatdata-data-breach","vendor":"Synthient Credential Stuffing Threat Data"},{"auto":true,"category":"patch","closedAt":"2025-11-18","cveIds":["CVE-2025-48703"],"exploited":"in-the-wild","identifiers":["CVE-2025-48703"],"json":"https://helix.ml/threat-watch/i/cwp-control-web-panel-cve-2025-48703.json","latestUpdate":{"date":"2025-11-04","title":"CISA added CVE-2025-48703 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 25, 2025)"},"patchStatus":"unknown","product":"Control Web Panel","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cwp-control-web-panel-cve-2025-48703","stacks":["wordpress"],"startedAt":"2025-11-04","status":"closed","summary":"CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. CISA added CVE-2025-48703 to its Known Exploited Vulnerabilities catalog on Nov 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"CWP Control Web Panel OS Command Injection Vulnerability (CVE-2025-48703)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/cwp-control-web-panel-cve-2025-48703","vendor":"CWP"},{"auto":true,"category":"patch","closedAt":"2025-11-18","cveIds":["CVE-2025-11371"],"exploited":"in-the-wild","identifiers":["CVE-2025-11371"],"json":"https://helix.ml/threat-watch/i/gladinet-centrestack-and-triofox-cve-2025-11371.json","latestUpdate":{"date":"2025-11-04","title":"CISA added CVE-2025-11371 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 25, 2025)"},"patchStatus":"unknown","product":"CentreStack and Triofox","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"gladinet-centrestack-and-triofox-cve-2025-11371","stacks":[],"startedAt":"2025-11-04","status":"closed","summary":"Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files. CISA added CVE-2025-11371 to its Known Exploited Vulnerabilities catalog on Nov 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-552"],"title":"Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability (CVE-2025-11371)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gladinet-centrestack-and-triofox-cve-2025-11371","vendor":"Gladinet"},{"auto":true,"category":"patch","closedAt":"2025-11-13","cveIds":["CVE-2025-41244"],"exploited":"in-the-wild","identifiers":["CVE-2025-41244"],"json":"https://helix.ml/threat-watch/i/broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244.json","latestUpdate":{"date":"2025-10-30","title":"CISA added CVE-2025-41244 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 20, 2025)"},"patchStatus":"unknown","product":"VMware Aria Operations and VMware Tools","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244","stacks":["cloud"],"startedAt":"2025-10-30","status":"closed","summary":"Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. CISA added CVE-2025-41244 to its Known Exploited Vulnerabilities catalog on Oct 30, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-267"],"title":"Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability (CVE-2025-41244)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244","vendor":"Broadcom"},{"auto":true,"category":"patch","closedAt":"2025-11-13","cveIds":["CVE-2025-24893"],"exploited":"in-the-wild","identifiers":["CVE-2025-24893"],"json":"https://helix.ml/threat-watch/i/xwiki-platform-cve-2025-24893.json","latestUpdate":{"date":"2025-10-30","title":"CISA added CVE-2025-24893 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 20, 2025)"},"patchStatus":"patched","product":"Platform","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"xwiki-platform-cve-2025-24893","stacks":[],"startedAt":"2025-10-30","status":"closed","summary":"XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch. CISA added CVE-2025-24893 to its Known Exploited Vulnerabilities catalog on Oct 30, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-95"],"title":"XWiki Platform Eval Injection Vulnerability (CVE-2025-24893)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/xwiki-platform-cve-2025-24893","vendor":"XWiki"},{"auto":true,"category":"patch","closedAt":"2025-11-11","cveIds":["CVE-2025-6204"],"exploited":"in-the-wild","identifiers":["CVE-2025-6204"],"json":"https://helix.ml/threat-watch/i/dassault-syst-mes-delmia-apriso-cve-2025-6204.json","latestUpdate":{"date":"2025-10-28","title":"CISA added CVE-2025-6204 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 18, 2025)"},"patchStatus":"unknown","product":"DELMIA Apriso","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"dassault-syst-mes-delmia-apriso-cve-2025-6204","stacks":[],"startedAt":"2025-10-28","status":"closed","summary":"Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code. CISA added CVE-2025-6204 to its Known Exploited Vulnerabilities catalog on Oct 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Dassault Systèmes DELMIA Apriso Code Injection Vulnerability (CVE-2025-6204)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/dassault-syst-mes-delmia-apriso-cve-2025-6204","vendor":"Dassault Systèmes"},{"auto":true,"category":"patch","closedAt":"2025-11-11","cveIds":["CVE-2025-6205"],"exploited":"in-the-wild","identifiers":["CVE-2025-6205"],"json":"https://helix.ml/threat-watch/i/dassault-syst-mes-delmia-apriso-cve-2025-6205.json","latestUpdate":{"date":"2025-10-28","title":"CISA added CVE-2025-6205 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 18, 2025)"},"patchStatus":"unknown","product":"DELMIA Apriso","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"dassault-syst-mes-delmia-apriso-cve-2025-6205","stacks":[],"startedAt":"2025-10-28","status":"closed","summary":"Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application. CISA added CVE-2025-6205 to its Known Exploited Vulnerabilities catalog on Oct 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-862"],"title":"Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability (CVE-2025-6205)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/dassault-syst-mes-delmia-apriso-cve-2025-6205","vendor":"Dassault Systèmes"},{"auto":true,"category":"breach","closedAt":"2025-11-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYVIDSTER2025"],"json":"https://helix.ml/threat-watch/i/myvidster2025-data-breach.json","latestUpdate":{"date":"2025-10-27","title":"Have I Been Pwned loaded 3.9M breached MyVidster (2025) accounts"},"patchStatus":"no-fix-needed","product":"myvidster.com","severity":"medium","severityNote":"3.9M accounts","slug":"myvidster2025-data-breach","stacks":[],"startedAt":"2025-10-27","status":"closed","summary":"In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum. Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos. Exposed data: email addresses, profile photos, usernames. The breach dates from Oct 24, 2025; Have I Been Pwned loaded it on Oct 27, 2025.","tags":["data-breach","hibp","email-addresses","profile-photos","usernames"],"title":"MyVidster (2025) data breach: 3.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/myvidster2025-data-breach","vendor":"MyVidster (2025)"},{"auto":true,"category":"patch","closedAt":"2025-11-07","cveIds":["CVE-2025-54236"],"exploited":"in-the-wild","identifiers":["CVE-2025-54236"],"json":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2025-54236.json","latestUpdate":{"date":"2025-10-24","title":"CISA added CVE-2025-54236 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2025)"},"patchStatus":"unknown","product":"Commerce and Magento","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-commerce-and-magento-cve-2025-54236","stacks":["php"],"startedAt":"2025-10-24","status":"closed","summary":"Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. CISA added CVE-2025-54236 to its Known Exploited Vulnerabilities catalog on Oct 24, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Adobe Commerce and Magento Improper Input Validation Vulnerability (CVE-2025-54236)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2025-54236","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2025-11-07","cveIds":["CVE-2025-59287"],"exploited":"in-the-wild","identifiers":["CVE-2025-59287"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-59287.json","latestUpdate":{"date":"2025-10-24","title":"CISA added CVE-2025-59287 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-59287","stacks":["rust","windows"],"startedAt":"2025-10-24","status":"closed","summary":"Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution. CISA added CVE-2025-59287 to its Known Exploited Vulnerabilities catalog on Oct 24, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability (CVE-2025-59287)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-59287","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-11-05","cveIds":["CVE-2025-61932"],"exploited":"in-the-wild","identifiers":["CVE-2025-61932"],"json":"https://helix.ml/threat-watch/i/motex-lanscope-endpoint-manager-cve-2025-61932.json","latestUpdate":{"date":"2025-10-22","title":"CISA added CVE-2025-61932 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 12, 2025)"},"patchStatus":"unknown","product":"LANSCOPE Endpoint Manager","severity":"critical","severityNote":"CVSS 9.3 (v4.0) · exploited in the wild (CISA KEV)","slug":"motex-lanscope-endpoint-manager-cve-2025-61932","stacks":[],"startedAt":"2025-10-22","status":"closed","summary":"Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets. CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities catalog on Oct 22, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-940"],"title":"Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability (CVE-2025-61932)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/motex-lanscope-endpoint-manager-cve-2025-61932","vendor":"Motex"},{"auto":true,"category":"breach","closedAt":"2025-11-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SYNTHIENTSTEALERLOGTHREATDATA"],"json":"https://helix.ml/threat-watch/i/synthientstealerlogthreatdata-data-breach.json","latestUpdate":{"date":"2025-10-21","title":"Have I Been Pwned loaded 183.0M breached Synthient Stealer Log Threat Data accounts"},"patchStatus":"no-fix-needed","product":"Synthient Stealer Log Threat Data","severity":"critical","severityNote":"183.0M accounts · passwords exposed · infostealer logs","slug":"synthientstealerlogthreatdata-data-breach","stacks":[],"startedAt":"2025-10-21","status":"closed","summary":"During 2025, Synthient aggregated billions of records of \"threat data\" from various internet sources. The data contained 183M unique email addresses alongside the websites they were entered into and the passwords used. After normalising and deduplicating the data, 183 million unique email addresses remained, each linked to the website where the credentials were captured, and the password used. This dataset is now searchable in HIBP by email address, password, domain, and the site on which the credentials were entered. Exposed data: email addresses, passwords. The breach dates from Apr 11, 2025; Have I Been Pwned loaded it on Oct 21, 2025.","tags":["data-breach","hibp","stealer-log","email-addresses","passwords"],"title":"Synthient Stealer Log Threat Data data breach: 183.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/synthientstealerlogthreatdata-data-breach","vendor":"Synthient Stealer Log Threat Data"},{"auto":true,"category":"patch","closedAt":"2025-11-03","cveIds":["CVE-2022-48503"],"exploited":"in-the-wild","identifiers":["CVE-2022-48503"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2022-48503.json","latestUpdate":{"date":"2025-10-20","title":"CISA added CVE-2022-48503 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2022-48503","stacks":[],"startedAt":"2025-10-20","status":"closed","summary":"Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2022-48503 to its Known Exploited Vulnerabilities catalog on Oct 20, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Apple Multiple Products Unspecified Vulnerability (CVE-2022-48503)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2022-48503","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2025-11-03","cveIds":["CVE-2025-2746"],"exploited":"in-the-wild","identifiers":["CVE-2025-2746"],"json":"https://helix.ml/threat-watch/i/kentico-xperience-cms-cve-2025-2746.json","latestUpdate":{"date":"2025-10-20","title":"CISA added CVE-2025-2746 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2025)"},"patchStatus":"patched","product":"Xperience CMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"kentico-xperience-cms-cve-2025-2746","stacks":[],"startedAt":"2025-10-20","status":"closed","summary":"Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. CISA added CVE-2025-2746 to its Known Exploited Vulnerabilities catalog on Oct 20, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2025-2746)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/kentico-xperience-cms-cve-2025-2746","vendor":"Kentico"},{"auto":true,"category":"patch","closedAt":"2025-11-03","cveIds":["CVE-2025-2747"],"exploited":"in-the-wild","identifiers":["CVE-2025-2747"],"json":"https://helix.ml/threat-watch/i/kentico-xperience-cms-cve-2025-2747.json","latestUpdate":{"date":"2025-10-20","title":"CISA added CVE-2025-2747 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2025)"},"patchStatus":"patched","product":"Xperience CMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"kentico-xperience-cms-cve-2025-2747","stacks":[],"startedAt":"2025-10-20","status":"closed","summary":"Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. CISA added CVE-2025-2747 to its Known Exploited Vulnerabilities catalog on Oct 20, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2025-2747)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/kentico-xperience-cms-cve-2025-2747","vendor":"Kentico"},{"auto":true,"category":"patch","closedAt":"2025-11-03","cveIds":["CVE-2025-33073"],"exploited":"in-the-wild","identifiers":["CVE-2025-33073"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-33073.json","latestUpdate":{"date":"2025-10-20","title":"CISA added CVE-2025-33073 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-33073","stacks":["windows"],"startedAt":"2025-10-20","status":"closed","summary":"Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. CISA added CVE-2025-33073 to its Known Exploited Vulnerabilities catalog on Oct 20, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-284"],"title":"Microsoft Windows SMB Client Improper Access Control Vulnerability (CVE-2025-33073)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-33073","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-11-03","cveIds":["CVE-2025-61884"],"exploited":"in-the-wild","identifiers":["CVE-2025-61884"],"json":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2025-61884.json","latestUpdate":{"date":"2025-10-20","title":"CISA added CVE-2025-61884 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2025)"},"patchStatus":"unknown","product":"E-Business Suite","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-e-business-suite-cve-2025-61884","stacks":[],"startedAt":"2025-10-20","status":"closed","summary":"Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. CISA added CVE-2025-61884 to its Known Exploited Vulnerabilities catalog on Oct 20, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","ssrf","cwe-918"],"title":"Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-61884)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2025-61884","vendor":"Oracle"},{"auto":true,"category":"breach","closedAt":"2025-10-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROSPER"],"json":"https://helix.ml/threat-watch/i/prosper-data-breach.json","latestUpdate":{"date":"2025-10-16","title":"Have I Been Pwned loaded 17.6M breached Prosper accounts"},"patchStatus":"no-fix-needed","product":"prosper.com","severity":"medium","severityNote":"17.6M accounts","slug":"prosper-data-breach","stacks":[],"startedAt":"2025-10-16","status":"closed","summary":"In September 2025, Prosper announced that it had detected unauthorised access to their systems, which resulted in the exposure of customer and applicant information. The data breach impacted 17.6M unique email addresses, along with other customer information, including US Social Security numbers. Prosper advised that they did not find any evidence of unauthorised access to customer accounts and funds, and that their customer-facing operations were uninterrupted. Further information about the incident is contained in Prosper's FAQs. Exposed data: browser user agent details, credit status information, dates of birth, email addresses, employment statuses, government issued ids, income levels, ip addresses, names, physical addresses. The breach dates from Sep 1, 2025; Have I Been Pwned loaded it on Oct 16, 2025.","tags":["data-breach","hibp","browser-user-agent-details","credit-status-information","dates-of-birth","email-addresses","employment-statuses","government-issued-ids","income-levels","ip-addresses","names","physical-addresses"],"title":"Prosper data breach: 17.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/prosper-data-breach","vendor":"Prosper"},{"auto":true,"category":"patch","closedAt":"2025-10-29","cveIds":["CVE-2025-54253"],"exploited":"in-the-wild","identifiers":["CVE-2025-54253"],"json":"https://helix.ml/threat-watch/i/adobe-experience-manager-aem-forms-cve-2025-54253.json","latestUpdate":{"date":"2025-10-15","title":"CISA added CVE-2025-54253 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 5, 2025)"},"patchStatus":"unknown","product":"Experience Manager (AEM) Forms","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-experience-manager-aem-forms-cve-2025-54253","stacks":[],"startedAt":"2025-10-15","status":"closed","summary":"Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. CISA added CVE-2025-54253 to its Known Exploited Vulnerabilities catalog on Oct 15, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Adobe Experience Manager Forms Code Execution Vulnerability (CVE-2025-54253)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adobe-experience-manager-aem-forms-cve-2025-54253","vendor":"Adobe"},{"auto":true,"category":"breach","closedAt":"2025-10-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HELLOCAKE"],"json":"https://helix.ml/threat-watch/i/hellocake-data-breach.json","latestUpdate":{"date":"2025-10-15","title":"Have I Been Pwned loaded 22K breached Hello Cake accounts"},"patchStatus":"no-fix-needed","product":"hellocake.com","severity":"high","severityNote":"22K accounts","slug":"hellocake-data-breach","stacks":[],"startedAt":"2025-10-15","status":"closed","summary":"In July 2025, the sexual healthcare product maker Hello Cake suffered a data breach. The data was subsequently posted on a public hacking forum and included 23k unique email addresses along with names, phone numbers, physical addresses, dates of birth and purchases. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses, purchases. The breach dates from Jul 25, 2025; Have I Been Pwned loaded it on Oct 15, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"Hello Cake data breach: 22K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/hellocake-data-breach","vendor":"Hello Cake"},{"auto":true,"category":"patch","closedAt":"2025-10-28","cveIds":["CVE-2025-47827"],"exploited":"in-the-wild","identifiers":["CVE-2025-47827"],"json":"https://helix.ml/threat-watch/i/igel-igel-os-cve-2025-47827.json","latestUpdate":{"date":"2025-10-14","title":"CISA added CVE-2025-47827 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 4, 2025)"},"patchStatus":"unknown","product":"IGEL OS","severity":"medium","severityNote":"CVSS 4.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"igel-igel-os-cve-2025-47827","stacks":[],"startedAt":"2025-10-14","status":"closed","summary":"IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. CISA added CVE-2025-47827 to its Known Exploited Vulnerabilities catalog on Oct 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-324"],"title":"IGEL OS Use of a Key Past its Expiration Date Vulnerability (CVE-2025-47827)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/igel-igel-os-cve-2025-47827","vendor":"IGEL"},{"auto":true,"category":"patch","closedAt":"2025-10-28","cveIds":["CVE-2025-24990"],"exploited":"in-the-wild","identifiers":["CVE-2025-24990"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24990.json","latestUpdate":{"date":"2025-10-14","title":"CISA added CVE-2025-24990 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 4, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-24990","stacks":["rust","windows"],"startedAt":"2025-10-14","status":"closed","summary":"Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges. CISA added CVE-2025-24990 to its Known Exploited Vulnerabilities catalog on Oct 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-822"],"title":"Microsoft Windows Untrusted Pointer Dereference Vulnerability (CVE-2025-24990)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24990","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-10-28","cveIds":["CVE-2025-59230"],"exploited":"in-the-wild","identifiers":["CVE-2025-59230"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-59230.json","latestUpdate":{"date":"2025-10-14","title":"CISA added CVE-2025-59230 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 4, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-59230","stacks":["windows"],"startedAt":"2025-10-14","status":"closed","summary":"Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally. CISA added CVE-2025-59230 to its Known Exploited Vulnerabilities catalog on Oct 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Microsoft Windows Improper Access Control Vulnerability (CVE-2025-59230)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-59230","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-10-28","cveIds":["CVE-2016-7836"],"exploited":"in-the-wild","identifiers":["CVE-2016-7836"],"json":"https://helix.ml/threat-watch/i/skysea-client-view-cve-2016-7836.json","latestUpdate":{"date":"2025-10-14","title":"CISA added CVE-2016-7836 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 4, 2025)"},"patchStatus":"unknown","product":"Client View","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"skysea-client-view-cve-2016-7836","stacks":[],"startedAt":"2025-10-14","status":"closed","summary":"SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. CISA added CVE-2016-7836 to its Known Exploited Vulnerabilities catalog on Oct 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-287"],"title":"SKYSEA Client View Improper Authentication Vulnerability (CVE-2016-7836)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/skysea-client-view-cve-2016-7836","vendor":"SKYSEA"},{"auto":true,"category":"breach","closedAt":"2025-10-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VIETNAMAIRLINES"],"json":"https://helix.ml/threat-watch/i/vietnamairlines-data-breach.json","latestUpdate":{"date":"2025-10-11","title":"Have I Been Pwned loaded 7.3M breached Vietnam Airlines accounts"},"patchStatus":"no-fix-needed","product":"vietnamairlines.com","severity":"medium","severityNote":"7.3M accounts","slug":"vietnamairlines-data-breach","stacks":[],"startedAt":"2025-10-11","status":"closed","summary":"In October 2025, data stolen from the Salesforce instances of multiple companies by a hacking group calling itself \"Scattered LAPSUS$ Hunters\" was publicly released. Among the affected organisations was Vietnam Airlines, which had 7.3M unique customer email addresses exposed following a breach of its Salesforce environment in June of that year. The compromised data also included names, phone numbers, dates of birth, and loyalty program membership numbers. Exposed data: dates of birth, email addresses, loyalty program details, names, phone numbers. The breach dates from Jun 20, 2025; Have I Been Pwned loaded it on Oct 11, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","loyalty-program-details","names","phone-numbers"],"title":"Vietnam Airlines data breach: 7.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/vietnamairlines-data-breach","vendor":"Vietnam Airlines"},{"auto":true,"category":"patch","closedAt":"2025-10-23","cveIds":["CVE-2021-43798"],"exploited":"in-the-wild","identifiers":["CVE-2021-43798"],"json":"https://helix.ml/threat-watch/i/grafana-labs-grafana-cve-2021-43798.json","latestUpdate":{"date":"2025-10-09","title":"CISA added CVE-2021-43798 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 30, 2025)"},"patchStatus":"patched","product":"Grafana","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"grafana-labs-grafana-cve-2021-43798","stacks":[],"startedAt":"2025-10-09","status":"closed","summary":"Grafana contains a path traversal vulnerability that could allow access to local files. CISA added CVE-2021-43798 to its Known Exploited Vulnerabilities catalog on Oct 9, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Grafana Path Traversal Vulnerability (CVE-2021-43798)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/grafana-labs-grafana-cve-2021-43798","vendor":"Grafana Labs"},{"auto":true,"category":"patch","closedAt":"2025-10-21","cveIds":["CVE-2025-27915"],"exploited":"in-the-wild","identifiers":["CVE-2025-27915"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-27915.json","latestUpdate":{"date":"2025-10-07","title":"CISA added CVE-2025-27915 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 28, 2025)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2025-27915","stacks":[],"startedAt":"2025-10-07","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration. CISA added CVE-2025-27915 to its Known Exploited Vulnerabilities catalog on Oct 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (CVE-2025-27915)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-27915","vendor":"Synacor"},{"auto":true,"category":"breach","closedAt":"2025-10-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADPOST"],"json":"https://helix.ml/threat-watch/i/adpost-data-breach.json","latestUpdate":{"date":"2025-10-07","title":"Have I Been Pwned loaded 3.3M breached Adpost accounts"},"patchStatus":"no-fix-needed","product":"adpost.com","severity":"medium","severityNote":"3.3M accounts","slug":"adpost-data-breach","stacks":[],"startedAt":"2025-10-07","status":"closed","summary":"In February 2025, data obtained from an earlier Adpost breach surfaced. The dataset contained 3.3M records including email addresses, usernames, and display names. Adpost later published a disclosure notice and advised they'd forced a credential refresh, among other actions. Exposed data: email addresses, names, usernames. The breach dates from Feb 14, 2025; Have I Been Pwned loaded it on Oct 7, 2025.","tags":["data-breach","hibp","email-addresses","names","usernames"],"title":"Adpost data breach: 3.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/adpost-data-breach","vendor":"Adpost"},{"auto":true,"category":"patch","closedAt":"2025-10-20","cveIds":["CVE-2021-22555"],"exploited":"in-the-wild","identifiers":["CVE-2021-22555"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2021-22555.json","latestUpdate":{"date":"2025-10-06","title":"CISA added CVE-2021-22555 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2025)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2021-22555","stacks":["linux"],"startedAt":"2025-10-06","status":"closed","summary":"Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. CISA added CVE-2021-22555 to its Known Exploited Vulnerabilities catalog on Oct 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Linux Kernel Heap Out-of-Bounds Write Vulnerability (CVE-2021-22555)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2021-22555","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2025-10-20","cveIds":["CVE-2010-3962"],"exploited":"in-the-wild","identifiers":["CVE-2010-3962"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2010-3962.json","latestUpdate":{"date":"2025-10-06","title":"CISA added CVE-2010-3962 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2025)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2010-3962","stacks":["browser","windows"],"startedAt":"2025-10-06","status":"closed","summary":"Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2010-3962 to its Known Exploited Vulnerabilities catalog on Oct 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption"],"title":"Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability (CVE-2010-3962)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2010-3962","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-10-20","cveIds":["CVE-2021-43226"],"exploited":"in-the-wild","identifiers":["CVE-2021-43226"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-43226.json","latestUpdate":{"date":"2025-10-06","title":"CISA added CVE-2021-43226 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-43226","stacks":["windows"],"startedAt":"2025-10-06","status":"closed","summary":"Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms. CISA added CVE-2021-43226 to its Known Exploited Vulnerabilities catalog on Oct 6, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2021-43226)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-43226","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-10-20","cveIds":["CVE-2013-3918"],"exploited":"in-the-wild","identifiers":["CVE-2013-3918"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2013-3918.json","latestUpdate":{"date":"2025-10-06","title":"CISA added CVE-2013-3918 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2013-3918","stacks":["windows"],"startedAt":"2025-10-06","status":"closed","summary":"Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2013-3918 to its Known Exploited Vulnerabilities catalog on Oct 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption"],"title":"Microsoft Windows Out-of-Bounds Write Vulnerability (CVE-2013-3918)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2013-3918","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-10-20","cveIds":["CVE-2011-3402"],"exploited":"in-the-wild","identifiers":["CVE-2011-3402"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2011-3402.json","latestUpdate":{"date":"2025-10-06","title":"CISA added CVE-2011-3402 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2011-3402","stacks":["windows"],"startedAt":"2025-10-06","status":"closed","summary":"Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. CISA added CVE-2011-3402 to its Known Exploited Vulnerabilities catalog on Oct 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Windows Remote Code Execution Vulnerability (CVE-2011-3402)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2011-3402","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-10-20","cveIds":["CVE-2010-3765"],"exploited":"in-the-wild","identifiers":["CVE-2010-3765"],"json":"https://helix.ml/threat-watch/i/mozilla-multiple-products-cve-2010-3765.json","latestUpdate":{"date":"2025-10-06","title":"CISA added CVE-2010-3765 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-multiple-products-cve-2010-3765","stacks":[],"startedAt":"2025-10-06","status":"closed","summary":"Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption. CISA added CVE-2010-3765 to its Known Exploited Vulnerabilities catalog on Oct 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption"],"title":"Mozilla Multiple Products Remote Code Execution Vulnerability (CVE-2010-3765)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/mozilla-multiple-products-cve-2010-3765","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2025-10-20","cveIds":["CVE-2025-61882"],"exploited":"in-the-wild","identifiers":["CVE-2025-61882"],"json":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2025-61882.json","latestUpdate":{"date":"2025-10-06","title":"CISA added CVE-2025-61882 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2025)"},"patchStatus":"unknown","product":"E-Business Suite","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-e-business-suite-cve-2025-61882","stacks":[],"startedAt":"2025-10-06","status":"closed","summary":"Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing. CISA added CVE-2025-61882 to its Known Exploited Vulnerabilities catalog on Oct 6, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Oracle E-Business Suite Unspecified Vulnerability (CVE-2025-61882)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2025-61882","vendor":"Oracle"},{"auto":true,"category":"breach","closedAt":"2025-10-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ARTISTSNCLIENTS"],"json":"https://helix.ml/threat-watch/i/artistsnclients-data-breach.json","latestUpdate":{"date":"2025-10-04","title":"Have I Been Pwned loaded 95K breached Artists\u0026Clients accounts"},"patchStatus":"no-fix-needed","product":"artistsnclients.com","severity":"high","severityNote":"95K accounts · passwords exposed","slug":"artistsnclients-data-breach","stacks":[],"startedAt":"2025-10-04","status":"closed","summary":"In August 2025, the \"marketplace that connects artists to prospective clients\" Artists\u0026Clients, suffered a data breach and subsequent ransom demand of US$50k. The data was subsequently leaked publicly and included 95k unique email addresses alongside usernames, IP addresses and bcrypt password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Aug 31, 2025; Have I Been Pwned loaded it on Oct 4, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Artists\u0026Clients data breach: 95K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/artistsnclients-data-breach","vendor":"Artists\u0026Clients"},{"auto":true,"category":"breach","closedAt":"2025-10-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LATESTPILOTJOBS"],"json":"https://helix.ml/threat-watch/i/latestpilotjobs-data-breach.json","latestUpdate":{"date":"2025-10-03","title":"Have I Been Pwned loaded 118K breached Latest Pilot Jobs accounts"},"patchStatus":"no-fix-needed","product":"latestpilotjobs.com","severity":"high","severityNote":"118K accounts · passwords exposed","slug":"latestpilotjobs-data-breach","stacks":[],"startedAt":"2025-10-03","status":"closed","summary":"In August 2022, the Latest Pilot Jobs website suffered a data breach that later appeared on a popular hacking forum before being redistributed as part of a larger corpus of data. The data included 119k unique email addresses along with names, usernames and unsalted MD5 password hashes. Exposed data: email addresses, names, passwords, usernames. The breach dates from Aug 14, 2022; Have I Been Pwned loaded it on Oct 3, 2025.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"Latest Pilot Jobs data breach: 118K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/latestpilotjobs-data-breach","vendor":"Latest Pilot Jobs"},{"auto":true,"category":"breach","closedAt":"2025-10-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOMEREFILL"],"json":"https://helix.ml/threat-watch/i/homerefill-data-breach.json","latestUpdate":{"date":"2025-10-03","title":"Have I Been Pwned loaded 187K breached HomeRefill accounts"},"patchStatus":"no-fix-needed","product":"homerefill.com.br","severity":"high","severityNote":"187K accounts · passwords exposed","slug":"homerefill-data-breach","stacks":[],"startedAt":"2025-10-03","status":"closed","summary":"In April 2020, now defunct Brazilian e-commerce platform HomeRefill suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 187k unique email addresses along with names, phone numbers, dates of birth and salted password hashes. Exposed data: dates of birth, email addresses, names, passwords, phone numbers. The breach dates from Apr 2, 2020; Have I Been Pwned loaded it on Oct 3, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers"],"title":"HomeRefill data breach: 187K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/homerefill-data-breach","vendor":"HomeRefill"},{"auto":true,"category":"patch","closedAt":"2025-10-16","cveIds":["CVE-2014-6278"],"exploited":"in-the-wild","identifiers":["CVE-2014-6278"],"json":"https://helix.ml/threat-watch/i/gnu-gnu-bash-cve-2014-6278.json","latestUpdate":{"date":"2025-10-02","title":"CISA added CVE-2014-6278 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2025)"},"patchStatus":"patched","product":"GNU Bash","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gnu-gnu-bash-cve-2014-6278","stacks":[],"startedAt":"2025-10-02","status":"closed","summary":"GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment. CISA added CVE-2014-6278 to its Known Exploited Vulnerabilities catalog on Oct 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"GNU Bash OS Command Injection Vulnerability (CVE-2014-6278)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/gnu-gnu-bash-cve-2014-6278","vendor":"GNU"},{"auto":true,"category":"patch","closedAt":"2025-10-16","cveIds":["CVE-2017-1000353"],"exploited":"in-the-wild","identifiers":["CVE-2017-1000353"],"json":"https://helix.ml/threat-watch/i/jenkins-jenkins-cve-2017-1000353.json","latestUpdate":{"date":"2025-10-02","title":"CISA added CVE-2017-1000353 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2025)"},"patchStatus":"patched","product":"Jenkins","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jenkins-jenkins-cve-2017-1000353","stacks":["devtools"],"startedAt":"2025-10-02","status":"closed","summary":"Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. CISA added CVE-2017-1000353 to its Known Exploited Vulnerabilities catalog on Oct 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Jenkins Remote Code Execution Vulnerability (CVE-2017-1000353)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/jenkins-jenkins-cve-2017-1000353","vendor":"Jenkins"},{"auto":true,"category":"patch","closedAt":"2025-10-16","cveIds":["CVE-2015-7755"],"exploited":"in-the-wild","identifiers":["CVE-2015-7755"],"json":"https://helix.ml/threat-watch/i/juniper-screenos-cve-2015-7755.json","latestUpdate":{"date":"2025-10-02","title":"CISA added CVE-2015-7755 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2025)"},"patchStatus":"unknown","product":"ScreenOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-screenos-cve-2015-7755","stacks":["network"],"startedAt":"2025-10-02","status":"closed","summary":"Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device. CISA added CVE-2015-7755 to its Known Exploited Vulnerabilities catalog on Oct 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Juniper ScreenOS Improper Authentication Vulnerability (CVE-2015-7755)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/juniper-screenos-cve-2015-7755","vendor":"Juniper"},{"auto":true,"category":"patch","closedAt":"2025-10-16","cveIds":["CVE-2025-21043"],"exploited":"in-the-wild","identifiers":["CVE-2025-21043"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2025-21043.json","latestUpdate":{"date":"2025-10-02","title":"CISA added CVE-2025-21043 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2025)"},"patchStatus":"unknown","product":"Mobile Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2025-21043","stacks":[],"startedAt":"2025-10-02","status":"closed","summary":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code. CISA added CVE-2025-21043 to its Known Exploited Vulnerabilities catalog on Oct 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Samsung Mobile Devices Out-of-Bounds Write Vulnerability (CVE-2025-21043)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2025-21043","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2025-10-16","cveIds":["CVE-2025-4008"],"exploited":"in-the-wild","identifiers":["CVE-2025-4008"],"json":"https://helix.ml/threat-watch/i/smartbedded-meteobridge-cve-2025-4008.json","latestUpdate":{"date":"2025-10-02","title":"CISA added CVE-2025-4008 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2025)"},"patchStatus":"unknown","product":"Meteobridge","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"smartbedded-meteobridge-cve-2025-4008","stacks":[],"startedAt":"2025-10-02","status":"closed","summary":"Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices. CISA added CVE-2025-4008 to its Known Exploited Vulnerabilities catalog on Oct 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-306","cwe-77"],"title":"Smartbedded Meteobridge Command Injection Vulnerability (CVE-2025-4008)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/smartbedded-meteobridge-cve-2025-4008","vendor":"Smartbedded"},{"auto":true,"category":"patch","closedAt":"2025-10-13","cveIds":["CVE-2021-21311"],"exploited":"in-the-wild","identifiers":["CVE-2021-21311"],"json":"https://helix.ml/threat-watch/i/adminer-adminer-cve-2021-21311.json","latestUpdate":{"date":"2025-09-29","title":"CISA added CVE-2021-21311 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 20, 2025)"},"patchStatus":"patched","product":"Adminer","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"adminer-adminer-cve-2021-21311","stacks":[],"startedAt":"2025-09-29","status":"closed","summary":"Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. CISA added CVE-2021-21311 to its Known Exploited Vulnerabilities catalog on Sep 29, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918"],"title":"Adminer Server-Side Request Forgery Vulnerability (CVE-2021-21311)","updatedAt":"2026-10-25T09:11:41Z","url":"https://helix.ml/threat-watch/i/adminer-adminer-cve-2021-21311","vendor":"Adminer"},{"auto":true,"category":"patch","closedAt":"2025-10-13","cveIds":["CVE-2025-32463"],"exploited":"in-the-wild","identifiers":["CVE-2025-32463"],"json":"https://helix.ml/threat-watch/i/sudo-sudo-cve-2025-32463.json","latestUpdate":{"date":"2025-09-29","title":"CISA added CVE-2025-32463 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 20, 2025)"},"patchStatus":"unknown","product":"Sudo","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sudo-sudo-cve-2025-32463","stacks":["linux","rust"],"startedAt":"2025-09-29","status":"closed","summary":"Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. CISA added CVE-2025-32463 to its Known Exploited Vulnerabilities catalog on Sep 29, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-829"],"title":"Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2025-32463)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sudo-sudo-cve-2025-32463","vendor":"Sudo"},{"auto":true,"category":"patch","closedAt":"2025-10-13","cveIds":["CVE-2025-59689"],"exploited":"in-the-wild","identifiers":["CVE-2025-59689"],"json":"https://helix.ml/threat-watch/i/libraesva-email-security-gateway-cve-2025-59689.json","latestUpdate":{"date":"2025-09-29","title":"CISA added CVE-2025-59689 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 20, 2025)"},"patchStatus":"unknown","product":"Email Security Gateway","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"libraesva-email-security-gateway-cve-2025-59689","stacks":[],"startedAt":"2025-09-29","status":"closed","summary":"Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment. CISA added CVE-2025-59689 to its Known Exploited Vulnerabilities catalog on Sep 29, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Libraesva Email Security Gateway Command Injection Vulnerability (CVE-2025-59689)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/libraesva-email-security-gateway-cve-2025-59689","vendor":"Libraesva"},{"auto":true,"category":"patch","closedAt":"2025-10-13","cveIds":["CVE-2025-10035"],"exploited":"in-the-wild","identifiers":["CVE-2025-10035"],"json":"https://helix.ml/threat-watch/i/fortra-goanywhere-mft-cve-2025-10035.json","latestUpdate":{"date":"2025-09-29","title":"CISA added CVE-2025-10035 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 20, 2025)"},"patchStatus":"unknown","product":"GoAnywhere MFT","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortra-goanywhere-mft-cve-2025-10035","stacks":["rust"],"startedAt":"2025-09-29","status":"closed","summary":"Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. CISA added CVE-2025-10035 to its Known Exploited Vulnerabilities catalog on Sep 29, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502","cwe-77"],"title":"Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability (CVE-2025-10035)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortra-goanywhere-mft-cve-2025-10035","vendor":"Fortra"},{"auto":true,"category":"patch","closedAt":"2025-10-13","cveIds":["CVE-2025-20352"],"exploited":"in-the-wild","identifiers":["CVE-2025-20352"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2025-20352.json","latestUpdate":{"date":"2025-09-29","title":"CISA added CVE-2025-20352 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 20, 2025)"},"patchStatus":"unknown","product":"IOS and IOS XE","severity":"high","severityNote":"CVSS 7.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-cve-2025-20352","stacks":["ios","network"],"startedAt":"2025-09-29","status":"closed","summary":"Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. CISA added CVE-2025-20352 to its Known Exploited Vulnerabilities catalog on Sep 29, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-121"],"title":"Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability (CVE-2025-20352)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2025-20352","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2025-10-09","cveIds":["CVE-2025-20362"],"exploited":"in-the-wild","identifiers":["CVE-2025-20362"],"json":"https://helix.ml/threat-watch/i/cisco-secure-firewall-adaptive-security-appliance-and-secure-firewall-threat-defense-cve-2025-20362.json","latestUpdate":{"date":"2025-09-25","title":"CISA added CVE-2025-20362 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 26, 2025)"},"patchStatus":"unknown","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-firewall-adaptive-security-appliance-and-secure-firewall-threat-defense-cve-2025-20362","stacks":["network"],"startedAt":"2025-09-25","status":"closed","summary":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. CISA added CVE-2025-20362 to its Known Exploited Vulnerabilities catalog on Sep 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-862"],"title":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability (CVE-2025-20362)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-secure-firewall-adaptive-security-appliance-and-secure-firewall-threat-defense-cve-2025-20362","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2025-10-09","cveIds":["CVE-2025-20333"],"exploited":"in-the-wild","identifiers":["CVE-2025-20333"],"json":"https://helix.ml/threat-watch/i/cisco-secure-firewall-adaptive-security-appliance-and-secure-firewall-threat-defense-cve-2025-20333.json","latestUpdate":{"date":"2025-09-25","title":"CISA added CVE-2025-20333 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 26, 2025)"},"patchStatus":"unknown","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-firewall-adaptive-security-appliance-and-secure-firewall-threat-defense-cve-2025-20333","stacks":["network"],"startedAt":"2025-09-25","status":"closed","summary":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. CISA added CVE-2025-20333 to its Known Exploited Vulnerabilities catalog on Sep 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-120"],"title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability (CVE-2025-20333)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-secure-firewall-adaptive-security-appliance-and-secure-firewall-threat-defense-cve-2025-20333","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2025-10-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CULTURA"],"json":"https://helix.ml/threat-watch/i/cultura-data-breach.json","latestUpdate":{"date":"2025-09-25","title":"Have I Been Pwned loaded 1.5M breached Cultura accounts"},"patchStatus":"no-fix-needed","product":"cultura.com","severity":"medium","severityNote":"1.5M accounts","slug":"cultura-data-breach","stacks":[],"startedAt":"2025-09-25","status":"closed","summary":"In September 2024, French retailer Cultura was the victim of a cyber attack they attributed to an external IT service provider. The resultant data breach included almost 1.5M unique email addresses along with names, phone numbers, physical addresses and orders. Cultura advised that all affected customers had been notified about the incident. Exposed data: email addresses, names, phone numbers, physical addresses, purchases. The breach dates from Sep 6, 2024; Have I Been Pwned loaded it on Sep 25, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"Cultura data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cultura-data-breach","vendor":"Cultura"},{"auto":true,"category":"breach","closedAt":"2025-10-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOUYGUESTELECOM"],"json":"https://helix.ml/threat-watch/i/bouyguestelecom-data-breach.json","latestUpdate":{"date":"2025-09-24","title":"Have I Been Pwned loaded 5.7M breached Bouygues Telecom accounts"},"patchStatus":"no-fix-needed","product":"bouyguestelecom.fr","severity":"high","severityNote":"5.7M accounts · financial data exposed","slug":"bouyguestelecom-data-breach","stacks":[],"startedAt":"2025-09-24","status":"closed","summary":"In August 2025, the French telecommunications company Bouygues Telecom detected a cyber attack against their services. The incident resulted in a data breach that exposed almost 6.4M customer records, including 5.7M unique email addresses. The breach also exposed names, physical addresses, phone numbers, dates of birth and IBANs (International Bank Account Numbers). Bouygues Telecom advised that all affected customers had been notified about the incident. Exposed data: bank account numbers, dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Aug 4, 2025; Have I Been Pwned loaded it on Sep 24, 2025.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses"],"title":"Bouygues Telecom data breach: 5.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bouyguestelecom-data-breach","vendor":"Bouygues Telecom"},{"auto":true,"category":"patch","closedAt":"2025-10-07","cveIds":["CVE-2025-10585"],"exploited":"in-the-wild","identifiers":["CVE-2025-10585"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-10585.json","latestUpdate":{"date":"2025-09-23","title":"CISA added CVE-2025-10585 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 14, 2025)"},"patchStatus":"unknown","product":"Chromium V8","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2025-10585","stacks":["browser"],"startedAt":"2025-09-23","status":"closed","summary":"Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. CISA added CVE-2025-10585 to its Known Exploited Vulnerabilities catalog on Sep 23, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2025-10585)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-10585","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2025-10-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANIMEIFY"],"json":"https://helix.ml/threat-watch/i/animeify-data-breach.json","latestUpdate":{"date":"2025-09-21","title":"Have I Been Pwned loaded 808K breached Animeify accounts"},"patchStatus":"no-fix-needed","product":"animeify.net","severity":"high","severityNote":"808K accounts · passwords exposed","slug":"animeify-data-breach","stacks":[],"startedAt":"2025-09-21","status":"closed","summary":"In October 2021, the now defunct Arabic language Anime website Animeify suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 808k unique email addresses along with names, usernames, genders and plain text passwords. Exposed data: email addresses, genders, names, passwords, usernames. The breach dates from Oct 14, 2021; Have I Been Pwned loaded it on Sep 21, 2025.","tags":["data-breach","hibp","email-addresses","genders","names","passwords","usernames"],"title":"Animeify data breach: 808K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/animeify-data-breach","vendor":"Animeify"},{"auto":true,"category":"breach","closedAt":"2025-10-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FREEONES"],"json":"https://helix.ml/threat-watch/i/freeones-data-breach.json","latestUpdate":{"date":"2025-09-18","title":"Have I Been Pwned loaded 960K breached FreeOnes accounts"},"patchStatus":"no-fix-needed","product":"freeones.com","severity":"high","severityNote":"960K accounts · passwords exposed","slug":"freeones-data-breach","stacks":[],"startedAt":"2025-09-18","status":"closed","summary":"In February 2017, the forum for the adult website FreeOnes suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 960k unique email addresses alongside usernames, IP addresses and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Feb 16, 2017; Have I Been Pwned loaded it on Sep 18, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"FreeOnes data breach: 960K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/freeones-data-breach","vendor":"FreeOnes"},{"auto":true,"category":"breach","closedAt":"2025-09-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MILJODATA"],"json":"https://helix.ml/threat-watch/i/miljodata-data-breach.json","latestUpdate":{"date":"2025-09-16","title":"Have I Been Pwned loaded 870K breached Miljödata accounts"},"patchStatus":"no-fix-needed","product":"miljodata.se","severity":"medium","severityNote":"870K accounts","slug":"miljodata-data-breach","stacks":[],"startedAt":"2025-09-16","status":"closed","summary":"In August 2025, the Swedish system supplier Miljödata was the victim of a ransomware attack. Following the attack, data was subsequently published on the dark web and included 870k unique email addresses across various compromised files. Data also included names, phone numbers, physical addresses, dates of birth and government-issued personal identity numbers. Exposed data: dates of birth, email addresses, genders, government issued ids, names, phone numbers, physical addresses. The breach dates from Aug 25, 2025; Have I Been Pwned loaded it on Sep 16, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","government-issued-ids","names","phone-numbers","physical-addresses"],"title":"Miljödata data breach: 870K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/miljodata-data-breach","vendor":"Miljödata"},{"auto":true,"category":"patch","closedAt":"2025-09-25","cveIds":["CVE-2025-5086"],"exploited":"in-the-wild","identifiers":["CVE-2025-5086"],"json":"https://helix.ml/threat-watch/i/dassault-syst-mes-delmia-apriso-cve-2025-5086.json","latestUpdate":{"date":"2025-09-11","title":"CISA added CVE-2025-5086 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 2, 2025)"},"patchStatus":"unknown","product":"DELMIA Apriso","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"dassault-syst-mes-delmia-apriso-cve-2025-5086","stacks":["rust"],"startedAt":"2025-09-11","status":"closed","summary":"Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution. CISA added CVE-2025-5086 to its Known Exploited Vulnerabilities catalog on Sep 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability (CVE-2025-5086)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/dassault-syst-mes-delmia-apriso-cve-2025-5086","vendor":"Dassault Systèmes"},{"auto":true,"category":"patch","closedAt":"2025-09-18","cveIds":["CVE-2025-38352"],"exploited":"in-the-wild","identifiers":["CVE-2025-38352"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-38352.json","latestUpdate":{"date":"2025-09-04","title":"CISA added CVE-2025-38352 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2025)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2025-38352","stacks":["linux"],"startedAt":"2025-09-04","status":"closed","summary":"Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability. CISA added CVE-2025-38352 to its Known Exploited Vulnerabilities catalog on Sep 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-367"],"title":"Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability (CVE-2025-38352)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-38352","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2025-09-18","cveIds":["CVE-2025-48543"],"exploited":"in-the-wild","identifiers":["CVE-2025-48543"],"json":"https://helix.ml/threat-watch/i/android-runtime-cve-2025-48543.json","latestUpdate":{"date":"2025-09-04","title":"CISA added CVE-2025-48543 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2025)"},"patchStatus":"patched","product":"Runtime","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-runtime-cve-2025-48543","stacks":["android"],"startedAt":"2025-09-04","status":"closed","summary":"Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation. CISA added CVE-2025-48543 to its Known Exploited Vulnerabilities catalog on Sep 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption"],"title":"Android Runtime Use-After-Free Vulnerability (CVE-2025-48543)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-runtime-cve-2025-48543","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2025-09-18","cveIds":["CVE-2025-53690"],"exploited":"in-the-wild","identifiers":["CVE-2025-53690"],"json":"https://helix.ml/threat-watch/i/sitecore-multiple-products-cve-2025-53690.json","latestUpdate":{"date":"2025-09-04","title":"CISA added CVE-2025-53690 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"sitecore-multiple-products-cve-2025-53690","stacks":["rust"],"startedAt":"2025-09-04","status":"closed","summary":"Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. CISA added CVE-2025-53690 to its Known Exploited Vulnerabilities catalog on Sep 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability (CVE-2025-53690)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sitecore-multiple-products-cve-2025-53690","vendor":"Sitecore"},{"auto":true,"category":"patch","closedAt":"2025-09-17","cveIds":["CVE-2023-50224"],"exploited":"in-the-wild","identifiers":["CVE-2023-50224"],"json":"https://helix.ml/threat-watch/i/tp-link-tl-wr841n-cve-2023-50224.json","latestUpdate":{"date":"2025-09-03","title":"CISA added CVE-2023-50224 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 24, 2025)"},"patchStatus":"unknown","product":"TL-WR841N","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"tp-link-tl-wr841n-cve-2023-50224","stacks":["network"],"startedAt":"2025-09-03","status":"closed","summary":"TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2023-50224 to its Known Exploited Vulnerabilities catalog on Sep 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-290"],"title":"TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability (CVE-2023-50224)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/tp-link-tl-wr841n-cve-2023-50224","vendor":"TP-Link"},{"auto":true,"category":"patch","closedAt":"2025-09-17","cveIds":["CVE-2025-9377"],"exploited":"in-the-wild","identifiers":["CVE-2025-9377"],"json":"https://helix.ml/threat-watch/i/tp-link-multiple-routers-cve-2025-9377.json","latestUpdate":{"date":"2025-09-03","title":"CISA added CVE-2025-9377 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 24, 2025)"},"patchStatus":"unknown","product":"Multiple Routers","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"tp-link-multiple-routers-cve-2025-9377","stacks":["network"],"startedAt":"2025-09-03","status":"closed","summary":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2025-9377 to its Known Exploited Vulnerabilities catalog on Sep 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability (CVE-2025-9377)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/tp-link-multiple-routers-cve-2025-9377","vendor":"TP-Link"},{"auto":true,"category":"patch","closedAt":"2025-09-16","cveIds":["CVE-2020-24363"],"exploited":"in-the-wild","identifiers":["CVE-2020-24363"],"json":"https://helix.ml/threat-watch/i/tp-link-tl-wa855re-cve-2020-24363.json","latestUpdate":{"date":"2025-09-02","title":"CISA added CVE-2020-24363 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 23, 2025)"},"patchStatus":"unknown","product":"TL-WA855RE","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"tp-link-tl-wa855re-cve-2020-24363","stacks":["network"],"startedAt":"2025-09-02","status":"closed","summary":"TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2020-24363 to its Known Exploited Vulnerabilities catalog on Sep 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability (CVE-2020-24363)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/tp-link-tl-wa855re-cve-2020-24363","vendor":"TP-Link"},{"auto":true,"category":"patch","closedAt":"2025-09-16","cveIds":["CVE-2025-55177"],"exploited":"in-the-wild","identifiers":["CVE-2025-55177"],"json":"https://helix.ml/threat-watch/i/meta-platforms-whatsapp-cve-2025-55177.json","latestUpdate":{"date":"2025-09-02","title":"CISA added CVE-2025-55177 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 23, 2025)"},"patchStatus":"unknown","product":"WhatsApp","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"meta-platforms-whatsapp-cve-2025-55177","stacks":[],"startedAt":"2025-09-02","status":"closed","summary":"Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. CISA added CVE-2025-55177 to its Known Exploited Vulnerabilities catalog on Sep 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-863"],"title":"Meta Platforms WhatsApp Incorrect Authorization Vulnerability (CVE-2025-55177)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/meta-platforms-whatsapp-cve-2025-55177","vendor":"Meta Platforms"},{"auto":true,"category":"breach","closedAt":"2025-09-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GIGLIO"],"json":"https://helix.ml/threat-watch/i/giglio-data-breach.json","latestUpdate":{"date":"2025-09-01","title":"Have I Been Pwned loaded 1.0M breached Giglio accounts"},"patchStatus":"no-fix-needed","product":"giglio.com","severity":"medium","severityNote":"1.0M accounts","slug":"giglio-data-breach","stacks":[],"startedAt":"2025-09-01","status":"closed","summary":"In August 2025, over 1M unique email addresses appeared in a breach allegedly obtained from Italian fashion designer Giglio. The data also included names, phone numbers and physical addresses. Giglio did not respond to repeated attempts to disclose the incident. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Aug 9, 2025; Have I Been Pwned loaded it on Sep 1, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Giglio data breach: 1.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/giglio-data-breach","vendor":"Giglio"},{"auto":true,"category":"patch","closedAt":"2025-09-12","cveIds":["CVE-2025-57819"],"exploited":"in-the-wild","identifiers":["CVE-2025-57819"],"json":"https://helix.ml/threat-watch/i/sangoma-freepbx-cve-2025-57819.json","latestUpdate":{"date":"2025-08-29","title":"CISA added CVE-2025-57819 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 19, 2025)"},"patchStatus":"unknown","product":"FreePBX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sangoma-freepbx-cve-2025-57819","stacks":[],"startedAt":"2025-08-29","status":"closed","summary":"Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. CISA added CVE-2025-57819 to its Known Exploited Vulnerabilities catalog on Aug 29, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-89","cwe-288"],"title":"Sangoma FreePBX Authentication Bypass Vulnerability (CVE-2025-57819)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sangoma-freepbx-cve-2025-57819","vendor":"Sangoma"},{"auto":true,"category":"breach","closedAt":"2025-09-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THESQUARE"],"json":"https://helix.ml/threat-watch/i/thesquare-data-breach.json","latestUpdate":{"date":"2025-08-27","title":"Have I Been Pwned loaded 107K breached TheSqua.re accounts"},"patchStatus":"no-fix-needed","product":"thesqua.re","severity":"medium","severityNote":"107K accounts","slug":"thesquare-data-breach","stacks":[],"startedAt":"2025-08-27","status":"closed","summary":"In June 2025, 107k unique customer email addresses were allegedly obtained from TheSqua.re, the \"easiest way to find your next serviced apartment\". The data also included names, phone numbers and cities which were subsequently posted to a popular hacking forum. TheSqua.re did not respond to repeated attempts to disclose the incident, however multiple impacted HIBP subscribers confirmed the legitimacy and accuracy of the data. Exposed data: email addresses, geographic locations, names, phone numbers. The breach dates from Jun 27, 2025; Have I Been Pwned loaded it on Aug 27, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","phone-numbers"],"title":"TheSqua.re data breach: 107K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/thesquare-data-breach","vendor":"TheSqua.re"},{"auto":true,"category":"patch","closedAt":"2025-09-09","cveIds":["CVE-2025-7775"],"exploited":"in-the-wild","identifiers":["CVE-2025-7775"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2025-7775.json","latestUpdate":{"date":"2025-08-26","title":"CISA added CVE-2025-7775 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 28, 2025)"},"patchStatus":"unknown","product":"NetScaler","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-cve-2025-7775","stacks":["cloud","vpn"],"startedAt":"2025-08-26","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service. CISA added CVE-2025-7775 to its Known Exploited Vulnerabilities catalog on Aug 26, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Citrix NetScaler Memory Overflow Vulnerability (CVE-2025-7775)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2025-7775","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2025-09-08","cveIds":["CVE-2025-48384"],"exploited":"in-the-wild","identifiers":["CVE-2025-48384"],"json":"https://helix.ml/threat-watch/i/git-git-cve-2025-48384.json","latestUpdate":{"date":"2025-08-25","title":"CISA added CVE-2025-48384 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2025)"},"patchStatus":"unknown","product":"Git","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"git-git-cve-2025-48384","stacks":[],"startedAt":"2025-08-25","status":"closed","summary":"Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files. CISA added CVE-2025-48384 to its Known Exploited Vulnerabilities catalog on Aug 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-59","cwe-436"],"title":"Git Link Following Vulnerability (CVE-2025-48384)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/git-git-cve-2025-48384","vendor":"Git"},{"auto":true,"category":"patch","closedAt":"2025-09-08","cveIds":["CVE-2024-8068"],"exploited":"in-the-wild","identifiers":["CVE-2024-8068"],"json":"https://helix.ml/threat-watch/i/citrix-session-recording-cve-2024-8068.json","latestUpdate":{"date":"2025-08-25","title":"CISA added CVE-2024-8068 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2025)"},"patchStatus":"unknown","product":"Session Recording","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-session-recording-cve-2024-8068","stacks":["cloud"],"startedAt":"2025-08-25","status":"closed","summary":"Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain. CISA added CVE-2024-8068 to its Known Exploited Vulnerabilities catalog on Aug 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-269"],"title":"Citrix Session Recording Improper Privilege Management Vulnerability (CVE-2024-8068)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-session-recording-cve-2024-8068","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2025-09-08","cveIds":["CVE-2024-8069"],"exploited":"in-the-wild","identifiers":["CVE-2024-8069"],"json":"https://helix.ml/threat-watch/i/citrix-session-recording-cve-2024-8069.json","latestUpdate":{"date":"2025-08-25","title":"CISA added CVE-2024-8069 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2025)"},"patchStatus":"unknown","product":"Session Recording","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-session-recording-cve-2024-8069","stacks":["cloud","rust"],"startedAt":"2025-08-25","status":"closed","summary":"Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server. CISA added CVE-2024-8069 to its Known Exploited Vulnerabilities catalog on Aug 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Citrix Session Recording Deserialization of Untrusted Data Vulnerability (CVE-2024-8069)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-session-recording-cve-2024-8069","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2025-09-04","cveIds":["CVE-2025-43300"],"exploited":"in-the-wild","identifiers":["CVE-2025-43300"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2025-43300.json","latestUpdate":{"date":"2025-08-21","title":"CISA added CVE-2025-43300 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2025)"},"patchStatus":"unknown","product":"iOS, iPadOS, and macOS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2025-43300","stacks":["ios","macos"],"startedAt":"2025-08-21","status":"closed","summary":"Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. CISA added CVE-2025-43300 to its Known Exploited Vulnerabilities catalog on Aug 21, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability (CVE-2025-43300)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2025-43300","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2025-09-01","cveIds":["CVE-2025-54948"],"exploited":"in-the-wild","identifiers":["CVE-2025-54948"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-cve-2025-54948.json","latestUpdate":{"date":"2025-08-18","title":"CISA added CVE-2025-54948 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2025)"},"patchStatus":"patched","product":"Apex One","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-cve-2025-54948","stacks":[],"startedAt":"2025-08-18","status":"closed","summary":"Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. CISA added CVE-2025-54948 to its Known Exploited Vulnerabilities catalog on Aug 18, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Trend Micro Apex One OS Command Injection Vulnerability (CVE-2025-54948)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-cve-2025-54948","vendor":"Trend Micro"},{"auto":true,"category":"breach","closedAt":"2025-09-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ALLIANZLIFE"],"json":"https://helix.ml/threat-watch/i/allianzlife-data-breach.json","latestUpdate":{"date":"2025-08-18","title":"Have I Been Pwned loaded 1.1M breached Allianz Life accounts"},"patchStatus":"no-fix-needed","product":"allianzlife.com","severity":"medium","severityNote":"1.1M accounts","slug":"allianzlife-data-breach","stacks":[],"startedAt":"2025-08-18","status":"closed","summary":"In July 2025, Allianz Life was the victim of a cyber attack which resulted in millions of records later being leaked online. Allianz attributed the attack to \"a social engineering technique\" which targeted data on Salesforce and resulted in the exposure of 1.1M unique email addresses, names, genders, dates of birth, phone numbers and physical addresses. Exposed data: dates of birth, email addresses, genders, names, phone numbers, physical addresses. The breach dates from Jul 16, 2025; Have I Been Pwned loaded it on Aug 18, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"Allianz Life data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/allianzlife-data-breach","vendor":"Allianz Life"},{"auto":true,"category":"patch","closedAt":"2025-08-27","cveIds":["CVE-2025-8876"],"exploited":"in-the-wild","identifiers":["CVE-2025-8876"],"json":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8876.json","latestUpdate":{"date":"2025-08-13","title":"CISA added CVE-2025-8876 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 20, 2025)"},"patchStatus":"unknown","product":"N-Central","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"n-able-n-central-cve-2025-8876","stacks":[],"startedAt":"2025-08-13","status":"closed","summary":"N-able N-Central contains a command injection vulnerability via improper sanitization of user input. CISA added CVE-2025-8876 to its Known Exploited Vulnerabilities catalog on Aug 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"N-able N-Central Command Injection Vulnerability (CVE-2025-8876)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8876","vendor":"N-able"},{"auto":true,"category":"patch","closedAt":"2025-08-27","cveIds":["CVE-2025-8875"],"exploited":"in-the-wild","identifiers":["CVE-2025-8875"],"json":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8875.json","latestUpdate":{"date":"2025-08-13","title":"CISA added CVE-2025-8875 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 20, 2025)"},"patchStatus":"unknown","product":"N-Central","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"n-able-n-central-cve-2025-8875","stacks":[],"startedAt":"2025-08-13","status":"closed","summary":"N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution. CISA added CVE-2025-8875 to its Known Exploited Vulnerabilities catalog on Aug 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization"],"title":"N-able N-Central Insecure Deserialization Vulnerability (CVE-2025-8875)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8875","vendor":"N-able"},{"auto":true,"category":"breach","closedAt":"2025-08-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DATATROLLSTEALERLOGS"],"json":"https://helix.ml/threat-watch/i/datatrollstealerlogs-data-breach.json","latestUpdate":{"date":"2025-08-13","title":"Have I Been Pwned loaded 109.5M breached Data Troll Stealer Logs accounts"},"patchStatus":"no-fix-needed","product":"Data Troll Stealer Logs","severity":"critical","severityNote":"109.5M accounts · passwords exposed · infostealer logs","slug":"datatrollstealerlogs-data-breach","stacks":[],"startedAt":"2025-08-13","status":"closed","summary":"In June 2025, headlines erupted over a \"16 billion password\" breach. In reality, the dataset was a compilation of publicly accessible stealer logs, mostly repurposed from older leaks, with only a small portion of genuinely new material. HIBP received 2.7B rows containing 109M unique email addresses, which was subsequently added to the service under the name \"Data Troll\". The websites the stealer logs were captured against are searchable via the HIBP dashboard. Exposed data: email addresses, passwords. The breach dates from Jun 20, 2025; Have I Been Pwned loaded it on Aug 13, 2025.","tags":["data-breach","hibp","stealer-log","email-addresses","passwords"],"title":"Data Troll Stealer Logs data breach: 109.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/datatrollstealerlogs-data-breach","vendor":"Data Troll Stealer Logs"},{"auto":true,"category":"patch","closedAt":"2025-08-26","cveIds":["CVE-2025-8088"],"exploited":"in-the-wild","identifiers":["CVE-2025-8088"],"json":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2025-8088.json","latestUpdate":{"date":"2025-08-12","title":"CISA added CVE-2025-8088 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 2, 2025)"},"patchStatus":"unknown","product":"WinRAR","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"rarlab-winrar-cve-2025-8088","stacks":[],"startedAt":"2025-08-12","status":"closed","summary":"RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files. CISA added CVE-2025-8088 to its Known Exploited Vulnerabilities catalog on Aug 12, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-35"],"title":"RARLAB WinRAR Path Traversal Vulnerability (CVE-2025-8088)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2025-8088","vendor":"RARLAB"},{"auto":true,"category":"patch","closedAt":"2025-08-26","cveIds":["CVE-2007-0671"],"exploited":"in-the-wild","identifiers":["CVE-2007-0671"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2007-0671.json","latestUpdate":{"date":"2025-08-12","title":"CISA added CVE-2007-0671 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 2, 2025)"},"patchStatus":"unknown","product":"Office","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2007-0671","stacks":["windows"],"startedAt":"2025-08-12","status":"closed","summary":"Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system. CISA added CVE-2007-0671 to its Known Exploited Vulnerabilities catalog on Aug 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2007-0671)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2007-0671","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-08-26","cveIds":["CVE-2013-3893"],"exploited":"in-the-wild","identifiers":["CVE-2013-3893"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-3893.json","latestUpdate":{"date":"2025-08-12","title":"CISA added CVE-2013-3893 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 2, 2025)"},"patchStatus":"unknown","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2013-3893","stacks":["browser","windows"],"startedAt":"2025-08-12","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2013-3893 to its Known Exploited Vulnerabilities catalog on Aug 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-399"],"title":"Microsoft Internet Explorer Resource Management Errors Vulnerability (CVE-2013-3893)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-3893","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2025-08-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNIGAME"],"json":"https://helix.ml/threat-watch/i/unigame-data-breach.json","latestUpdate":{"date":"2025-08-08","title":"Have I Been Pwned loaded 843K breached Unigame accounts"},"patchStatus":"no-fix-needed","product":"unigame.me","severity":"high","severityNote":"843K accounts · passwords exposed","slug":"unigame-data-breach","stacks":[],"startedAt":"2025-08-08","status":"closed","summary":"In December 2019, the now defunct gaming website Unigame (maker of Hunter Online) suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 844k email addresses and salted MD5 password hashes. Exposed data: email addresses, passwords. The breach dates from Dec 14, 2019; Have I Been Pwned loaded it on Aug 8, 2025.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Unigame data breach: 843K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/unigame-data-breach","vendor":"Unigame"},{"auto":true,"category":"patch","closedAt":"2025-08-19","cveIds":["CVE-2020-25078"],"exploited":"in-the-wild","identifiers":["CVE-2020-25078"],"json":"https://helix.ml/threat-watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078.json","latestUpdate":{"date":"2025-08-05","title":"CISA added CVE-2020-25078 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 26, 2025)"},"patchStatus":"patched","product":"DCS-2530L and DCS-2670L Devices","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078","stacks":["network"],"startedAt":"2025-08-05","status":"closed","summary":"D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2020-25078 to its Known Exploited Vulnerabilities catalog on Aug 5, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability (CVE-2020-25078)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2025-08-19","cveIds":["CVE-2020-25079"],"exploited":"in-the-wild","identifiers":["CVE-2020-25079"],"json":"https://helix.ml/threat-watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25079.json","latestUpdate":{"date":"2025-08-05","title":"CISA added CVE-2020-25079 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 26, 2025)"},"patchStatus":"patched","product":"DCS-2530L and DCS-2670L Devices","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25079","stacks":["network"],"startedAt":"2025-08-05","status":"closed","summary":"D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2020-25079 to its Known Exploited Vulnerabilities catalog on Aug 5, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability (CVE-2020-25079)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25079","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2025-08-19","cveIds":["CVE-2022-40799"],"exploited":"in-the-wild","identifiers":["CVE-2022-40799"],"json":"https://helix.ml/threat-watch/i/d-link-dnr-322l-cve-2022-40799.json","latestUpdate":{"date":"2025-08-05","title":"CISA added CVE-2022-40799 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 26, 2025)"},"patchStatus":"unknown","product":"DNR-322L","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dnr-322l-cve-2022-40799","stacks":["network"],"startedAt":"2025-08-05","status":"closed","summary":"D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2022-40799 to its Known Exploited Vulnerabilities catalog on Aug 5, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-494"],"title":"D-Link DNR-322L Download of Code Without Integrity Check Vulnerability (CVE-2022-40799)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dnr-322l-cve-2022-40799","vendor":"D-Link"},{"auto":true,"category":"breach","closedAt":"2025-08-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEPI-HOLE"],"json":"https://helix.ml/threat-watch/i/thepi-hole-data-breach.json","latestUpdate":{"date":"2025-07-31","title":"Have I Been Pwned loaded 29K breached Pi-hole accounts"},"patchStatus":"no-fix-needed","product":"pi-hole.net","severity":"medium","severityNote":"29K accounts","slug":"thepi-hole-data-breach","stacks":[],"startedAt":"2025-07-31","status":"closed","summary":"In July 2025, a vulnerability in the GiveWP WordPress plugin exposed the names and email addresses of approximately 30k donors to the Pi-hole network-wide ad blocking project. Pi-hole subsequently self-submitted the list of impacted donors to HIBP. Exposed data: email addresses, names. The breach dates from Jul 30, 2025; Have I Been Pwned loaded it on Jul 31, 2025.","tags":["data-breach","hibp","email-addresses","names"],"title":"Pi-hole data breach: 29K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/thepi-hole-data-breach","vendor":"Pi-hole"},{"auto":true,"category":"patch","closedAt":"2025-08-11","cveIds":["CVE-2023-2533"],"exploited":"in-the-wild","identifiers":["CVE-2023-2533"],"json":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2023-2533.json","latestUpdate":{"date":"2025-07-28","title":"CISA added CVE-2023-2533 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 18, 2025)"},"patchStatus":"unknown","product":"NG/MF","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"papercut-ng-mf-cve-2023-2533","stacks":[],"startedAt":"2025-07-28","status":"closed","summary":"PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. CISA added CVE-2023-2533 to its Known Exploited Vulnerabilities catalog on Jul 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-352"],"title":"PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-2533)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/papercut-ng-mf-cve-2023-2533","vendor":"PaperCut"},{"auto":true,"category":"patch","closedAt":"2025-08-11","cveIds":["CVE-2025-20337"],"exploited":"in-the-wild","identifiers":["CVE-2025-20337"],"json":"https://helix.ml/threat-watch/i/cisco-identity-services-engine-cve-2025-20337.json","latestUpdate":{"date":"2025-07-28","title":"CISA added CVE-2025-20337 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 18, 2025)"},"patchStatus":"unknown","product":"Identity Services Engine","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-identity-services-engine-cve-2025-20337","stacks":["network"],"startedAt":"2025-07-28","status":"closed","summary":"Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CISA added CVE-2025-20337 to its Known Exploited Vulnerabilities catalog on Jul 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-74"],"title":"Cisco Identity Services Engine Injection Vulnerability (CVE-2025-20337)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-identity-services-engine-cve-2025-20337","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2025-08-11","cveIds":["CVE-2025-20281"],"exploited":"in-the-wild","identifiers":["CVE-2025-20281"],"json":"https://helix.ml/threat-watch/i/cisco-identity-services-engine-cve-2025-20281.json","latestUpdate":{"date":"2025-07-28","title":"CISA added CVE-2025-20281 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 18, 2025)"},"patchStatus":"unknown","product":"Identity Services Engine","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-identity-services-engine-cve-2025-20281","stacks":["network"],"startedAt":"2025-07-28","status":"closed","summary":"Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CISA added CVE-2025-20281 to its Known Exploited Vulnerabilities catalog on Jul 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-74"],"title":"Cisco Identity Services Engine Injection Vulnerability (CVE-2025-20281)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-identity-services-engine-cve-2025-20281","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2025-08-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CREAMSCAFE"],"json":"https://helix.ml/threat-watch/i/creamscafe-data-breach.json","latestUpdate":{"date":"2025-07-23","title":"Have I Been Pwned loaded 159K breached Creams Cafe accounts"},"patchStatus":"no-fix-needed","product":"creamscafe.com","severity":"medium","severityNote":"159K accounts","slug":"creamscafe-data-breach","stacks":[],"startedAt":"2025-07-23","status":"closed","summary":"In May 2025, 160k records of customer data was allegedly obtained from Creams Cafe, \"the UK's favourite dessert parlour\". The data included email and physical addresses, names and phone numbers. Creams Cafe did not respond to repeated attempts to disclose the incident, however multiple impacted HIBP subscribers confirmed the legitimacy and accuracy of the data. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from May 1, 2025; Have I Been Pwned loaded it on Jul 23, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Creams Cafe data breach: 159K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/creamscafe-data-breach","vendor":"Creams Cafe"},{"auto":true,"category":"patch","closedAt":"2025-08-05","cveIds":["CVE-2025-2775"],"exploited":"in-the-wild","identifiers":["CVE-2025-2775"],"json":"https://helix.ml/threat-watch/i/sysaid-sysaid-on-prem-cve-2025-2775.json","latestUpdate":{"date":"2025-07-22","title":"CISA added CVE-2025-2775 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 12, 2025)"},"patchStatus":"unknown","product":"SysAid On-Prem","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"sysaid-sysaid-on-prem-cve-2025-2775","stacks":[],"startedAt":"2025-07-22","status":"closed","summary":"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. CISA added CVE-2025-2775 to its Known Exploited Vulnerabilities catalog on Jul 22, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-611"],"title":"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (CVE-2025-2775)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sysaid-sysaid-on-prem-cve-2025-2775","vendor":"SysAid"},{"auto":true,"category":"patch","closedAt":"2025-08-05","cveIds":["CVE-2025-2776"],"exploited":"in-the-wild","identifiers":["CVE-2025-2776"],"json":"https://helix.ml/threat-watch/i/sysaid-sysaid-on-prem-cve-2025-2776.json","latestUpdate":{"date":"2025-07-22","title":"CISA added CVE-2025-2776 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 12, 2025)"},"patchStatus":"unknown","product":"SysAid On-Prem","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sysaid-sysaid-on-prem-cve-2025-2776","stacks":[],"startedAt":"2025-07-22","status":"closed","summary":"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. CISA added CVE-2025-2776 to its Known Exploited Vulnerabilities catalog on Jul 22, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-611"],"title":"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (CVE-2025-2776)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sysaid-sysaid-on-prem-cve-2025-2776","vendor":"SysAid"},{"auto":true,"category":"patch","closedAt":"2025-08-05","cveIds":["CVE-2025-6558"],"exploited":"in-the-wild","identifiers":["CVE-2025-6558"],"json":"https://helix.ml/threat-watch/i/google-chromium-cve-2025-6558.json","latestUpdate":{"date":"2025-07-22","title":"CISA added CVE-2025-6558 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 12, 2025)"},"patchStatus":"unknown","product":"Chromium","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-cve-2025-6558","stacks":["browser"],"startedAt":"2025-07-22","status":"closed","summary":"Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2025-6558 to its Known Exploited Vulnerabilities catalog on Jul 22, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Google Chromium ANGLE and GPU Improper Input Validation Vulnerability (CVE-2025-6558)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-cve-2025-6558","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2025-08-05","cveIds":["CVE-2025-54309"],"exploited":"in-the-wild","identifiers":["CVE-2025-54309"],"json":"https://helix.ml/threat-watch/i/crushftp-crushftp-cve-2025-54309.json","latestUpdate":{"date":"2025-07-22","title":"CISA added CVE-2025-54309 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 12, 2025)"},"patchStatus":"unknown","product":"CrushFTP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"crushftp-crushftp-cve-2025-54309","stacks":[],"startedAt":"2025-07-22","status":"closed","summary":"CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS. CISA added CVE-2025-54309 to its Known Exploited Vulnerabilities catalog on Jul 22, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-420"],"title":"CrushFTP Unprotected Alternate Channel Vulnerability (CVE-2025-54309)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/crushftp-crushftp-cve-2025-54309","vendor":"CrushFTP"},{"auto":true,"category":"patch","closedAt":"2025-08-05","cveIds":["CVE-2025-49704"],"exploited":"in-the-wild","identifiers":["CVE-2025-49704"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2025-49704.json","latestUpdate":{"date":"2025-07-22","title":"CISA added CVE-2025-49704 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 23, 2025)"},"patchStatus":"unpatched","product":"SharePoint","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2025-49704","stacks":["windows"],"startedAt":"2025-07-22","status":"closed","summary":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704. CISA added CVE-2025-49704 to its Known Exploited Vulnerabilities catalog on Jul 22, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Microsoft SharePoint Code Injection Vulnerability (CVE-2025-49704)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2025-49704","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-08-05","cveIds":["CVE-2025-49706"],"exploited":"in-the-wild","identifiers":["CVE-2025-49706"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2025-49706.json","latestUpdate":{"date":"2025-07-22","title":"CISA added CVE-2025-49706 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 23, 2025)"},"patchStatus":"unpatched","product":"SharePoint","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2025-49706","stacks":["windows"],"startedAt":"2025-07-22","status":"closed","summary":"Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706. CISA added CVE-2025-49706 to its Known Exploited Vulnerabilities catalog on Jul 22, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-287"],"title":"Microsoft SharePoint Improper Authentication Vulnerability (CVE-2025-49706)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2025-49706","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-08-03","cveIds":["CVE-2025-53770"],"exploited":"in-the-wild","identifiers":["CVE-2025-53770"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2025-53770.json","latestUpdate":{"date":"2025-07-20","title":"CISA added CVE-2025-53770 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 21, 2025)"},"patchStatus":"unpatched","product":"SharePoint","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2025-53770","stacks":["rust","windows"],"startedAt":"2025-07-20","status":"closed","summary":"Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog on Jul 20, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2025-53770)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2025-53770","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-08-01","cveIds":["CVE-2025-25257"],"exploited":"in-the-wild","identifiers":["CVE-2025-25257"],"json":"https://helix.ml/threat-watch/i/fortinet-fortiweb-cve-2025-25257.json","latestUpdate":{"date":"2025-07-18","title":"CISA added CVE-2025-25257 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 8, 2025)"},"patchStatus":"unknown","product":"FortiWeb","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortiweb-cve-2025-25257","stacks":["network"],"startedAt":"2025-07-18","status":"closed","summary":"Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. CISA added CVE-2025-25257 to its Known Exploited Vulnerabilities catalog on Jul 18, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Fortinet FortiWeb SQL Injection Vulnerability (CVE-2025-25257)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-fortiweb-cve-2025-25257","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2025-07-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MAREADS"],"json":"https://helix.ml/threat-watch/i/mareads-data-breach.json","latestUpdate":{"date":"2025-07-15","title":"Have I Been Pwned loaded 74K breached MaReads accounts"},"patchStatus":"no-fix-needed","product":"mareads.com","severity":"medium","severityNote":"74K accounts","slug":"mareads-data-breach","stacks":[],"startedAt":"2025-07-15","status":"closed","summary":"In June 2025, MaReads, the website for readers and writers of Thai-language fiction and comics suffered a data breach that exposed 74k records. The breach included usernames, email addresses, phone numbers and dates of birth. MaReads is aware of the breach. Exposed data: dates of birth, email addresses, phone numbers, usernames. The breach dates from Jun 22, 2025; Have I Been Pwned loaded it on Jul 15, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","phone-numbers","usernames"],"title":"MaReads data breach: 74K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mareads-data-breach","vendor":"MaReads"},{"auto":true,"category":"patch","closedAt":"2025-07-28","cveIds":["CVE-2025-47812"],"exploited":"in-the-wild","identifiers":["CVE-2025-47812"],"json":"https://helix.ml/threat-watch/i/wing-ftp-server-wing-ftp-server-cve-2025-47812.json","latestUpdate":{"date":"2025-07-14","title":"CISA added CVE-2025-47812 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 4, 2025)"},"patchStatus":"unknown","product":"Wing FTP Server","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"wing-ftp-server-wing-ftp-server-cve-2025-47812","stacks":[],"startedAt":"2025-07-14","status":"closed","summary":"Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). CISA added CVE-2025-47812 to its Known Exploited Vulnerabilities catalog on Jul 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-158"],"title":"Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability (CVE-2025-47812)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/wing-ftp-server-wing-ftp-server-cve-2025-47812","vendor":"Wing FTP Server"},{"auto":true,"category":"breach","closedAt":"2025-07-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OMNICURIS"],"json":"https://helix.ml/threat-watch/i/omnicuris-data-breach.json","latestUpdate":{"date":"2025-07-13","title":"Have I Been Pwned loaded 215K breached Omnicuris accounts"},"patchStatus":"no-fix-needed","product":"omnicuris.com","severity":"medium","severityNote":"215K accounts","slug":"omnicuris-data-breach","stacks":[],"startedAt":"2025-07-13","status":"closed","summary":"In June 2025, the Indian CME platform Omnicuris suffered a data breach that exposed approximately 200k records of healthcare professionals. The data included names, email addresses, phone numbers, geographic locations and other data attributes relating to professional expertise and training progress. Omnicuris is aware of the incident. Exposed data: email addresses, geographic locations, names, phone numbers. The breach dates from Jun 8, 2025; Have I Been Pwned loaded it on Jul 13, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","phone-numbers"],"title":"Omnicuris data breach: 215K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/omnicuris-data-breach","vendor":"Omnicuris"},{"auto":true,"category":"patch","closedAt":"2025-07-24","cveIds":["CVE-2025-5777"],"exploited":"in-the-wild","identifiers":["CVE-2025-5777"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-gateway-cve-2025-5777.json","latestUpdate":{"date":"2025-07-10","title":"CISA added CVE-2025-5777 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 11, 2025)"},"patchStatus":"unknown","product":"NetScaler ADC and Gateway","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-adc-and-gateway-cve-2025-5777","stacks":["cloud","vpn"],"startedAt":"2025-07-10","status":"closed","summary":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. CISA added CVE-2025-5777 to its Known Exploited Vulnerabilities catalog on Jul 10, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-125"],"title":"Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability (CVE-2025-5777)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-gateway-cve-2025-5777","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2025-07-21","cveIds":["CVE-2019-9621"],"exploited":"in-the-wild","identifiers":["CVE-2019-9621"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2019-9621.json","latestUpdate":{"date":"2025-07-07","title":"CISA added CVE-2019-9621 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2025)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2019-9621","stacks":[],"startedAt":"2025-07-07","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component. CISA added CVE-2019-9621 to its Known Exploited Vulnerabilities catalog on Jul 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-918","cwe-807"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-9621)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2019-9621","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2025-07-21","cveIds":["CVE-2019-5418"],"exploited":"in-the-wild","identifiers":["CVE-2019-5418"],"json":"https://helix.ml/threat-watch/i/rails-ruby-on-rails-cve-2019-5418.json","latestUpdate":{"date":"2025-07-07","title":"CISA added CVE-2019-5418 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2025)"},"patchStatus":"patched","product":"Ruby on Rails","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"rails-ruby-on-rails-cve-2019-5418","stacks":["ruby"],"startedAt":"2025-07-07","status":"closed","summary":"Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. CISA added CVE-2019-5418 to its Known Exploited Vulnerabilities catalog on Jul 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Rails Ruby on Rails Path Traversal Vulnerability (CVE-2019-5418)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/rails-ruby-on-rails-cve-2019-5418","vendor":"Rails"},{"auto":true,"category":"patch","closedAt":"2025-07-21","cveIds":["CVE-2016-10033"],"exploited":"in-the-wild","identifiers":["CVE-2016-10033"],"json":"https://helix.ml/threat-watch/i/php-phpmailer-cve-2016-10033.json","latestUpdate":{"date":"2025-07-07","title":"CISA added CVE-2016-10033 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2025)"},"patchStatus":"patched","product":"PHPMailer","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"php-phpmailer-cve-2016-10033","stacks":["php"],"startedAt":"2025-07-07","status":"closed","summary":"PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. CISA added CVE-2016-10033 to its Known Exploited Vulnerabilities catalog on Jul 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77","cwe-88"],"title":"PHPMailer Command Injection Vulnerability (CVE-2016-10033)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/php-phpmailer-cve-2016-10033","vendor":"PHP"},{"auto":true,"category":"patch","closedAt":"2025-07-21","cveIds":["CVE-2014-3931"],"exploited":"in-the-wild","identifiers":["CVE-2014-3931"],"json":"https://helix.ml/threat-watch/i/looking-glass-multi-router-looking-glass-mrlg-cve-2014-3931.json","latestUpdate":{"date":"2025-07-07","title":"CISA added CVE-2014-3931 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2025)"},"patchStatus":"unknown","product":"Multi-Router Looking Glass (MRLG)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"looking-glass-multi-router-looking-glass-mrlg-cve-2014-3931","stacks":["network"],"startedAt":"2025-07-07","status":"closed","summary":"Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption. CISA added CVE-2014-3931 to its Known Exploited Vulnerabilities catalog on Jul 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability (CVE-2014-3931)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/looking-glass-multi-router-looking-glass-mrlg-cve-2014-3931","vendor":"Looking Glass"},{"auto":true,"category":"breach","closedAt":"2025-07-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CATWATCHFUL"],"json":"https://helix.ml/threat-watch/i/catwatchful-data-breach.json","latestUpdate":{"date":"2025-07-03","title":"Have I Been Pwned loaded 61K breached Catwatchful accounts"},"patchStatus":"no-fix-needed","product":"catwatchful.com","severity":"high","severityNote":"61K accounts · passwords exposed","slug":"catwatchful-data-breach","stacks":[],"startedAt":"2025-07-03","status":"closed","summary":"In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records. The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the system. Exposed data: email addresses, passwords. The breach dates from Jun 9, 2025; Have I Been Pwned loaded it on Jul 3, 2025.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Catwatchful data breach: 61K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/catwatchful-data-breach","vendor":"Catwatchful"},{"auto":true,"category":"patch","closedAt":"2025-07-16","cveIds":["CVE-2025-6554"],"exploited":"in-the-wild","identifiers":["CVE-2025-6554"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-6554.json","latestUpdate":{"date":"2025-07-02","title":"CISA added CVE-2025-6554 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 23, 2025)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2025-6554","stacks":["browser"],"startedAt":"2025-07-02","status":"closed","summary":"Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2025-6554 to its Known Exploited Vulnerabilities catalog on Jul 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2025-6554)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-6554","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2025-07-15","cveIds":["CVE-2025-48928"],"exploited":"in-the-wild","identifiers":["CVE-2025-48928"],"json":"https://helix.ml/threat-watch/i/telemessage-tm-sgnl-cve-2025-48928.json","latestUpdate":{"date":"2025-07-01","title":"CISA added CVE-2025-48928 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 22, 2025)"},"patchStatus":"unknown","product":"TM SGNL","severity":"medium","severityNote":"CVSS 4.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"telemessage-tm-sgnl-cve-2025-48928","stacks":[],"startedAt":"2025-07-01","status":"closed","summary":"TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump. CISA added CVE-2025-48928 to its Known Exploited Vulnerabilities catalog on Jul 1, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-528"],"title":"TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability (CVE-2025-48928)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/telemessage-tm-sgnl-cve-2025-48928","vendor":"TeleMessage"},{"auto":true,"category":"patch","closedAt":"2025-07-15","cveIds":["CVE-2025-48927"],"exploited":"in-the-wild","identifiers":["CVE-2025-48927"],"json":"https://helix.ml/threat-watch/i/telemessage-tm-sgnl-cve-2025-48927.json","latestUpdate":{"date":"2025-07-01","title":"CISA added CVE-2025-48927 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 22, 2025)"},"patchStatus":"unknown","product":"TM SGNL","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"telemessage-tm-sgnl-cve-2025-48927","stacks":[],"startedAt":"2025-07-01","status":"closed","summary":"TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI. CISA added CVE-2025-48927 to its Known Exploited Vulnerabilities catalog on Jul 1, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1188"],"title":"TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability (CVE-2025-48927)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/telemessage-tm-sgnl-cve-2025-48927","vendor":"TeleMessage"},{"auto":true,"category":"patch","closedAt":"2025-07-14","cveIds":["CVE-2025-6543"],"exploited":"in-the-wild","identifiers":["CVE-2025-6543"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-gateway-cve-2025-6543.json","latestUpdate":{"date":"2025-06-30","title":"CISA added CVE-2025-6543 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 21, 2025)"},"patchStatus":"unknown","product":"NetScaler ADC and Gateway","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-adc-and-gateway-cve-2025-6543","stacks":["cloud","vpn"],"startedAt":"2025-06-30","status":"closed","summary":"Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. CISA added CVE-2025-6543 to its Known Exploited Vulnerabilities catalog on Jun 30, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability (CVE-2025-6543)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-gateway-cve-2025-6543","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2025-07-09","cveIds":["CVE-2019-6693"],"exploited":"in-the-wild","identifiers":["CVE-2019-6693"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2019-6693.json","latestUpdate":{"date":"2025-06-25","title":"CISA added CVE-2019-6693 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 16, 2025)"},"patchStatus":"unknown","product":"FortiOS","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2019-6693","stacks":["network","vpn"],"startedAt":"2025-06-25","status":"closed","summary":"Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. CISA added CVE-2019-6693 to its Known Exploited Vulnerabilities catalog on Jun 25, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","hard-coded-credentials","cwe-798"],"title":"Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability (CVE-2019-6693)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2019-6693","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2025-07-09","cveIds":["CVE-2024-0769"],"exploited":"in-the-wild","identifiers":["CVE-2024-0769"],"json":"https://helix.ml/threat-watch/i/d-link-dir-859-router-cve-2024-0769.json","latestUpdate":{"date":"2025-06-25","title":"CISA added CVE-2024-0769 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 16, 2025)"},"patchStatus":"unknown","product":"DIR-859 Router","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-859-router-cve-2024-0769","stacks":["network"],"startedAt":"2025-06-25","status":"closed","summary":"D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. CISA added CVE-2024-0769 to its Known Exploited Vulnerabilities catalog on Jun 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","path-traversal","cwe-22"],"title":"D-Link DIR-859 Router Path Traversal Vulnerability (CVE-2024-0769)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dir-859-router-cve-2024-0769","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2025-07-09","cveIds":["CVE-2024-54085"],"exploited":"in-the-wild","identifiers":["CVE-2024-54085"],"json":"https://helix.ml/threat-watch/i/ami-megarac-spx-cve-2024-54085.json","latestUpdate":{"date":"2025-06-25","title":"CISA added CVE-2024-54085 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 16, 2025)"},"patchStatus":"unknown","product":"MegaRAC SPx","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ami-megarac-spx-cve-2024-54085","stacks":[],"startedAt":"2025-06-25","status":"closed","summary":"AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. CISA added CVE-2024-54085 to its Known Exploited Vulnerabilities catalog on Jun 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-290"],"title":"AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability (CVE-2024-54085)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ami-megarac-spx-cve-2024-54085","vendor":"AMI"},{"auto":true,"category":"breach","closedAt":"2025-07-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HAVEFUNTEACHING"],"json":"https://helix.ml/threat-watch/i/havefunteaching-data-breach.json","latestUpdate":{"date":"2025-06-25","title":"Have I Been Pwned loaded 27K breached Have Fun Teaching accounts"},"patchStatus":"no-fix-needed","product":"havefunteaching.com","severity":"medium","severityNote":"27K accounts","slug":"havefunteaching-data-breach","stacks":[],"startedAt":"2025-06-25","status":"closed","summary":"In August 2021, the teaching resources website Have Fun Teaching suffered a data breach that leaked 80k WooCommerce transactions which were later posted to a popular hacking forum. The data contained 27k unique email addresses along with physical and IP addresses, names, payment methods and the item purchased. Have Fun Teaching is aware of the incident. Exposed data: browser user agent details, email addresses, ip addresses, names, payment methods, physical addresses, purchases. The breach dates from Aug 15, 2021; Have I Been Pwned loaded it on Jun 25, 2025.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","names","payment-methods","physical-addresses","purchases"],"title":"Have Fun Teaching data breach: 27K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/havefunteaching-data-breach","vendor":"Have Fun Teaching"},{"auto":true,"category":"breach","closedAt":"2025-07-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROBINSONSMALLS"],"json":"https://helix.ml/threat-watch/i/robinsonsmalls-data-breach.json","latestUpdate":{"date":"2025-06-25","title":"Have I Been Pwned loaded 195K breached Robinsons Malls accounts"},"patchStatus":"no-fix-needed","product":"robinsonsmalls.com","severity":"medium","severityNote":"195K accounts","slug":"robinsonsmalls-data-breach","stacks":[],"startedAt":"2025-06-25","status":"closed","summary":"In June 2024, the Philippines' largest shopping-mall operators Robinsons Malls suffered a data breach stemming from their mobile app. The incident exposed 195k unique email addresses along with names, phone numbers, dates of birth, genders and the user's city and province. Exposed data: dates of birth, email addresses, genders, geographic locations, names, phone numbers. The breach dates from Jun 1, 2024; Have I Been Pwned loaded it on Jun 25, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","phone-numbers"],"title":"Robinsons Malls data breach: 195K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/robinsonsmalls-data-breach","vendor":"Robinsons Malls"},{"auto":true,"category":"patch","closedAt":"2025-07-01","cveIds":["CVE-2023-0386"],"exploited":"in-the-wild","identifiers":["CVE-2023-0386"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2023-0386.json","latestUpdate":{"date":"2025-06-17","title":"CISA added CVE-2023-0386 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 8, 2025)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2023-0386","stacks":["linux"],"startedAt":"2025-06-17","status":"closed","summary":"Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. CISA added CVE-2023-0386 to its Known Exploited Vulnerabilities catalog on Jun 17, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-282"],"title":"Linux Kernel Improper Ownership Management Vulnerability (CVE-2023-0386)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2023-0386","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2025-06-30","cveIds":["CVE-2023-33538"],"exploited":"in-the-wild","identifiers":["CVE-2023-33538"],"json":"https://helix.ml/threat-watch/i/tp-link-multiple-routers-cve-2023-33538.json","latestUpdate":{"date":"2025-06-16","title":"CISA added CVE-2023-33538 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 7, 2025)"},"patchStatus":"unknown","product":"Multiple Routers","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"tp-link-multiple-routers-cve-2023-33538","stacks":["network"],"startedAt":"2025-06-16","status":"closed","summary":"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2023-33538 to its Known Exploited Vulnerabilities catalog on Jun 16, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"TP-Link Multiple Routers Command Injection Vulnerability (CVE-2023-33538)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/tp-link-multiple-routers-cve-2023-33538","vendor":"TP-Link"},{"auto":true,"category":"patch","closedAt":"2025-06-30","cveIds":["CVE-2025-43200"],"exploited":"in-the-wild","identifiers":["CVE-2025-43200"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43200.json","latestUpdate":{"date":"2025-06-16","title":"CISA added CVE-2025-43200 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 7, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"medium","severityNote":"CVSS 4.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-43200","stacks":[],"startedAt":"2025-06-16","status":"closed","summary":"Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. CISA added CVE-2025-43200 to its Known Exploited Vulnerabilities catalog on Jun 16, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple Multiple Products Unspecified Vulnerability (CVE-2025-43200)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-43200","vendor":"Apple"},{"auto":true,"category":"breach","closedAt":"2025-06-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UALABEE"],"json":"https://helix.ml/threat-watch/i/ualabee-data-breach.json","latestUpdate":{"date":"2025-06-13","title":"Have I Been Pwned loaded 472K breached Ualabee accounts"},"patchStatus":"no-fix-needed","product":"ualabee.com","severity":"medium","severityNote":"472K accounts","slug":"ualabee-data-breach","stacks":[],"startedAt":"2025-06-13","status":"closed","summary":"In May 2025, the South American mobility services platform Ualabee had hundreds of thousands of records scraped from an interface on their platform. The data included 472k unique email addresses along with names, profile photos, dates of birth and phone numbers. Exposed data: dates of birth, email addresses, names, phone numbers, profile photos. The breach dates from May 6, 2025; Have I Been Pwned loaded it on Jun 13, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","profile-photos"],"title":"Ualabee data breach: 472K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ualabee-data-breach","vendor":"Ualabee"},{"auto":true,"category":"patch","closedAt":"2025-06-24","cveIds":["CVE-2025-33053"],"exploited":"in-the-wild","identifiers":["CVE-2025-33053"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-33053.json","latestUpdate":{"date":"2025-06-10","title":"CISA added CVE-2025-33053 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 1, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-33053","stacks":["windows"],"startedAt":"2025-06-10","status":"closed","summary":"Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files. CISA added CVE-2025-33053 to its Known Exploited Vulnerabilities catalog on Jun 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-73"],"title":"Microsoft Windows External Control of File Name or Path Vulnerability (CVE-2025-33053)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-33053","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-06-24","cveIds":["CVE-2025-24016"],"exploited":"in-the-wild","identifiers":["CVE-2025-24016"],"json":"https://helix.ml/threat-watch/i/wazuh-wazuh-server-cve-2025-24016.json","latestUpdate":{"date":"2025-06-10","title":"CISA added CVE-2025-24016 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 1, 2025)"},"patchStatus":"unknown","product":"Wazuh Server","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"wazuh-wazuh-server-cve-2025-24016","stacks":["rust"],"startedAt":"2025-06-10","status":"closed","summary":"Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers. CISA added CVE-2025-24016 to its Known Exploited Vulnerabilities catalog on Jun 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Wazuh Server Deserialization of Untrusted Data Vulnerability (CVE-2025-24016)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/wazuh-wazuh-server-cve-2025-24016","vendor":"Wazuh"},{"auto":true,"category":"breach","closedAt":"2025-06-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WIREDBUCKS"],"json":"https://helix.ml/threat-watch/i/wiredbucks-data-breach.json","latestUpdate":{"date":"2025-06-10","title":"Have I Been Pwned loaded 918K breached WiredBucks accounts"},"patchStatus":"no-fix-needed","product":"wiredbucks.com","severity":"high","severityNote":"918K accounts · passwords exposed","slug":"wiredbucks-data-breach","stacks":[],"startedAt":"2025-06-10","status":"closed","summary":"In May 2022, the now defunct social media influencer platform WiredBucks suffered a data breach that was later redistributed as part of a larger corpus of data. The incident exposed over 900k email and IP addresses alongside names, usernames, earnings via the platform, physical addresses and passwords stored as plain text. Exposed data: earnings, email addresses, ip addresses, names, passwords, physical addresses, usernames. The breach dates from May 25, 2022; Have I Been Pwned loaded it on Jun 10, 2025.","tags":["data-breach","hibp","earnings","email-addresses","ip-addresses","names","passwords","physical-addresses","usernames"],"title":"WiredBucks data breach: 918K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/wiredbucks-data-breach","vendor":"WiredBucks"},{"auto":true,"category":"patch","closedAt":"2025-06-23","cveIds":["CVE-2024-42009"],"exploited":"in-the-wild","identifiers":["CVE-2024-42009"],"json":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2024-42009.json","latestUpdate":{"date":"2025-06-09","title":"CISA added CVE-2024-42009 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 30, 2025)"},"patchStatus":"unknown","product":"Webmail","severity":"critical","severityNote":"CVSS 9.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-webmail-cve-2024-42009","stacks":[],"startedAt":"2025-06-09","status":"closed","summary":"RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. CISA added CVE-2024-42009 to its Known Exploited Vulnerabilities catalog on Jun 9, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"RoundCube Webmail Cross-Site Scripting Vulnerability (CVE-2024-42009)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2024-42009","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2025-06-23","cveIds":["CVE-2025-32433"],"exploited":"in-the-wild","identifiers":["CVE-2025-32433"],"json":"https://helix.ml/threat-watch/i/erlang-erlang-otp-cve-2025-32433.json","latestUpdate":{"date":"2025-06-09","title":"CISA added CVE-2025-32433 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 30, 2025)"},"patchStatus":"patched","product":"Erlang/OTP","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"erlang-erlang-otp-cve-2025-32433","stacks":[],"startedAt":"2025-06-09","status":"closed","summary":"Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE. CISA added CVE-2025-32433 to its Known Exploited Vulnerabilities catalog on Jun 9, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-306"],"title":"Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability (CVE-2025-32433)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/erlang-erlang-otp-cve-2025-32433","vendor":"Erlang"},{"auto":true,"category":"breach","closedAt":"2025-06-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DISKUNION"],"json":"https://helix.ml/threat-watch/i/diskunion-data-breach.json","latestUpdate":{"date":"2025-06-07","title":"Have I Been Pwned loaded 690K breached Disk Union accounts"},"patchStatus":"no-fix-needed","product":"diskunion.net","severity":"high","severityNote":"690K accounts · passwords exposed","slug":"diskunion-data-breach","stacks":[],"startedAt":"2025-06-07","status":"closed","summary":"In June 2022, the Japanese record chain store Disk Union suffered a data breach. The incident exposed 690k unique email addresses along with names, post codes, phone numbers and plain text passwords. Exposed data: email addresses, geographic locations, names, passwords, phone numbers, usernames. The breach dates from Jun 24, 2022; Have I Been Pwned loaded it on Jun 7, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","phone-numbers","usernames"],"title":"Disk Union data breach: 690K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/diskunion-data-breach","vendor":"Disk Union"},{"auto":true,"category":"patch","closedAt":"2025-06-19","cveIds":["CVE-2025-5419"],"exploited":"in-the-wild","identifiers":["CVE-2025-5419"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-5419.json","latestUpdate":{"date":"2025-06-05","title":"CISA added CVE-2025-5419 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 26, 2025)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2025-5419","stacks":["browser"],"startedAt":"2025-06-05","status":"closed","summary":"Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2025-5419 to its Known Exploited Vulnerabilities catalog on Jun 5, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125","cwe-787"],"title":"Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (CVE-2025-5419)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2025-5419","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2025-06-17","cveIds":["CVE-2025-21479"],"exploited":"in-the-wild","identifiers":["CVE-2025-21479"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2025-21479.json","latestUpdate":{"date":"2025-06-03","title":"CISA added CVE-2025-21479 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 24, 2025)"},"patchStatus":"unknown","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2025-21479","stacks":[],"startedAt":"2025-06-03","status":"closed","summary":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. CISA added CVE-2025-21479 to its Known Exploited Vulnerabilities catalog on Jun 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-863"],"title":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (CVE-2025-21479)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2025-21479","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2025-06-17","cveIds":["CVE-2025-21480"],"exploited":"in-the-wild","identifiers":["CVE-2025-21480"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2025-21480.json","latestUpdate":{"date":"2025-06-03","title":"CISA added CVE-2025-21480 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 24, 2025)"},"patchStatus":"unknown","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2025-21480","stacks":[],"startedAt":"2025-06-03","status":"closed","summary":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. CISA added CVE-2025-21480 to its Known Exploited Vulnerabilities catalog on Jun 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-863"],"title":"Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (CVE-2025-21480)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2025-21480","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2025-06-17","cveIds":["CVE-2025-27038"],"exploited":"in-the-wild","identifiers":["CVE-2025-27038"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2025-27038.json","latestUpdate":{"date":"2025-06-03","title":"CISA added CVE-2025-27038 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 24, 2025)"},"patchStatus":"unknown","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2025-27038","stacks":[],"startedAt":"2025-06-03","status":"closed","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome. CISA added CVE-2025-27038 to its Known Exploited Vulnerabilities catalog on Jun 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2025-27038)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2025-27038","vendor":"Qualcomm"},{"auto":true,"category":"breach","closedAt":"2025-06-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COLOCROSSING"],"json":"https://helix.ml/threat-watch/i/colocrossing-data-breach.json","latestUpdate":{"date":"2025-06-03","title":"Have I Been Pwned loaded 7183 breached ColoCrossing accounts"},"patchStatus":"no-fix-needed","product":"colocrossing.com","severity":"high","severityNote":"7183 accounts · passwords exposed","slug":"colocrossing-data-breach","stacks":[],"startedAt":"2025-06-03","status":"closed","summary":"In May 2025, hosting provider ColoCrossing identified a data breach that impacted customers of their ColoCloud virtual server product. ColoCrossing advised the incident was isolated to their cloud/VPS platform and stemmed from a single sign-on vulnerability. 7k email addresses were exposed in the incident along with names and MD5-Crypt password hashes. Exposed data: email addresses, names, passwords. The breach dates from May 24, 2025; Have I Been Pwned loaded it on Jun 3, 2025.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"ColoCrossing data breach: 7183 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/colocrossing-data-breach","vendor":"ColoCrossing"},{"auto":true,"category":"patch","closedAt":"2025-06-16","cveIds":["CVE-2021-32030"],"exploited":"in-the-wild","identifiers":["CVE-2021-32030"],"json":"https://helix.ml/threat-watch/i/asus-routers-cve-2021-32030.json","latestUpdate":{"date":"2025-06-02","title":"CISA added CVE-2021-32030 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2025)"},"patchStatus":"unknown","product":"Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"asus-routers-cve-2021-32030","stacks":["network"],"startedAt":"2025-06-02","status":"closed","summary":"ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2021-32030 to its Known Exploited Vulnerabilities catalog on Jun 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"ASUS Routers Improper Authentication Vulnerability (CVE-2021-32030)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/asus-routers-cve-2021-32030","vendor":"ASUS"},{"auto":true,"category":"patch","closedAt":"2025-06-16","cveIds":["CVE-2025-3935"],"exploited":"in-the-wild","identifiers":["CVE-2025-3935"],"json":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2025-3935.json","latestUpdate":{"date":"2025-06-02","title":"CISA added CVE-2025-3935 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2025)"},"patchStatus":"unknown","product":"ScreenConnect","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"connectwise-screenconnect-cve-2025-3935","stacks":[],"startedAt":"2025-06-02","status":"closed","summary":"ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. CISA added CVE-2025-3935 to its Known Exploited Vulnerabilities catalog on Jun 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-287"],"title":"ConnectWise ScreenConnect Improper Authentication Vulnerability (CVE-2025-3935)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2025-3935","vendor":"ConnectWise"},{"auto":true,"category":"patch","closedAt":"2025-06-16","cveIds":["CVE-2025-35939"],"exploited":"in-the-wild","identifiers":["CVE-2025-35939"],"json":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2025-35939.json","latestUpdate":{"date":"2025-06-02","title":"CISA added CVE-2025-35939 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2025)"},"patchStatus":"patched","product":"Craft CMS","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"craft-cms-craft-cms-cve-2025-35939","stacks":[],"startedAt":"2025-06-02","status":"closed","summary":"Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432. CISA added CVE-2025-35939 to its Known Exploited Vulnerabilities catalog on Jun 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-472"],"title":"Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability (CVE-2025-35939)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2025-35939","vendor":"Craft CMS"},{"auto":true,"category":"patch","closedAt":"2025-06-16","cveIds":["CVE-2024-56145"],"exploited":"in-the-wild","identifiers":["CVE-2024-56145"],"json":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2024-56145.json","latestUpdate":{"date":"2025-06-02","title":"CISA added CVE-2024-56145 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2025)"},"patchStatus":"patched","product":"Craft CMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"craft-cms-craft-cms-cve-2024-56145","stacks":[],"startedAt":"2025-06-02","status":"closed","summary":"Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled. CISA added CVE-2024-56145 to its Known Exploited Vulnerabilities catalog on Jun 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Craft CMS Code Injection Vulnerability (CVE-2024-56145)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2024-56145","vendor":"Craft CMS"},{"auto":true,"category":"patch","closedAt":"2025-06-16","cveIds":["CVE-2023-39780"],"exploited":"in-the-wild","identifiers":["CVE-2023-39780"],"json":"https://helix.ml/threat-watch/i/asus-rt-ax55-routers-cve-2023-39780.json","latestUpdate":{"date":"2025-06-02","title":"CISA added CVE-2023-39780 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2025)"},"patchStatus":"unknown","product":"RT-AX55 Routers","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"asus-rt-ax55-routers-cve-2023-39780","stacks":["network"],"startedAt":"2025-06-02","status":"closed","summary":"ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346. CISA added CVE-2023-39780 to its Known Exploited Vulnerabilities catalog on Jun 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"ASUS RT-AX55 Routers OS Command Injection Vulnerability (CVE-2023-39780)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/asus-rt-ax55-routers-cve-2023-39780","vendor":"ASUS"},{"auto":true,"category":"breach","closedAt":"2025-06-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FREEMOBILE"],"json":"https://helix.ml/threat-watch/i/freemobile-data-breach.json","latestUpdate":{"date":"2025-05-27","title":"Have I Been Pwned loaded 13.9M breached Free accounts"},"patchStatus":"no-fix-needed","product":"free.fr","severity":"high","severityNote":"13.9M accounts · financial data exposed","slug":"freemobile-data-breach","stacks":[],"startedAt":"2025-05-27","status":"closed","summary":"In October 2024, French ISP \"Free\" suffered a data breach which was subsequently posted for sale and later, leaked publicly. The data included 14M unique email addresses along with names, physical addresses, phone numbers, genders, dates of birth and for many records, IBAN bank account numbers. Free advised that the numbers were \"not enough to make a direct debit from a bank\". Exposed data: bank account numbers, dates of birth, genders, names, phone numbers, physical addresses. The breach dates from Oct 17, 2024; Have I Been Pwned loaded it on May 27, 2025.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","genders","names","phone-numbers","physical-addresses"],"title":"Free data breach: 13.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/freemobile-data-breach","vendor":"Free"},{"auto":true,"category":"breach","closedAt":"2025-06-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OPERATIONENDGAME2"],"json":"https://helix.ml/threat-watch/i/operationendgame2-data-breach.json","latestUpdate":{"date":"2025-05-23","title":"Have I Been Pwned loaded 15.4M breached Operation Endgame 2.0 accounts"},"patchStatus":"no-fix-needed","product":"Operation Endgame 2.0","severity":"high","severityNote":"15.4M accounts · passwords exposed","slug":"operationendgame2-data-breach","stacks":[],"startedAt":"2025-05-23","status":"closed","summary":"In May 2025, a coalition of law enforcement agencies took down the criminal infrastructure behind the malware used to launch ransomware attacks in a new phase of \"Operation Endgame\". This followed the first Operation Endgame exercise a year earlier, with the latest action resulting in 15.3M victim email addresses being provided to HIBP by law enforcement. A further 43.8M victim passwords were also provided for HIBP's Pwned Passwords service. Exposed data: email addresses, passwords. The breach dates from May 23, 2025; Have I Been Pwned loaded it on May 23, 2025.","tags":["data-breach","hibp","malware","email-addresses","passwords"],"title":"Operation Endgame 2.0 data breach: 15.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/operationendgame2-data-breach","vendor":"Operation Endgame 2.0"},{"auto":true,"category":"patch","closedAt":"2025-06-05","cveIds":["CVE-2025-4632"],"exploited":"in-the-wild","identifiers":["CVE-2025-4632"],"json":"https://helix.ml/threat-watch/i/samsung-magicinfo-9-server-cve-2025-4632.json","latestUpdate":{"date":"2025-05-22","title":"CISA added CVE-2025-4632 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 12, 2025)"},"patchStatus":"patched","product":"MagicINFO 9 Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-magicinfo-9-server-cve-2025-4632","stacks":[],"startedAt":"2025-05-22","status":"closed","summary":"Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority. CISA added CVE-2025-4632 to its Known Exploited Vulnerabilities catalog on May 22, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Samsung MagicINFO 9 Server Path Traversal Vulnerability (CVE-2025-4632)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/samsung-magicinfo-9-server-cve-2025-4632","vendor":"Samsung"},{"auto":true,"category":"breach","closedAt":"2025-06-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FFR"],"json":"https://helix.ml/threat-watch/i/ffr-data-breach.json","latestUpdate":{"date":"2025-05-22","title":"Have I Been Pwned loaded 281K breached Fédération Francaise de Rugby accounts"},"patchStatus":"no-fix-needed","product":"ffr.fr","severity":"medium","severityNote":"281K accounts","slug":"ffr-data-breach","stacks":[],"startedAt":"2025-05-22","status":"closed","summary":"In June 2023, the Fédération Francaise de Rugby (French Rugby Federation) suffered a data breach and attempted ransom. The breach exposed 282k unique email addresses along with names, dates of birth and phone numbers. The Federation subsequently published a disclosure notice and stated that the attack primarily affected email servers. Exposed data: dates of birth, email addresses, names, phone numbers. The breach dates from Jul 6, 2023; Have I Been Pwned loaded it on May 22, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers"],"title":"Fédération Francaise de Rugby data breach: 281K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ffr-data-breach","vendor":"Fédération Francaise de Rugby"},{"auto":true,"category":"patch","closedAt":"2025-06-02","cveIds":["CVE-2023-38950"],"exploited":"in-the-wild","identifiers":["CVE-2023-38950"],"json":"https://helix.ml/threat-watch/i/zkteco-biotime-cve-2023-38950.json","latestUpdate":{"date":"2025-05-19","title":"CISA added CVE-2023-38950 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2025)"},"patchStatus":"unknown","product":"BioTime","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"zkteco-biotime-cve-2023-38950","stacks":[],"startedAt":"2025-05-19","status":"closed","summary":"ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload. CISA added CVE-2023-38950 to its Known Exploited Vulnerabilities catalog on May 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"ZKTeco BioTime Path Traversal Vulnerability (CVE-2023-38950)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/zkteco-biotime-cve-2023-38950","vendor":"ZKTeco"},{"auto":true,"category":"patch","closedAt":"2025-06-02","cveIds":["CVE-2024-27443"],"exploited":"in-the-wild","identifiers":["CVE-2024-27443"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2024-27443.json","latestUpdate":{"date":"2025-05-19","title":"CISA added CVE-2024-27443 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2025)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2024-27443","stacks":[],"startedAt":"2025-05-19","status":"closed","summary":"Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code. CISA added CVE-2024-27443 to its Known Exploited Vulnerabilities catalog on May 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2024-27443)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2024-27443","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2025-06-02","cveIds":["CVE-2025-27920"],"exploited":"in-the-wild","identifiers":["CVE-2025-27920"],"json":"https://helix.ml/threat-watch/i/srimax-output-messenger-cve-2025-27920.json","latestUpdate":{"date":"2025-05-19","title":"CISA added CVE-2025-27920 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2025)"},"patchStatus":"unknown","product":"Output Messenger","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"srimax-output-messenger-cve-2025-27920","stacks":[],"startedAt":"2025-05-19","status":"closed","summary":"Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access. CISA added CVE-2025-27920 to its Known Exploited Vulnerabilities catalog on May 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Srimax Output Messenger Directory Traversal Vulnerability (CVE-2025-27920)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/srimax-output-messenger-cve-2025-27920","vendor":"Srimax"},{"auto":true,"category":"patch","closedAt":"2025-06-02","cveIds":["CVE-2024-11182"],"exploited":"in-the-wild","identifiers":["CVE-2024-11182"],"json":"https://helix.ml/threat-watch/i/mdaemon-email-server-cve-2024-11182.json","latestUpdate":{"date":"2025-05-19","title":"CISA added CVE-2024-11182 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2025)"},"patchStatus":"unknown","product":"Email Server","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"mdaemon-email-server-cve-2024-11182","stacks":[],"startedAt":"2025-05-19","status":"closed","summary":"MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message. CISA added CVE-2024-11182 to its Known Exploited Vulnerabilities catalog on May 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability (CVE-2024-11182)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/mdaemon-email-server-cve-2024-11182","vendor":"MDaemon"},{"auto":true,"category":"patch","closedAt":"2025-06-02","cveIds":["CVE-2025-4428"],"exploited":"in-the-wild","identifiers":["CVE-2025-4428"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4428.json","latestUpdate":{"date":"2025-05-19","title":"CISA added CVE-2025-4428 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2025)"},"patchStatus":"unknown","product":"Endpoint Manager Mobile (EPMM)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-cve-2025-4428","stacks":[],"startedAt":"2025-05-19","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. CISA added CVE-2025-4428 to its Known Exploited Vulnerabilities catalog on May 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (CVE-2025-4428)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4428","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2025-06-02","cveIds":["CVE-2025-4427"],"exploited":"in-the-wild","identifiers":["CVE-2025-4427"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427.json","latestUpdate":{"date":"2025-05-19","title":"CISA added CVE-2025-4427 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2025)"},"patchStatus":"unknown","product":"Endpoint Manager Mobile (EPMM)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-cve-2025-4427","stacks":[],"startedAt":"2025-05-19","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. CISA added CVE-2025-4427 to its Known Exploited Vulnerabilities catalog on May 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability (CVE-2025-4427)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2025-05-29","cveIds":["CVE-2025-42999"],"exploited":"in-the-wild","identifiers":["CVE-2025-42999"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2025-42999.json","latestUpdate":{"date":"2025-05-15","title":"CISA added CVE-2025-42999 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 5, 2025)"},"patchStatus":"unknown","product":"NetWeaver","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2025-42999","stacks":[],"startedAt":"2025-05-15","status":"closed","summary":"SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. CISA added CVE-2025-42999 to its Known Exploited Vulnerabilities catalog on May 15, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"SAP NetWeaver Deserialization Vulnerability (CVE-2025-42999)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2025-42999","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2025-05-29","cveIds":["CVE-2024-12987"],"exploited":"in-the-wild","identifiers":["CVE-2024-12987"],"json":"https://helix.ml/threat-watch/i/draytek-vigor-routers-cve-2024-12987.json","latestUpdate":{"date":"2025-05-15","title":"CISA added CVE-2024-12987 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 5, 2025)"},"patchStatus":"unknown","product":"Vigor Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"draytek-vigor-routers-cve-2024-12987","stacks":["network"],"startedAt":"2025-05-15","status":"closed","summary":"DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface. CISA added CVE-2024-12987 to its Known Exploited Vulnerabilities catalog on May 15, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"DrayTek Vigor Routers OS Command Injection Vulnerability (CVE-2024-12987)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/draytek-vigor-routers-cve-2024-12987","vendor":"DrayTek"},{"auto":true,"category":"patch","closedAt":"2025-05-28","cveIds":["CVE-2025-32756"],"exploited":"in-the-wild","identifiers":["CVE-2025-32756"],"json":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-32756.json","latestUpdate":{"date":"2025-05-14","title":"CISA added CVE-2025-32756 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 4, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-multiple-products-cve-2025-32756","stacks":["network"],"startedAt":"2025-05-14","status":"closed","summary":"Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. CISA added CVE-2025-32756 to its Known Exploited Vulnerabilities catalog on May 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-124"],"title":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability (CVE-2025-32756)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-32756","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2025-05-27","cveIds":["CVE-2025-32709"],"exploited":"in-the-wild","identifiers":["CVE-2025-32709"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-32709.json","latestUpdate":{"date":"2025-05-13","title":"CISA added CVE-2025-32709 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-32709","stacks":["windows"],"startedAt":"2025-05-13","status":"closed","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator. CISA added CVE-2025-32709 to its Known Exploited Vulnerabilities catalog on May 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-416"],"title":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (CVE-2025-32709)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-32709","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-05-27","cveIds":["CVE-2025-30397"],"exploited":"in-the-wild","identifiers":["CVE-2025-30397"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-30397.json","latestUpdate":{"date":"2025-05-13","title":"CISA added CVE-2025-30397 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-30397","stacks":["windows"],"startedAt":"2025-05-13","status":"closed","summary":"Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL. CISA added CVE-2025-30397 to its Known Exploited Vulnerabilities catalog on May 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Microsoft Windows Scripting Engine Type Confusion Vulnerability (CVE-2025-30397)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-30397","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-05-27","cveIds":["CVE-2025-32706"],"exploited":"in-the-wild","identifiers":["CVE-2025-32706"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-32706.json","latestUpdate":{"date":"2025-05-13","title":"CISA added CVE-2025-32706 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-32706","stacks":["windows"],"startedAt":"2025-05-13","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2025-32706 to its Known Exploited Vulnerabilities catalog on May 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability (CVE-2025-32706)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-32706","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-05-27","cveIds":["CVE-2025-32701"],"exploited":"in-the-wild","identifiers":["CVE-2025-32701"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-32701.json","latestUpdate":{"date":"2025-05-13","title":"CISA added CVE-2025-32701 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-32701","stacks":["windows"],"startedAt":"2025-05-13","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2025-32701 to its Known Exploited Vulnerabilities catalog on May 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability (CVE-2025-32701)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-32701","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-05-27","cveIds":["CVE-2025-30400"],"exploited":"in-the-wild","identifiers":["CVE-2025-30400"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-30400.json","latestUpdate":{"date":"2025-05-13","title":"CISA added CVE-2025-30400 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-30400","stacks":["windows"],"startedAt":"2025-05-13","status":"closed","summary":"Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2025-30400 to its Known Exploited Vulnerabilities catalog on May 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Windows DWM Core Library Use-After-Free Vulnerability (CVE-2025-30400)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-30400","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-05-26","cveIds":["CVE-2025-47729"],"exploited":"in-the-wild","identifiers":["CVE-2025-47729"],"json":"https://helix.ml/threat-watch/i/telemessage-tm-sgnl-cve-2025-47729.json","latestUpdate":{"date":"2025-05-12","title":"CISA added CVE-2025-47729 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2025)"},"patchStatus":"unknown","product":"TM SGNL","severity":"medium","severityNote":"CVSS 4.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"telemessage-tm-sgnl-cve-2025-47729","stacks":[],"startedAt":"2025-05-12","status":"closed","summary":"TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users. CISA added CVE-2025-47729 to its Known Exploited Vulnerabilities catalog on May 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-912"],"title":"TeleMessage TM SGNL Hidden Functionality Vulnerability (CVE-2025-47729)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/telemessage-tm-sgnl-cve-2025-47729","vendor":"TeleMessage"},{"auto":true,"category":"breach","closedAt":"2025-05-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ONRPG"],"json":"https://helix.ml/threat-watch/i/onrpg-data-breach.json","latestUpdate":{"date":"2025-05-08","title":"Have I Been Pwned loaded 1.0M breached OnRPG accounts"},"patchStatus":"no-fix-needed","product":"onrpg.com","severity":"high","severityNote":"1.0M accounts · passwords exposed","slug":"onrpg-data-breach","stacks":[],"startedAt":"2025-05-08","status":"closed","summary":"In July 2016, the now defunct free online games list website OnRPG suffered a data breach that was later redistributed as part of a larger corpus of data. The incident exposed just over 1M email and IP addresses alongside usernames and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on May 8, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"OnRPG data breach: 1.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/onrpg-data-breach","vendor":"OnRPG"},{"auto":true,"category":"patch","closedAt":"2025-05-21","cveIds":["CVE-2024-11120"],"exploited":"in-the-wild","identifiers":["CVE-2024-11120"],"json":"https://helix.ml/threat-watch/i/geovision-multiple-devices-cve-2024-11120.json","latestUpdate":{"date":"2025-05-07","title":"CISA added CVE-2024-11120 to the Known Exploited Vulnerabilities catalog (federal remediation due May 28, 2025)"},"patchStatus":"unknown","product":"Multiple Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"geovision-multiple-devices-cve-2024-11120","stacks":[],"startedAt":"2025-05-07","status":"closed","summary":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2024-11120 to its Known Exploited Vulnerabilities catalog on May 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"GeoVision Devices OS Command Injection Vulnerability (CVE-2024-11120)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/geovision-multiple-devices-cve-2024-11120","vendor":"GeoVision"},{"auto":true,"category":"patch","closedAt":"2025-05-21","cveIds":["CVE-2024-6047"],"exploited":"in-the-wild","identifiers":["CVE-2024-6047"],"json":"https://helix.ml/threat-watch/i/geovision-multiple-devices-cve-2024-6047.json","latestUpdate":{"date":"2025-05-07","title":"CISA added CVE-2024-6047 to the Known Exploited Vulnerabilities catalog (federal remediation due May 28, 2025)"},"patchStatus":"unknown","product":"Multiple Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"geovision-multiple-devices-cve-2024-6047","stacks":[],"startedAt":"2025-05-07","status":"closed","summary":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2024-6047 to its Known Exploited Vulnerabilities catalog on May 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"GeoVision Devices OS Command Injection Vulnerability (CVE-2024-6047)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/geovision-multiple-devices-cve-2024-6047","vendor":"GeoVision"},{"auto":true,"category":"patch","closedAt":"2025-05-20","cveIds":["CVE-2025-27363"],"exploited":"in-the-wild","identifiers":["CVE-2025-27363"],"json":"https://helix.ml/threat-watch/i/freetype-freetype-cve-2025-27363.json","latestUpdate":{"date":"2025-05-06","title":"CISA added CVE-2025-27363 to the Known Exploited Vulnerabilities catalog (federal remediation due May 27, 2025)"},"patchStatus":"unknown","product":"FreeType","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"freetype-freetype-cve-2025-27363","stacks":[],"startedAt":"2025-05-06","status":"closed","summary":"FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution. CISA added CVE-2025-27363 to its Known Exploited Vulnerabilities catalog on May 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"FreeType Out-of-Bounds Write Vulnerability (CVE-2025-27363)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/freetype-freetype-cve-2025-27363","vendor":"FreeType"},{"auto":true,"category":"patch","closedAt":"2025-05-19","cveIds":["CVE-2025-3248"],"exploited":"in-the-wild","identifiers":["CVE-2025-3248"],"json":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2025-3248.json","latestUpdate":{"date":"2025-05-05","title":"CISA added CVE-2025-3248 to the Known Exploited Vulnerabilities catalog (federal remediation due May 26, 2025)"},"patchStatus":"patched","product":"Langflow","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"langflow-langflow-cve-2025-3248","stacks":[],"startedAt":"2025-05-05","status":"closed","summary":"Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on May 5, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","auth-bypass","cwe-306"],"title":"Langflow Missing Authentication Vulnerability (CVE-2025-3248)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/langflow-langflow-cve-2025-3248","vendor":"Langflow"},{"auto":true,"category":"patch","closedAt":"2025-05-16","cveIds":["CVE-2025-34028"],"exploited":"in-the-wild","identifiers":["CVE-2025-34028"],"json":"https://helix.ml/threat-watch/i/commvault-command-center-cve-2025-34028.json","latestUpdate":{"date":"2025-05-02","title":"CISA added CVE-2025-34028 to the Known Exploited Vulnerabilities catalog (federal remediation due May 23, 2025)"},"patchStatus":"unknown","product":"Command Center","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"commvault-command-center-cve-2025-34028","stacks":[],"startedAt":"2025-05-02","status":"closed","summary":"Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. CISA added CVE-2025-34028 to its Known Exploited Vulnerabilities catalog on May 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"Commvault Command Center Path Traversal Vulnerability (CVE-2025-34028)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/commvault-command-center-cve-2025-34028","vendor":"Commvault"},{"auto":true,"category":"patch","closedAt":"2025-05-16","cveIds":["CVE-2024-58136"],"exploited":"in-the-wild","identifiers":["CVE-2024-58136"],"json":"https://helix.ml/threat-watch/i/yiiframework-yii-cve-2024-58136.json","latestUpdate":{"date":"2025-05-02","title":"CISA added CVE-2024-58136 to the Known Exploited Vulnerabilities catalog (federal remediation due May 23, 2025)"},"patchStatus":"patched","product":"Yii","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"yiiframework-yii-cve-2024-58136","stacks":[],"startedAt":"2025-05-02","status":"closed","summary":"Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432. CISA added CVE-2024-58136 to its Known Exploited Vulnerabilities catalog on May 2, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-424"],"title":"Yiiframework Yii Improper Protection of Alternate Path Vulnerability (CVE-2024-58136)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/yiiframework-yii-cve-2024-58136","vendor":"Yiiframework"},{"auto":true,"category":"patch","closedAt":"2025-05-15","cveIds":["CVE-2024-38475"],"exploited":"in-the-wild","identifiers":["CVE-2024-38475"],"json":"https://helix.ml/threat-watch/i/apache-http-server-cve-2024-38475.json","latestUpdate":{"date":"2025-05-01","title":"CISA added CVE-2024-38475 to the Known Exploited Vulnerabilities catalog (federal remediation due May 22, 2025)"},"patchStatus":"patched","product":"HTTP Server","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-http-server-cve-2024-38475","stacks":[],"startedAt":"2025-05-01","status":"closed","summary":"Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. CISA added CVE-2024-38475 to its Known Exploited Vulnerabilities catalog on May 1, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-116"],"title":"Apache HTTP Server Improper Escaping of Output Vulnerability (CVE-2024-38475)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-http-server-cve-2024-38475","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2025-05-15","cveIds":["CVE-2023-44221"],"exploited":"in-the-wild","identifiers":["CVE-2023-44221"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma100-appliances-cve-2023-44221.json","latestUpdate":{"date":"2025-05-01","title":"CISA added CVE-2023-44221 to the Known Exploited Vulnerabilities catalog (federal remediation due May 22, 2025)"},"patchStatus":"unknown","product":"SMA100 Appliances","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma100-appliances-cve-2023-44221","stacks":["vpn"],"startedAt":"2025-05-01","status":"closed","summary":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. CISA added CVE-2023-44221 to its Known Exploited Vulnerabilities catalog on May 1, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"SonicWall SMA100 Appliances OS Command Injection Vulnerability (CVE-2023-44221)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma100-appliances-cve-2023-44221","vendor":"SonicWall"},{"auto":true,"category":"breach","closedAt":"2025-05-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TEHETSEGKAPU"],"json":"https://helix.ml/threat-watch/i/tehetsegkapu-data-breach.json","latestUpdate":{"date":"2025-05-01","title":"Have I Been Pwned loaded 54K breached TehetségKapu accounts"},"patchStatus":"no-fix-needed","product":"tehetsegkapu.hu","severity":"medium","severityNote":"54K accounts","slug":"tehetsegkapu-data-breach","stacks":[],"startedAt":"2025-05-01","status":"closed","summary":"In March 2025, almost 55k records were breached from the Hungarian education office website TehetségKapu. The data was subsequently published to a popular hacking forum and included email addresses, names and usernames. Exposed data: email addresses, names, usernames. The breach dates from Mar 26, 2025; Have I Been Pwned loaded it on May 1, 2025.","tags":["data-breach","hibp","email-addresses","names","usernames"],"title":"TehetségKapu data breach: 54K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tehetsegkapu-data-breach","vendor":"TehetségKapu"},{"auto":true,"category":"patch","closedAt":"2025-05-13","cveIds":["CVE-2025-31324"],"exploited":"in-the-wild","identifiers":["CVE-2025-31324"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2025-31324.json","latestUpdate":{"date":"2025-04-29","title":"CISA added CVE-2025-31324 to the Known Exploited Vulnerabilities catalog (federal remediation due May 20, 2025)"},"patchStatus":"unknown","product":"NetWeaver","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2025-31324","stacks":[],"startedAt":"2025-04-29","status":"closed","summary":"SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries. CISA added CVE-2025-31324 to its Known Exploited Vulnerabilities catalog on Apr 29, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-434"],"title":"SAP NetWeaver Unrestricted File Upload Vulnerability (CVE-2025-31324)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2025-31324","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2025-05-12","cveIds":["CVE-2025-1976"],"exploited":"in-the-wild","identifiers":["CVE-2025-1976"],"json":"https://helix.ml/threat-watch/i/broadcom-brocade-fabric-os-cve-2025-1976.json","latestUpdate":{"date":"2025-04-28","title":"CISA added CVE-2025-1976 to the Known Exploited Vulnerabilities catalog (federal remediation due May 19, 2025)"},"patchStatus":"unknown","product":"Brocade Fabric OS","severity":"medium","severityNote":"CVSS 6.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"broadcom-brocade-fabric-os-cve-2025-1976","stacks":[],"startedAt":"2025-04-28","status":"closed","summary":"Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. CISA added CVE-2025-1976 to its Known Exploited Vulnerabilities catalog on Apr 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Broadcom Brocade Fabric OS Code Injection Vulnerability (CVE-2025-1976)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/broadcom-brocade-fabric-os-cve-2025-1976","vendor":"Broadcom"},{"auto":true,"category":"patch","closedAt":"2025-05-12","cveIds":["CVE-2025-42599"],"exploited":"in-the-wild","identifiers":["CVE-2025-42599"],"json":"https://helix.ml/threat-watch/i/qualitia-active-mail-cve-2025-42599.json","latestUpdate":{"date":"2025-04-28","title":"CISA added CVE-2025-42599 to the Known Exploited Vulnerabilities catalog (federal remediation due May 19, 2025)"},"patchStatus":"unknown","product":"Active! Mail","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualitia-active-mail-cve-2025-42599","stacks":[],"startedAt":"2025-04-28","status":"closed","summary":"Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request. CISA added CVE-2025-42599 to its Known Exploited Vulnerabilities catalog on Apr 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-121"],"title":"Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability (CVE-2025-42599)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualitia-active-mail-cve-2025-42599","vendor":"Qualitia"},{"auto":true,"category":"patch","closedAt":"2025-05-12","cveIds":["CVE-2025-3928"],"exploited":"in-the-wild","identifiers":["CVE-2025-3928"],"json":"https://helix.ml/threat-watch/i/commvault-web-server-cve-2025-3928.json","latestUpdate":{"date":"2025-04-28","title":"CISA added CVE-2025-3928 to the Known Exploited Vulnerabilities catalog (federal remediation due May 19, 2025)"},"patchStatus":"unknown","product":"Web Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"commvault-web-server-cve-2025-3928","stacks":[],"startedAt":"2025-04-28","status":"closed","summary":"Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells. CISA added CVE-2025-3928 to its Known Exploited Vulnerabilities catalog on Apr 28, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Commvault Web Server Unspecified Vulnerability (CVE-2025-3928)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/commvault-web-server-cve-2025-3928","vendor":"Commvault"},{"auto":true,"category":"patch","closedAt":"2025-05-01","cveIds":["CVE-2025-24054"],"exploited":"in-the-wild","identifiers":["CVE-2025-24054"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24054.json","latestUpdate":{"date":"2025-04-17","title":"CISA added CVE-2025-24054 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-24054","stacks":["windows"],"startedAt":"2025-04-17","status":"closed","summary":"Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network. CISA added CVE-2025-24054 to its Known Exploited Vulnerabilities catalog on Apr 17, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-73"],"title":"Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability (CVE-2025-24054)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24054","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-05-01","cveIds":["CVE-2025-31201"],"exploited":"in-the-wild","identifiers":["CVE-2025-31201"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-31201.json","latestUpdate":{"date":"2025-04-17","title":"CISA added CVE-2025-31201 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-31201","stacks":[],"startedAt":"2025-04-17","status":"closed","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. CISA added CVE-2025-31201 to its Known Exploited Vulnerabilities catalog on Apr 17, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple Multiple Products Arbitrary Read and Write Vulnerability (CVE-2025-31201)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-31201","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2025-05-01","cveIds":["CVE-2025-31200"],"exploited":"in-the-wild","identifiers":["CVE-2025-31200"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-31200.json","latestUpdate":{"date":"2025-04-17","title":"CISA added CVE-2025-31200 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-31200","stacks":[],"startedAt":"2025-04-17","status":"closed","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. CISA added CVE-2025-31200 to its Known Exploited Vulnerabilities catalog on Apr 17, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2025-31200)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-31200","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2025-04-30","cveIds":["CVE-2021-20035"],"exploited":"in-the-wild","identifiers":["CVE-2021-20035"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma100-appliances-cve-2021-20035.json","latestUpdate":{"date":"2025-04-16","title":"CISA added CVE-2021-20035 to the Known Exploited Vulnerabilities catalog (federal remediation due May 7, 2025)"},"patchStatus":"unknown","product":"SMA100 Appliances","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma100-appliances-cve-2021-20035","stacks":["vpn"],"startedAt":"2025-04-16","status":"closed","summary":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution. CISA added CVE-2021-20035 to its Known Exploited Vulnerabilities catalog on Apr 16, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"SonicWall SMA100 Appliances OS Command Injection Vulnerability (CVE-2021-20035)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma100-appliances-cve-2021-20035","vendor":"SonicWall"},{"auto":true,"category":"breach","closedAt":"2025-04-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SAMSUNGGERMANY"],"json":"https://helix.ml/threat-watch/i/samsunggermany-data-breach.json","latestUpdate":{"date":"2025-04-13","title":"Have I Been Pwned loaded 216K breached Samsung Germany Customer Tickets accounts"},"patchStatus":"no-fix-needed","product":"samsung.de","severity":"medium","severityNote":"216K accounts","slug":"samsunggermany-data-breach","stacks":[],"startedAt":"2025-04-13","status":"closed","summary":"In March 2025, data from Samsung Germany was compromised in a data breach of their logistics provider, Spectos. Allegedly due to credentials being obtained by malware running on a Spectos employee's machine, the breach included 216k unique email addresses along with names, physical addresses, items purchased from Samsung Germany and related support tickets and shipping tracking numbers. Exposed data: email addresses, names, physical addresses, purchases, salutations, shipment tracking numbers, support tickets. The breach dates from Mar 30, 2025; Have I Been Pwned loaded it on Apr 13, 2025.","tags":["data-breach","hibp","email-addresses","names","physical-addresses","purchases","salutations","shipment-tracking-numbers","support-tickets"],"title":"Samsung Germany Customer Tickets data breach: 216K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/samsunggermany-data-breach","vendor":"Samsung Germany Customer Tickets"},{"auto":true,"category":"patch","closedAt":"2025-04-23","cveIds":["CVE-2024-53150"],"exploited":"in-the-wild","identifiers":["CVE-2024-53150"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-53150.json","latestUpdate":{"date":"2025-04-09","title":"CISA added CVE-2024-53150 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 30, 2025)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2024-53150","stacks":["linux"],"startedAt":"2025-04-09","status":"closed","summary":"Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information. CISA added CVE-2024-53150 to its Known Exploited Vulnerabilities catalog on Apr 9, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Linux Kernel Out-of-Bounds Read Vulnerability (CVE-2024-53150)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-53150","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2025-04-23","cveIds":["CVE-2024-53197"],"exploited":"in-the-wild","identifiers":["CVE-2024-53197"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-53197.json","latestUpdate":{"date":"2025-04-09","title":"CISA added CVE-2024-53197 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 30, 2025)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2024-53197","stacks":["linux"],"startedAt":"2025-04-09","status":"closed","summary":"Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code. CISA added CVE-2024-53197 to its Known Exploited Vulnerabilities catalog on Apr 9, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","privilege-escalation","memory-corruption","cwe-787"],"title":"Linux Kernel Out-of-Bounds Access Vulnerability (CVE-2024-53197)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-53197","vendor":"Linux"},{"auto":true,"category":"breach","closedAt":"2025-04-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QRAVED"],"json":"https://helix.ml/threat-watch/i/qraved-data-breach.json","latestUpdate":{"date":"2025-04-09","title":"Have I Been Pwned loaded 984K breached Qraved accounts"},"patchStatus":"no-fix-needed","product":"qraved.com","severity":"high","severityNote":"984K accounts · passwords exposed","slug":"qraved-data-breach","stacks":[],"startedAt":"2025-04-09","status":"closed","summary":"In July 2021, the Indonesian restaurant website Qraved suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed almost 1M unique email addresses along with names, phone numbers, dates of birth and passwords stored as MD5 hashes. Exposed data: dates of birth, email addresses, names, passwords, phone numbers. The breach dates from Jul 9, 2021; Have I Been Pwned loaded it on Apr 9, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers"],"title":"Qraved data breach: 984K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/qraved-data-breach","vendor":"Qraved"},{"auto":true,"category":"patch","closedAt":"2025-04-22","cveIds":["CVE-2025-29824"],"exploited":"in-the-wild","identifiers":["CVE-2025-29824"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-29824.json","latestUpdate":{"date":"2025-04-08","title":"CISA added CVE-2025-29824 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 29, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-29824","stacks":["windows"],"startedAt":"2025-04-08","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2025-29824 to its Known Exploited Vulnerabilities catalog on Apr 8, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-416"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability (CVE-2025-29824)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-29824","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-04-22","cveIds":["CVE-2025-30406"],"exploited":"in-the-wild","identifiers":["CVE-2025-30406"],"json":"https://helix.ml/threat-watch/i/gladinet-centrestack-cve-2025-30406.json","latestUpdate":{"date":"2025-04-08","title":"CISA added CVE-2025-30406 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 29, 2025)"},"patchStatus":"patched","product":"CentreStack","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gladinet-centrestack-cve-2025-30406","stacks":[],"startedAt":"2025-04-08","status":"closed","summary":"Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution. CISA added CVE-2025-30406 to its Known Exploited Vulnerabilities catalog on Apr 8, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-321"],"title":"Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability (CVE-2025-30406)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/gladinet-centrestack-cve-2025-30406","vendor":"Gladinet"},{"auto":true,"category":"breach","closedAt":"2025-04-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOULANGER"],"json":"https://helix.ml/threat-watch/i/boulanger-data-breach.json","latestUpdate":{"date":"2025-04-08","title":"Have I Been Pwned loaded 2.1M breached Boulanger accounts"},"patchStatus":"no-fix-needed","product":"boulanger.com","severity":"medium","severityNote":"2.1M accounts","slug":"boulanger-data-breach","stacks":[],"startedAt":"2025-04-08","status":"closed","summary":"In September 2024, French electronics retailer Boulanger suffered a data breach that exposed over 27M rows of data. The data included 2M unique email addresses along with names, physical addresses, phone numbers and latitude and longitude. The data was later publicly published to a popular hacking forum. Exposed data: email addresses, geographic locations, latitude and longitude pairs, names, phone numbers, physical addresses. The breach dates from Sep 6, 2024; Have I Been Pwned loaded it on Apr 8, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","latitude-and-longitude-pairs","names","phone-numbers","physical-addresses"],"title":"Boulanger data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/boulanger-data-breach","vendor":"Boulanger"},{"auto":true,"category":"patch","closedAt":"2025-04-21","cveIds":["CVE-2025-31161"],"exploited":"in-the-wild","identifiers":["CVE-2025-31161"],"json":"https://helix.ml/threat-watch/i/crushftp-crushftp-cve-2025-31161.json","latestUpdate":{"date":"2025-04-07","title":"CISA added CVE-2025-31161 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2025)"},"patchStatus":"unknown","product":"CrushFTP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"crushftp-crushftp-cve-2025-31161","stacks":[],"startedAt":"2025-04-07","status":"closed","summary":"CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. CISA added CVE-2025-31161 to its Known Exploited Vulnerabilities catalog on Apr 7, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-305"],"title":"CrushFTP Authentication Bypass Vulnerability (CVE-2025-31161)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/crushftp-crushftp-cve-2025-31161","vendor":"CrushFTP"},{"auto":true,"category":"patch","closedAt":"2025-04-18","cveIds":["CVE-2025-22457"],"exploited":"in-the-wild","identifiers":["CVE-2025-22457"],"json":"https://helix.ml/threat-watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457.json","latestUpdate":{"date":"2025-04-04","title":"CISA added CVE-2025-22457 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 11, 2025)"},"patchStatus":"unknown","product":"Connect Secure, Policy Secure, and ZTA Gateways","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457","stacks":["vpn"],"startedAt":"2025-04-04","status":"closed","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. CISA added CVE-2025-22457 to its Known Exploited Vulnerabilities catalog on Apr 4, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-121"],"title":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability (CVE-2025-22457)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2025-04-15","cveIds":["CVE-2025-24813"],"exploited":"in-the-wild","identifiers":["CVE-2025-24813"],"json":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2025-24813.json","latestUpdate":{"date":"2025-04-01","title":"CISA added CVE-2025-24813 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 22, 2025)"},"patchStatus":"unknown","product":"Tomcat","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-tomcat-cve-2025-24813","stacks":["java"],"startedAt":"2025-04-01","status":"closed","summary":"Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. CISA added CVE-2025-24813 to its Known Exploited Vulnerabilities catalog on Apr 1, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-44","cwe-502"],"title":"Apache Tomcat Path Equivalence Vulnerability (CVE-2025-24813)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2025-24813","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2025-04-14","cveIds":["CVE-2024-20439"],"exploited":"in-the-wild","identifiers":["CVE-2024-20439"],"json":"https://helix.ml/threat-watch/i/cisco-smart-licensing-utility-cve-2024-20439.json","latestUpdate":{"date":"2025-03-31","title":"CISA added CVE-2024-20439 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2025)"},"patchStatus":"unknown","product":"Smart Licensing Utility","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-smart-licensing-utility-cve-2024-20439","stacks":["network"],"startedAt":"2025-03-31","status":"closed","summary":"Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. CISA added CVE-2024-20439 to its Known Exploited Vulnerabilities catalog on Mar 31, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-912"],"title":"Cisco Smart Licensing Utility Static Credential Vulnerability (CVE-2024-20439)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-smart-licensing-utility-cve-2024-20439","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2025-04-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GERMANDONERKEBAB"],"json":"https://helix.ml/threat-watch/i/germandonerkebab-data-breach.json","latestUpdate":{"date":"2025-03-30","title":"Have I Been Pwned loaded 162K breached German Doner Kebab accounts"},"patchStatus":"no-fix-needed","product":"germandonerkebab.com","severity":"medium","severityNote":"162K accounts","slug":"germandonerkebab-data-breach","stacks":[],"startedAt":"2025-03-30","status":"closed","summary":"In March 2025, data allegedly sourced from German Doner Kebab was published on a popular hacking forum. The data included 162k unique email addresses alongside names, phone numbers and physical addresses. German Doner Kebab subsequently sent a disclosure notice to impacted individuals. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Mar 27, 2025; Have I Been Pwned loaded it on Mar 30, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"German Doner Kebab data breach: 162K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/germandonerkebab-data-breach","vendor":"German Doner Kebab"},{"auto":true,"category":"patch","closedAt":"2025-04-10","cveIds":["CVE-2025-2783"],"exploited":"in-the-wild","identifiers":["CVE-2025-2783"],"json":"https://helix.ml/threat-watch/i/google-chromium-mojo-cve-2025-2783.json","latestUpdate":{"date":"2025-03-27","title":"CISA added CVE-2025-2783 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 17, 2025)"},"patchStatus":"unknown","product":"Chromium Mojo","severity":"high","severityNote":"CVSS 8.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-mojo-cve-2025-2783","stacks":["browser"],"startedAt":"2025-03-27","status":"closed","summary":"Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2025-2783 to its Known Exploited Vulnerabilities catalog on Mar 27, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Google Chromium Mojo Sandbox Escape Vulnerability (CVE-2025-2783)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-mojo-cve-2025-2783","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2025-04-09","cveIds":["CVE-2019-9875"],"exploited":"in-the-wild","identifiers":["CVE-2019-9875"],"json":"https://helix.ml/threat-watch/i/sitecore-cms-and-experience-platform-xp-cve-2019-9875.json","latestUpdate":{"date":"2025-03-26","title":"CISA added CVE-2019-9875 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 16, 2025)"},"patchStatus":"patched","product":"CMS and Experience Platform (XP)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sitecore-cms-and-experience-platform-xp-cve-2019-9875","stacks":[],"startedAt":"2025-03-26","status":"closed","summary":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. CISA added CVE-2019-9875 to its Known Exploited Vulnerabilities catalog on Mar 26, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (CVE-2019-9875)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sitecore-cms-and-experience-platform-xp-cve-2019-9875","vendor":"Sitecore"},{"auto":true,"category":"patch","closedAt":"2025-04-09","cveIds":["CVE-2019-9874"],"exploited":"in-the-wild","identifiers":["CVE-2019-9874"],"json":"https://helix.ml/threat-watch/i/sitecore-cms-and-experience-platform-xp-cve-2019-9874.json","latestUpdate":{"date":"2025-03-26","title":"CISA added CVE-2019-9874 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 16, 2025)"},"patchStatus":"patched","product":"CMS and Experience Platform (XP)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sitecore-cms-and-experience-platform-xp-cve-2019-9874","stacks":[],"startedAt":"2025-03-26","status":"closed","summary":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN. CISA added CVE-2019-9874 to its Known Exploited Vulnerabilities catalog on Mar 26, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (CVE-2019-9874)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sitecore-cms-and-experience-platform-xp-cve-2019-9874","vendor":"Sitecore"},{"auto":true,"category":"breach","closedAt":"2025-04-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TROYHUNTMAILCHIMPLIST"],"json":"https://helix.ml/threat-watch/i/troyhuntmailchimplist-data-breach.json","latestUpdate":{"date":"2025-03-25","title":"Have I Been Pwned loaded 16K breached Troy Hunt's Mailchimp List accounts"},"patchStatus":"no-fix-needed","product":"troyhunt.com","severity":"medium","severityNote":"16K accounts","slug":"troyhuntmailchimplist-data-breach","stacks":[],"startedAt":"2025-03-25","status":"closed","summary":"In March 2025, a phishing attack successfully gained access to Troy Hunt's Mailchimp account and automatically exported a list of people who had subscribed to the newsletter for his personal blog. The exported list contained 16k email addresses and other data automatically collected by Mailchimp including IP address and a derived latitude, longitude and time zone. Exposed data: email addresses, geographic locations, ip addresses, latitude and longitude pairs. The breach dates from Mar 25, 2025; Have I Been Pwned loaded it on Mar 25, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","latitude-and-longitude-pairs"],"title":"Troy Hunt's Mailchimp List data breach: 16K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/troyhuntmailchimplist-data-breach","vendor":"Troy Hunt's Mailchimp List"},{"auto":true,"category":"patch","closedAt":"2025-04-07","cveIds":["CVE-2025-30154"],"exploited":"in-the-wild","identifiers":["CVE-2025-30154"],"json":"https://helix.ml/threat-watch/i/reviewdog-action-setup-github-action-cve-2025-30154.json","latestUpdate":{"date":"2025-03-24","title":"CISA added CVE-2025-30154 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 14, 2025)"},"patchStatus":"patched","product":"action-setup GitHub Action","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"reviewdog-action-setup-github-action-cve-2025-30154","stacks":["devtools"],"startedAt":"2025-03-24","status":"closed","summary":"reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. CISA added CVE-2025-30154 to its Known Exploited Vulnerabilities catalog on Mar 24, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-506"],"title":"reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability (CVE-2025-30154)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/reviewdog-action-setup-github-action-cve-2025-30154","vendor":"reviewdog"},{"auto":true,"category":"patch","closedAt":"2025-04-02","cveIds":["CVE-2017-12637"],"exploited":"in-the-wild","identifiers":["CVE-2017-12637"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2017-12637.json","latestUpdate":{"date":"2025-03-19","title":"CISA added CVE-2017-12637 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 9, 2025)"},"patchStatus":"unknown","product":"NetWeaver","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2017-12637","stacks":[],"startedAt":"2025-03-19","status":"closed","summary":"SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string. CISA added CVE-2017-12637 to its Known Exploited Vulnerabilities catalog on Mar 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"SAP NetWeaver Directory Traversal Vulnerability (CVE-2017-12637)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2017-12637","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2025-04-02","cveIds":["CVE-2024-48248"],"exploited":"in-the-wild","identifiers":["CVE-2024-48248"],"json":"https://helix.ml/threat-watch/i/nakivo-backup-and-replication-cve-2024-48248.json","latestUpdate":{"date":"2025-03-19","title":"CISA added CVE-2024-48248 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 9, 2025)"},"patchStatus":"unknown","product":"Backup and Replication","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"nakivo-backup-and-replication-cve-2024-48248","stacks":[],"startedAt":"2025-03-19","status":"closed","summary":"NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files. CISA added CVE-2024-48248 to its Known Exploited Vulnerabilities catalog on Mar 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-36"],"title":"NAKIVO Backup and Replication Absolute Path Traversal Vulnerability (CVE-2024-48248)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/nakivo-backup-and-replication-cve-2024-48248","vendor":"NAKIVO"},{"auto":true,"category":"patch","closedAt":"2025-04-02","cveIds":["CVE-2025-1316"],"exploited":"in-the-wild","identifiers":["CVE-2025-1316"],"json":"https://helix.ml/threat-watch/i/edimax-ic-7100-ip-camera-cve-2025-1316.json","latestUpdate":{"date":"2025-03-19","title":"CISA added CVE-2025-1316 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 9, 2025)"},"patchStatus":"unknown","product":"IC-7100 IP Camera","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"edimax-ic-7100-ip-camera-cve-2025-1316","stacks":[],"startedAt":"2025-03-19","status":"closed","summary":"Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CISA added CVE-2025-1316 to its Known Exploited Vulnerabilities catalog on Mar 19, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Edimax IC-7100 IP Camera OS Command Injection Vulnerability (CVE-2025-1316)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/edimax-ic-7100-ip-camera-cve-2025-1316","vendor":"Edimax"},{"auto":true,"category":"breach","closedAt":"2025-04-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEXIPOL"],"json":"https://helix.ml/threat-watch/i/lexipol-data-breach.json","latestUpdate":{"date":"2025-03-19","title":"Have I Been Pwned loaded 672K breached Lexipol accounts"},"patchStatus":"no-fix-needed","product":"lexipol.com","severity":"high","severityNote":"672K accounts · passwords exposed","slug":"lexipol-data-breach","stacks":[],"startedAt":"2025-03-19","status":"closed","summary":"In February 2025, the public safety policy management systems company Lexipol suffered a data breach. Attributed to the self-proclaimed \"Puppygirl Hacker Polycule\", the breach exposed an extensive number of documents and user records which were subsequently published publicly. The breach included over 670k unique email addresses in the user records, along with names, phone numbers, system-generated usernames and passwords stored as either MD5 or SHA-256 hashes. Exposed data: email addresses, names, passwords, phone numbers, usernames. The breach dates from Feb 11, 2025; Have I Been Pwned loaded it on Mar 19, 2025.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","usernames"],"title":"Lexipol data breach: 672K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/lexipol-data-breach","vendor":"Lexipol"},{"auto":true,"category":"breach","closedAt":"2025-04-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPYX"],"json":"https://helix.ml/threat-watch/i/spyx-data-breach.json","latestUpdate":{"date":"2025-03-19","title":"Have I Been Pwned loaded 2.0M breached SpyX accounts"},"patchStatus":"no-fix-needed","product":"spyx.com","severity":"high","severityNote":"2.0M accounts · passwords exposed","slug":"spyx-data-breach","stacks":[],"startedAt":"2025-03-19","status":"closed","summary":"In June 2024, spyware maker SpyX suffered a data breach that exposed almost 2M unique email addresses. The breach also exposed IP addresses, countries of residence, device information and 6-digit PINs in the password field. Further, a collection of iCloud credentials likely used to monitor targets directly via the cloud were also in the breach and contained the target's email address and plain text Apple password. Exposed data: device information, email addresses, geographic locations, ip addresses, passwords. The breach dates from Jun 24, 2024; Have I Been Pwned loaded it on Mar 19, 2025.","tags":["data-breach","hibp","device-information","email-addresses","geographic-locations","ip-addresses","passwords"],"title":"SpyX data breach: 2.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/spyx-data-breach","vendor":"SpyX"},{"auto":true,"category":"patch","closedAt":"2025-04-01","cveIds":["CVE-2025-30066"],"exploited":"in-the-wild","identifiers":["CVE-2025-30066"],"json":"https://helix.ml/threat-watch/i/tj-actions-changed-files-github-action-cve-2025-30066.json","latestUpdate":{"date":"2025-03-18","title":"CISA added CVE-2025-30066 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 8, 2025)"},"patchStatus":"unknown","product":"changed-files GitHub Action","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"tj-actions-changed-files-github-action-cve-2025-30066","stacks":["devtools"],"startedAt":"2025-03-18","status":"closed","summary":"tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys. CISA added CVE-2025-30066 to its Known Exploited Vulnerabilities catalog on Mar 18, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-506"],"title":"tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability (CVE-2025-30066)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/tj-actions-changed-files-github-action-cve-2025-30066","vendor":"tj-actions"},{"auto":true,"category":"patch","closedAt":"2025-04-01","cveIds":["CVE-2025-24472"],"exploited":"in-the-wild","identifiers":["CVE-2025-24472"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472.json","latestUpdate":{"date":"2025-03-18","title":"CISA added CVE-2025-24472 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 8, 2025)"},"patchStatus":"unknown","product":"FortiOS and FortiProxy","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-and-fortiproxy-cve-2025-24472","stacks":["network","vpn"],"startedAt":"2025-03-18","status":"closed","summary":"Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. CISA added CVE-2025-24472 to its Known Exploited Vulnerabilities catalog on Mar 18, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-288"],"title":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (CVE-2025-24472)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2025-03-27","cveIds":["CVE-2025-21590"],"exploited":"in-the-wild","identifiers":["CVE-2025-21590"],"json":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2025-21590.json","latestUpdate":{"date":"2025-03-13","title":"CISA added CVE-2025-21590 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 3, 2025)"},"patchStatus":"unknown","product":"Junos OS","severity":"medium","severityNote":"CVSS 4.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-junos-os-cve-2025-21590","stacks":["network"],"startedAt":"2025-03-13","status":"closed","summary":"Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code. CISA added CVE-2025-21590 to its Known Exploited Vulnerabilities catalog on Mar 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-653"],"title":"Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability (CVE-2025-21590)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2025-21590","vendor":"Juniper"},{"auto":true,"category":"patch","closedAt":"2025-03-27","cveIds":["CVE-2025-24201"],"exploited":"in-the-wild","identifiers":["CVE-2025-24201"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-24201.json","latestUpdate":{"date":"2025-03-13","title":"CISA added CVE-2025-24201 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 3, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-24201","stacks":["browser","ios"],"startedAt":"2025-03-13","status":"closed","summary":"Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2025-24201 to its Known Exploited Vulnerabilities catalog on Mar 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability (CVE-2025-24201)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-24201","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2025-03-25","cveIds":["CVE-2025-24993"],"exploited":"in-the-wild","identifiers":["CVE-2025-24993"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24993.json","latestUpdate":{"date":"2025-03-11","title":"CISA added CVE-2025-24993 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 1, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-24993","stacks":["windows"],"startedAt":"2025-03-11","status":"closed","summary":"Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally. CISA added CVE-2025-24993 to its Known Exploited Vulnerabilities catalog on Mar 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability (CVE-2025-24993)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24993","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-25","cveIds":["CVE-2025-24991"],"exploited":"in-the-wild","identifiers":["CVE-2025-24991"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24991.json","latestUpdate":{"date":"2025-03-11","title":"CISA added CVE-2025-24991 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 1, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-24991","stacks":["windows"],"startedAt":"2025-03-11","status":"closed","summary":"Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. CISA added CVE-2025-24991 to its Known Exploited Vulnerabilities catalog on Mar 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability (CVE-2025-24991)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24991","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-25","cveIds":["CVE-2025-24985"],"exploited":"in-the-wild","identifiers":["CVE-2025-24985"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24985.json","latestUpdate":{"date":"2025-03-11","title":"CISA added CVE-2025-24985 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 1, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-24985","stacks":["windows"],"startedAt":"2025-03-11","status":"closed","summary":"Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally. CISA added CVE-2025-24985 to its Known Exploited Vulnerabilities catalog on Mar 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-190","cwe-122"],"title":"Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability (CVE-2025-24985)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24985","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-25","cveIds":["CVE-2025-24984"],"exploited":"in-the-wild","identifiers":["CVE-2025-24984"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24984.json","latestUpdate":{"date":"2025-03-11","title":"CISA added CVE-2025-24984 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 1, 2025)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 4.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-24984","stacks":["windows"],"startedAt":"2025-03-11","status":"closed","summary":"Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. CISA added CVE-2025-24984 to its Known Exploited Vulnerabilities catalog on Mar 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-532"],"title":"Microsoft Windows NTFS Information Disclosure Vulnerability (CVE-2025-24984)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24984","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-25","cveIds":["CVE-2025-24983"],"exploited":"in-the-wild","identifiers":["CVE-2025-24983"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24983.json","latestUpdate":{"date":"2025-03-11","title":"CISA added CVE-2025-24983 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 1, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-24983","stacks":["windows"],"startedAt":"2025-03-11","status":"closed","summary":"Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2025-24983 to its Known Exploited Vulnerabilities catalog on Mar 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Windows Win32k Use-After-Free Vulnerability (CVE-2025-24983)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-24983","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-25","cveIds":["CVE-2025-26633"],"exploited":"in-the-wild","identifiers":["CVE-2025-26633"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-26633.json","latestUpdate":{"date":"2025-03-11","title":"CISA added CVE-2025-26633 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 1, 2025)"},"patchStatus":"unknown","product":"Windows","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-26633","stacks":["windows"],"startedAt":"2025-03-11","status":"closed","summary":"Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally. CISA added CVE-2025-26633 to its Known Exploited Vulnerabilities catalog on Mar 11, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-707"],"title":"Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability (CVE-2025-26633)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-26633","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-24","cveIds":["CVE-2024-13161"],"exploited":"in-the-wild","identifiers":["CVE-2024-13161"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-13161.json","latestUpdate":{"date":"2025-03-10","title":"CISA added CVE-2024-13161 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 31, 2025)"},"patchStatus":"unknown","product":"Endpoint Manager (EPM)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-epm-cve-2024-13161","stacks":[],"startedAt":"2025-03-10","status":"closed","summary":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. CISA added CVE-2024-13161 to its Known Exploited Vulnerabilities catalog on Mar 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-36"],"title":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (CVE-2024-13161)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-13161","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2025-03-24","cveIds":["CVE-2024-13160"],"exploited":"in-the-wild","identifiers":["CVE-2024-13160"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-13160.json","latestUpdate":{"date":"2025-03-10","title":"CISA added CVE-2024-13160 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 31, 2025)"},"patchStatus":"unknown","product":"Endpoint Manager (EPM)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-epm-cve-2024-13160","stacks":[],"startedAt":"2025-03-10","status":"closed","summary":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. CISA added CVE-2024-13160 to its Known Exploited Vulnerabilities catalog on Mar 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-36"],"title":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (CVE-2024-13160)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-13160","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2025-03-24","cveIds":["CVE-2024-13159"],"exploited":"in-the-wild","identifiers":["CVE-2024-13159"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-13159.json","latestUpdate":{"date":"2025-03-10","title":"CISA added CVE-2024-13159 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 31, 2025)"},"patchStatus":"unknown","product":"Endpoint Manager (EPM)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-epm-cve-2024-13159","stacks":[],"startedAt":"2025-03-10","status":"closed","summary":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. CISA added CVE-2024-13159 to its Known Exploited Vulnerabilities catalog on Mar 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-36"],"title":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (CVE-2024-13159)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-13159","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2025-03-24","cveIds":["CVE-2024-57968"],"exploited":"in-the-wild","identifiers":["CVE-2024-57968"],"json":"https://helix.ml/threat-watch/i/advantive-veracore-cve-2024-57968.json","latestUpdate":{"date":"2025-03-10","title":"CISA added CVE-2024-57968 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 31, 2025)"},"patchStatus":"unknown","product":"VeraCore","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"advantive-veracore-cve-2024-57968","stacks":[],"startedAt":"2025-03-10","status":"closed","summary":"Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx. CISA added CVE-2024-57968 to its Known Exploited Vulnerabilities catalog on Mar 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"Advantive VeraCore Unrestricted File Upload Vulnerability (CVE-2024-57968)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/advantive-veracore-cve-2024-57968","vendor":"Advantive"},{"auto":true,"category":"patch","closedAt":"2025-03-24","cveIds":["CVE-2025-25181"],"exploited":"in-the-wild","identifiers":["CVE-2025-25181"],"json":"https://helix.ml/threat-watch/i/advantive-veracore-cve-2025-25181.json","latestUpdate":{"date":"2025-03-10","title":"CISA added CVE-2025-25181 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 31, 2025)"},"patchStatus":"unknown","product":"VeraCore","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"advantive-veracore-cve-2025-25181","stacks":[],"startedAt":"2025-03-10","status":"closed","summary":"Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter. CISA added CVE-2025-25181 to its Known Exploited Vulnerabilities catalog on Mar 10, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Advantive VeraCore SQL Injection Vulnerability (CVE-2025-25181)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/advantive-veracore-cve-2025-25181","vendor":"Advantive"},{"auto":true,"category":"patch","closedAt":"2025-03-18","cveIds":["CVE-2025-22226"],"exploited":"in-the-wild","identifiers":["CVE-2025-22226"],"json":"https://helix.ml/threat-watch/i/vmware-esxi-workstation-and-fusion-cve-2025-22226.json","latestUpdate":{"date":"2025-03-04","title":"CISA added CVE-2025-22226 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 25, 2025)"},"patchStatus":"unknown","product":"ESXi, Workstation, and Fusion","severity":"medium","severityNote":"CVSS 6.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-esxi-workstation-and-fusion-cve-2025-22226","stacks":["cloud"],"startedAt":"2025-03-04","status":"closed","summary":"VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process. CISA added CVE-2025-22226 to its Known Exploited Vulnerabilities catalog on Mar 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability (CVE-2025-22226)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-esxi-workstation-and-fusion-cve-2025-22226","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2025-03-18","cveIds":["CVE-2025-22225"],"exploited":"in-the-wild","identifiers":["CVE-2025-22225"],"json":"https://helix.ml/threat-watch/i/vmware-esxi-cve-2025-22225.json","latestUpdate":{"date":"2025-03-04","title":"CISA added CVE-2025-22225 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 25, 2025)"},"patchStatus":"unknown","product":"ESXi","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-esxi-cve-2025-22225","stacks":["cloud"],"startedAt":"2025-03-04","status":"closed","summary":"VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. CISA added CVE-2025-22225 to its Known Exploited Vulnerabilities catalog on Mar 4, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-123"],"title":"VMware ESXi Arbitrary Write Vulnerability (CVE-2025-22225)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-esxi-cve-2025-22225","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2025-03-18","cveIds":["CVE-2025-22224"],"exploited":"in-the-wild","identifiers":["CVE-2025-22224"],"json":"https://helix.ml/threat-watch/i/vmware-esxi-and-workstation-cve-2025-22224.json","latestUpdate":{"date":"2025-03-04","title":"CISA added CVE-2025-22224 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 25, 2025)"},"patchStatus":"unknown","product":"ESXi and Workstation","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-esxi-and-workstation-cve-2025-22224","stacks":["cloud"],"startedAt":"2025-03-04","status":"closed","summary":"VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. CISA added CVE-2025-22224 to its Known Exploited Vulnerabilities catalog on Mar 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-367"],"title":"VMware ESXi and Workstation TOCTOU Race Condition Vulnerability (CVE-2025-22224)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-esxi-and-workstation-cve-2025-22224","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2025-03-18","cveIds":["CVE-2024-50302"],"exploited":"in-the-wild","identifiers":["CVE-2024-50302"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-50302.json","latestUpdate":{"date":"2025-03-04","title":"CISA added CVE-2024-50302 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 25, 2025)"},"patchStatus":"patched","product":"Kernel","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2024-50302","stacks":["linux"],"startedAt":"2025-03-04","status":"closed","summary":"The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report. CISA added CVE-2024-50302 to its Known Exploited Vulnerabilities catalog on Mar 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-908"],"title":"Linux Kernel Use of Uninitialized Resource Vulnerability (CVE-2024-50302)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-50302","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2025-03-17","cveIds":["CVE-2024-4885"],"exploited":"in-the-wild","identifiers":["CVE-2024-4885"],"json":"https://helix.ml/threat-watch/i/progress-whatsup-gold-cve-2024-4885.json","latestUpdate":{"date":"2025-03-03","title":"CISA added CVE-2024-4885 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2025)"},"patchStatus":"unknown","product":"WhatsUp Gold","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-whatsup-gold-cve-2024-4885","stacks":[],"startedAt":"2025-03-03","status":"closed","summary":"Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. CISA added CVE-2024-4885 to its Known Exploited Vulnerabilities catalog on Mar 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"Progress WhatsUp Gold Path Traversal Vulnerability (CVE-2024-4885)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/progress-whatsup-gold-cve-2024-4885","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2025-03-17","cveIds":["CVE-2018-8639"],"exploited":"in-the-wild","identifiers":["CVE-2018-8639"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8639.json","latestUpdate":{"date":"2025-03-03","title":"CISA added CVE-2018-8639 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2018-8639","stacks":["windows"],"startedAt":"2025-03-03","status":"closed","summary":"Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. CISA added CVE-2018-8639 to its Known Exploited Vulnerabilities catalog on Mar 3, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","privilege-escalation","cwe-404"],"title":"Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability (CVE-2018-8639)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8639","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-17","cveIds":["CVE-2022-43769"],"exploited":"in-the-wild","identifiers":["CVE-2022-43769"],"json":"https://helix.ml/threat-watch/i/hitachi-vantara-pentaho-business-analytics-ba-server-cve-2022-43769.json","latestUpdate":{"date":"2025-03-03","title":"CISA added CVE-2022-43769 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2025)"},"patchStatus":"unknown","product":"Pentaho Business Analytics (BA) Server","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"hitachi-vantara-pentaho-business-analytics-ba-server-cve-2022-43769","stacks":[],"startedAt":"2025-03-03","status":"closed","summary":"Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution. CISA added CVE-2022-43769 to its Known Exploited Vulnerabilities catalog on Mar 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-74"],"title":"Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability (CVE-2022-43769)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/hitachi-vantara-pentaho-business-analytics-ba-server-cve-2022-43769","vendor":"Hitachi Vantara"},{"auto":true,"category":"patch","closedAt":"2025-03-17","cveIds":["CVE-2022-43939"],"exploited":"in-the-wild","identifiers":["CVE-2022-43939"],"json":"https://helix.ml/threat-watch/i/hitachi-vantara-pentaho-business-analytics-ba-server-cve-2022-43939.json","latestUpdate":{"date":"2025-03-03","title":"CISA added CVE-2022-43939 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2025)"},"patchStatus":"unknown","product":"Pentaho Business Analytics (BA) Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"hitachi-vantara-pentaho-business-analytics-ba-server-cve-2022-43939","stacks":[],"startedAt":"2025-03-03","status":"closed","summary":"Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization. CISA added CVE-2022-43939 to its Known Exploited Vulnerabilities catalog on Mar 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-647"],"title":"Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability (CVE-2022-43939)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/hitachi-vantara-pentaho-business-analytics-ba-server-cve-2022-43939","vendor":"Hitachi Vantara"},{"auto":true,"category":"patch","closedAt":"2025-03-17","cveIds":["CVE-2023-20118"],"exploited":"in-the-wild","identifiers":["CVE-2023-20118"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv-series-routers-cve-2023-20118.json","latestUpdate":{"date":"2025-03-03","title":"CISA added CVE-2023-20118 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2025)"},"patchStatus":"unknown","product":"Small Business RV Series Routers","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv-series-routers-cve-2023-20118","stacks":["network"],"startedAt":"2025-03-03","status":"closed","summary":"Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data. CISA added CVE-2023-20118 to its Known Exploited Vulnerabilities catalog on Mar 3, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Cisco Small Business RV Series Routers Command Injection Vulnerability (CVE-2023-20118)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv-series-routers-cve-2023-20118","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2025-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COLORDATING"],"json":"https://helix.ml/threat-watch/i/colordating-data-breach.json","latestUpdate":{"date":"2025-03-03","title":"Have I Been Pwned loaded 220K breached Color Dating accounts"},"patchStatus":"no-fix-needed","product":"colordatingapp.com","severity":"high","severityNote":"220K accounts · passwords exposed","slug":"colordating-data-breach","stacks":[],"startedAt":"2025-03-03","status":"closed","summary":"In September 2018, the dating app to match people with different ethnicities Color Dating suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 220k unique email addresses along with bios, names, profile photos and bcrypt password hashes. Exposed data: bios, dates of birth, email addresses, geographic locations, names, passwords, profile photos. The breach dates from Sep 5, 2018; Have I Been Pwned loaded it on Mar 3, 2025.","tags":["data-breach","hibp","bios","dates-of-birth","email-addresses","geographic-locations","names","passwords","profile-photos"],"title":"Color Dating data breach: 220K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/colordating-data-breach","vendor":"Color Dating"},{"auto":true,"category":"breach","closedAt":"2025-03-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLATEARTHDAVE"],"json":"https://helix.ml/threat-watch/i/flatearthdave-data-breach.json","latestUpdate":{"date":"2025-03-02","title":"Have I Been Pwned loaded 33K breached Flat Earth Sun, Moon and Zodiac App accounts"},"patchStatus":"no-fix-needed","product":"flatearthdave.com","severity":"high","severityNote":"33K accounts · passwords exposed","slug":"flatearthdave-data-breach","stacks":[],"startedAt":"2025-03-02","status":"closed","summary":"In October 2024, the flat earth sun, moon and zodiac app created by Flat Earth Dave was found to be leaking extensive personal information of its users. The data included 33k unique email addresses along with usernames, latitudes and longitudes (their position on the globe) and passwords stored in plain text. A small number of profiles also contained names, dates of birth and genders. Exposed data: dates of birth, email addresses, genders, geographic locations, latitude and longitude pairs, names, passwords, usernames. The breach dates from Oct 15, 2024; Have I Been Pwned loaded it on Mar 2, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","latitude-and-longitude-pairs","names","passwords","usernames"],"title":"Flat Earth Sun, Moon and Zodiac App data breach: 33K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/flatearthdave-data-breach","vendor":"Flat Earth Sun, Moon and Zodiac App"},{"auto":true,"category":"breach","closedAt":"2025-03-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ORANGEROMANIA"],"json":"https://helix.ml/threat-watch/i/orangeromania-data-breach.json","latestUpdate":{"date":"2025-02-27","title":"Have I Been Pwned loaded 556K breached Orange Romania accounts"},"patchStatus":"no-fix-needed","product":"orange.ro","severity":"high","severityNote":"556K accounts · financial data exposed","slug":"orangeromania-data-breach","stacks":[],"startedAt":"2025-02-27","status":"closed","summary":"In February 2025, the Romanian arm of telecommunications company Orange suffered a data breach which was subsequently published to a popular hacking forum. The data included 556k email addresses (of which hundreds of thousands were in the form of [phone number]@as1.romtelecom.net), phone numbers, subscription details, partial credit card data (type, last 4 digits, expiration date and issuing bank). The breach also exposed an extensive number of internal documents. Exposed data: email addresses, partial credit card data, phone numbers. The breach dates from Feb 24, 2025; Have I Been Pwned loaded it on Feb 27, 2025.","tags":["data-breach","hibp","email-addresses","partial-credit-card-data","phone-numbers"],"title":"Orange Romania data breach: 556K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/orangeromania-data-breach","vendor":"Orange Romania"},{"auto":true,"category":"breach","closedAt":"2025-03-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPYZIE"],"json":"https://helix.ml/threat-watch/i/spyzie-data-breach.json","latestUpdate":{"date":"2025-02-27","title":"Have I Been Pwned loaded 518K breached Spyzie accounts"},"patchStatus":"no-fix-needed","product":"spyzie.io","severity":"high","severityNote":"518K accounts","slug":"spyzie-data-breach","stacks":[],"startedAt":"2025-02-27","status":"closed","summary":"In February 2025, the spyware service Spyzie suffered a data breach along with sibling spyware services, Spyic and Cocospy. The Spyzie breach alone exposed almost 519k customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more. Exposed data: email addresses. The breach dates from Feb 22, 2024; Have I Been Pwned loaded it on Feb 27, 2025.","tags":["data-breach","hibp","email-addresses"],"title":"Spyzie data breach: 518K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/spyzie-data-breach","vendor":"Spyzie"},{"auto":true,"category":"patch","closedAt":"2025-03-11","cveIds":["CVE-2023-34192"],"exploited":"in-the-wild","identifiers":["CVE-2023-34192"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2023-34192.json","latestUpdate":{"date":"2025-02-25","title":"CISA added CVE-2023-34192 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 18, 2025)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2023-34192","stacks":[],"startedAt":"2025-02-25","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. CISA added CVE-2023-34192 to its Known Exploited Vulnerabilities catalog on Feb 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","xss","cwe-79"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2023-34192)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2023-34192","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2025-03-11","cveIds":["CVE-2024-49035"],"exploited":"in-the-wild","identifiers":["CVE-2024-49035"],"json":"https://helix.ml/threat-watch/i/microsoft-partner-center-cve-2024-49035.json","latestUpdate":{"date":"2025-02-25","title":"CISA added CVE-2024-49035 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 18, 2025)"},"patchStatus":"unknown","product":"Partner Center","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-partner-center-cve-2024-49035","stacks":[],"startedAt":"2025-02-25","status":"closed","summary":"Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges. CISA added CVE-2024-49035 to its Known Exploited Vulnerabilities catalog on Feb 25, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-269"],"title":"Microsoft Partner Center Improper Access Control Vulnerability (CVE-2024-49035)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-partner-center-cve-2024-49035","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2025-03-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ALIENSTEALERLOGS"],"json":"https://helix.ml/threat-watch/i/alienstealerlogs-data-breach.json","latestUpdate":{"date":"2025-02-25","title":"Have I Been Pwned loaded 284.1M breached ALIEN TXTBASE Stealer Logs accounts"},"patchStatus":"no-fix-needed","product":"ALIEN TXTBASE Stealer Logs","severity":"critical","severityNote":"284.1M accounts · passwords exposed · infostealer logs","slug":"alienstealerlogs-data-breach","stacks":[],"startedAt":"2025-02-25","status":"closed","summary":"In February 2025, 23 billion rows of stealer logs were obtained from a Telegram channel known as ALIEN TXTBASE. The data contained 284M unique email addresses alongside the websites they were entered into and the passwords used. This data is now searchable in HIBP by both email domain and the domain of the target website. Exposed data: email addresses, passwords. The breach dates from Feb 15, 2025; Have I Been Pwned loaded it on Feb 25, 2025.","tags":["data-breach","hibp","stealer-log","email-addresses","passwords"],"title":"ALIEN TXTBASE Stealer Logs data breach: 284.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/alienstealerlogs-data-breach","vendor":"ALIEN TXTBASE Stealer Logs"},{"auto":true,"category":"patch","closedAt":"2025-03-10","cveIds":["CVE-2024-20953"],"exploited":"in-the-wild","identifiers":["CVE-2024-20953"],"json":"https://helix.ml/threat-watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-20953.json","latestUpdate":{"date":"2025-02-24","title":"CISA added CVE-2024-20953 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2025)"},"patchStatus":"unknown","product":"Agile Product Lifecycle Management (PLM)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-agile-product-lifecycle-management-plm-cve-2024-20953","stacks":[],"startedAt":"2025-02-24","status":"closed","summary":"Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system. CISA added CVE-2024-20953 to its Known Exploited Vulnerabilities catalog on Feb 24, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability (CVE-2024-20953)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-20953","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2025-03-10","cveIds":["CVE-2017-3066"],"exploited":"in-the-wild","identifiers":["CVE-2017-3066"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2017-3066.json","latestUpdate":{"date":"2025-02-24","title":"CISA added CVE-2017-3066 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2025)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2017-3066","stacks":[],"startedAt":"2025-02-24","status":"closed","summary":"Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. CISA added CVE-2017-3066 to its Known Exploited Vulnerabilities catalog on Feb 24, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Adobe ColdFusion Deserialization Vulnerability (CVE-2017-3066)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2017-3066","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2025-03-07","cveIds":["CVE-2025-24989"],"exploited":"in-the-wild","identifiers":["CVE-2025-24989"],"json":"https://helix.ml/threat-watch/i/microsoft-power-pages-cve-2025-24989.json","latestUpdate":{"date":"2025-02-21","title":"CISA added CVE-2025-24989 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 14, 2025)"},"patchStatus":"patched","product":"Power Pages","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-power-pages-cve-2025-24989","stacks":[],"startedAt":"2025-02-21","status":"closed","summary":"Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. CISA added CVE-2025-24989 to its Known Exploited Vulnerabilities catalog on Feb 21, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Microsoft Power Pages Improper Access Control Vulnerability (CVE-2025-24989)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-power-pages-cve-2025-24989","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-03-06","cveIds":["CVE-2025-0111"],"exploited":"in-the-wild","identifiers":["CVE-2025-0111"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2025-0111.json","latestUpdate":{"date":"2025-02-20","title":"CISA added CVE-2025-0111 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 13, 2025)"},"patchStatus":"unknown","product":"PAN-OS","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2025-0111","stacks":["network"],"startedAt":"2025-02-20","status":"closed","summary":"Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. CISA added CVE-2025-0111 to its Known Exploited Vulnerabilities catalog on Feb 20, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-73"],"title":"Palo Alto Networks PAN-OS File Read Vulnerability (CVE-2025-0111)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2025-0111","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2025-03-06","cveIds":["CVE-2025-23209"],"exploited":"in-the-wild","identifiers":["CVE-2025-23209"],"json":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2025-23209.json","latestUpdate":{"date":"2025-02-20","title":"CISA added CVE-2025-23209 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 13, 2025)"},"patchStatus":"patched","product":"Craft CMS","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"craft-cms-craft-cms-cve-2025-23209","stacks":[],"startedAt":"2025-02-20","status":"closed","summary":"Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution. CISA added CVE-2025-23209 to its Known Exploited Vulnerabilities catalog on Feb 20, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Craft CMS Code Injection Vulnerability (CVE-2025-23209)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/craft-cms-craft-cms-cve-2025-23209","vendor":"Craft CMS"},{"auto":true,"category":"breach","closedAt":"2025-03-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COCOSPY"],"json":"https://helix.ml/threat-watch/i/cocospy-data-breach.json","latestUpdate":{"date":"2025-02-20","title":"Have I Been Pwned loaded 1.8M breached Cocospy accounts"},"patchStatus":"no-fix-needed","product":"cocospy.com","severity":"high","severityNote":"1.8M accounts","slug":"cocospy-data-breach","stacks":[],"startedAt":"2025-02-20","status":"closed","summary":"In February 2025, the spyware service Cocospy suffered a data breach along with sibling spyware service, Spyic. The Cocospy breach alone exposed almost 1.8M customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more. Exposed data: email addresses. The breach dates from Feb 14, 2025; Have I Been Pwned loaded it on Feb 20, 2025.","tags":["data-breach","hibp","email-addresses"],"title":"Cocospy data breach: 1.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cocospy-data-breach","vendor":"Cocospy"},{"auto":true,"category":"breach","closedAt":"2025-03-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPYIC"],"json":"https://helix.ml/threat-watch/i/spyic-data-breach.json","latestUpdate":{"date":"2025-02-20","title":"Have I Been Pwned loaded 875K breached Spyic accounts"},"patchStatus":"no-fix-needed","product":"spyic.com","severity":"high","severityNote":"875K accounts","slug":"spyic-data-breach","stacks":[],"startedAt":"2025-02-20","status":"closed","summary":"In February 2025, the spyware service Spyic suffered a data breach along with sibling spyware service, Cocospy. The Spyic breach alone exposed almost 876k customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more. Exposed data: email addresses. The breach dates from Feb 14, 2025; Have I Been Pwned loaded it on Feb 20, 2025.","tags":["data-breach","hibp","email-addresses"],"title":"Spyic data breach: 875K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/spyic-data-breach","vendor":"Spyic"},{"auto":true,"category":"patch","closedAt":"2025-03-04","cveIds":["CVE-2025-0108"],"exploited":"in-the-wild","identifiers":["CVE-2025-0108"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2025-0108.json","latestUpdate":{"date":"2025-02-18","title":"CISA added CVE-2025-0108 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 11, 2025)"},"patchStatus":"unknown","product":"PAN-OS","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2025-0108","stacks":["network"],"startedAt":"2025-02-18","status":"closed","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts. CISA added CVE-2025-0108 to its Known Exploited Vulnerabilities catalog on Feb 18, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CVE-2025-0108)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2025-0108","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2025-03-04","cveIds":["CVE-2024-53704"],"exploited":"in-the-wild","identifiers":["CVE-2024-53704"],"json":"https://helix.ml/threat-watch/i/sonicwall-sonicos-cve-2024-53704.json","latestUpdate":{"date":"2025-02-18","title":"CISA added CVE-2024-53704 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 11, 2025)"},"patchStatus":"unknown","product":"SonicOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sonicos-cve-2024-53704","stacks":["vpn"],"startedAt":"2025-02-18","status":"closed","summary":"SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. CISA added CVE-2024-53704 to its Known Exploited Vulnerabilities catalog on Feb 18, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-287"],"title":"SonicWall SonicOS SSLVPN Improper Authentication Vulnerability (CVE-2024-53704)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sonicwall-sonicos-cve-2024-53704","vendor":"SonicWall"},{"auto":true,"category":"breach","closedAt":"2025-03-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STORENVY"],"json":"https://helix.ml/threat-watch/i/storenvy-data-breach.json","latestUpdate":{"date":"2025-02-16","title":"Have I Been Pwned loaded 11.1M breached Storenvy accounts"},"patchStatus":"no-fix-needed","product":"storenvy.com","severity":"high","severityNote":"11.1M accounts · passwords exposed","slug":"storenvy-data-breach","stacks":[],"startedAt":"2025-02-16","status":"closed","summary":"In mid-2019, the e-commerce website Storenvy suffered a data breach that exposed millions of customer records. A portion of the breached records were subsequently posted to a hacking forum with cracked password hashes, whilst the entire corpus of 23M rows was put up for sale. The data contained 11M unique email addresses alongside usernames, IP addresses, the user's city, gender date of birth and original salted SHA-1 password hash. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, passwords, usernames. The breach dates from Apr 4, 2019; Have I Been Pwned loaded it on Feb 16, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","passwords","usernames"],"title":"Storenvy data breach: 11.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/storenvy-data-breach","vendor":"Storenvy"},{"auto":true,"category":"patch","closedAt":"2025-02-27","cveIds":["CVE-2024-57727"],"exploited":"in-the-wild","identifiers":["CVE-2024-57727"],"json":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2024-57727.json","latestUpdate":{"date":"2025-02-13","title":"CISA added CVE-2024-57727 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 6, 2025)"},"patchStatus":"unknown","product":"SimpleHelp","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"simplehelp-simplehelp-cve-2024-57727","stacks":[],"startedAt":"2025-02-13","status":"closed","summary":"SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords. CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities catalog on Feb 13, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"SimpleHelp Path Traversal Vulnerability (CVE-2024-57727)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/simplehelp-simplehelp-cve-2024-57727","vendor":"SimpleHelp "},{"auto":true,"category":"breach","closedAt":"2025-02-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOXBINTOODA"],"json":"https://helix.ml/threat-watch/i/doxbintooda-data-breach.json","latestUpdate":{"date":"2025-02-13","title":"Have I Been Pwned loaded 136K breached Doxbin (TOoDA) accounts"},"patchStatus":"no-fix-needed","product":"doxbin.com","severity":"high","severityNote":"136K accounts","slug":"doxbintooda-data-breach","stacks":[],"startedAt":"2025-02-13","status":"closed","summary":"In February 2025, the \"doxing\" website Doxbin was compromised by a group calling themselves \"TOoDA\" and the data dumped publicly. Included in the breach were 336k unique email addresses alongside usernames. Exposed data: email addresses, usernames. The breach dates from Feb 12, 2024; Have I Been Pwned loaded it on Feb 13, 2025.","tags":["data-breach","hibp","email-addresses","usernames"],"title":"Doxbin (TOoDA) data breach: 136K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/doxbintooda-data-breach","vendor":"Doxbin (TOoDA)"},{"auto":true,"category":"patch","closedAt":"2025-02-26","cveIds":["CVE-2025-24200"],"exploited":"in-the-wild","identifiers":["CVE-2025-24200"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2025-24200.json","latestUpdate":{"date":"2025-02-12","title":"CISA added CVE-2025-24200 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 5, 2025)"},"patchStatus":"unknown","product":"iOS and iPadOS","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-ipados-cve-2025-24200","stacks":["ios"],"startedAt":"2025-02-12","status":"closed","summary":"Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. CISA added CVE-2025-24200 to its Known Exploited Vulnerabilities catalog on Feb 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-863"],"title":"Apple iOS and iPadOS Incorrect Authorization Vulnerability (CVE-2025-24200)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2025-24200","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2025-02-26","cveIds":["CVE-2024-41710"],"exploited":"in-the-wild","identifiers":["CVE-2024-41710"],"json":"https://helix.ml/threat-watch/i/mitel-sip-phones-cve-2024-41710.json","latestUpdate":{"date":"2025-02-12","title":"CISA added CVE-2024-41710 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 5, 2025)"},"patchStatus":"unknown","product":"SIP Phones","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"mitel-sip-phones-cve-2024-41710","stacks":[],"startedAt":"2025-02-12","status":"closed","summary":"Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system. CISA added CVE-2024-41710 to its Known Exploited Vulnerabilities catalog on Feb 12, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-88"],"title":"Mitel SIP Phones Argument Injection Vulnerability (CVE-2024-41710)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/mitel-sip-phones-cve-2024-41710","vendor":"Mitel"},{"auto":true,"category":"breach","closedAt":"2025-02-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZACKS2024"],"json":"https://helix.ml/threat-watch/i/zacks2024-data-breach.json","latestUpdate":{"date":"2025-02-12","title":"Have I Been Pwned loaded 12.0M breached Zacks (2024) accounts"},"patchStatus":"no-fix-needed","product":"zacks.com","severity":"high","severityNote":"12.0M accounts · passwords exposed","slug":"zacks2024-data-breach","stacks":[],"startedAt":"2025-02-12","status":"closed","summary":"In June 2024, the investment research company Zacks was allegedly breached, and data was later published to a popular hacking forum. This comes after a separate Zacks data breach confirmed by the organisation in 2023 with the subsequent breach disclosing millions of additional records representing a superset of data from the first incident. The 2024 breach included 12M unique email addresses along with IP and physical addresses, names, usernames, phone numbers and unsalted SHA-256 password hashes. Zacks did not respond to multiple attempts to contact them about the incident. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Jun 22, 2024; Have I Been Pwned loaded it on Feb 12, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Zacks (2024) data breach: 12.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/zacks2024-data-breach","vendor":"Zacks (2024)"},{"auto":true,"category":"patch","closedAt":"2025-02-25","cveIds":["CVE-2024-40891"],"exploited":"in-the-wild","identifiers":["CVE-2024-40891"],"json":"https://helix.ml/threat-watch/i/zyxel-dsl-cpe-devices-cve-2024-40891.json","latestUpdate":{"date":"2025-02-11","title":"CISA added CVE-2024-40891 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 4, 2025)"},"patchStatus":"unpatched","product":"DSL CPE Devices","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-dsl-cpe-devices-cve-2024-40891","stacks":["network"],"startedAt":"2025-02-11","status":"closed","summary":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. CISA added CVE-2024-40891 to its Known Exploited Vulnerabilities catalog on Feb 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zyxel DSL CPE OS Command Injection Vulnerability (CVE-2024-40891)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/zyxel-dsl-cpe-devices-cve-2024-40891","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2025-02-25","cveIds":["CVE-2024-40890"],"exploited":"in-the-wild","identifiers":["CVE-2024-40890"],"json":"https://helix.ml/threat-watch/i/zyxel-dsl-cpe-devices-cve-2024-40890.json","latestUpdate":{"date":"2025-02-11","title":"CISA added CVE-2024-40890 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 4, 2025)"},"patchStatus":"unpatched","product":"DSL CPE Devices","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-dsl-cpe-devices-cve-2024-40890","stacks":["network"],"startedAt":"2025-02-11","status":"closed","summary":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. CISA added CVE-2024-40890 to its Known Exploited Vulnerabilities catalog on Feb 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zyxel DSL CPE OS Command Injection Vulnerability (CVE-2024-40890)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/zyxel-dsl-cpe-devices-cve-2024-40890","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2025-02-25","cveIds":["CVE-2025-21418"],"exploited":"in-the-wild","identifiers":["CVE-2025-21418"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21418.json","latestUpdate":{"date":"2025-02-11","title":"CISA added CVE-2025-21418 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 4, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-21418","stacks":["windows"],"startedAt":"2025-02-11","status":"closed","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CISA added CVE-2025-21418 to its Known Exploited Vulnerabilities catalog on Feb 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-122"],"title":"Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability (CVE-2025-21418)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21418","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-02-25","cveIds":["CVE-2025-21391"],"exploited":"in-the-wild","identifiers":["CVE-2025-21391"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21391.json","latestUpdate":{"date":"2025-02-11","title":"CISA added CVE-2025-21391 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 4, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-21391","stacks":["windows"],"startedAt":"2025-02-11","status":"closed","summary":"Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable. CISA added CVE-2025-21391 to its Known Exploited Vulnerabilities catalog on Feb 11, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-59"],"title":"Microsoft Windows Storage Link Following Vulnerability (CVE-2025-21391)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21391","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2025-02-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LANDAIRSEA"],"json":"https://helix.ml/threat-watch/i/landairsea-data-breach.json","latestUpdate":{"date":"2025-02-11","title":"Have I Been Pwned loaded 337K breached LandAirSea accounts"},"patchStatus":"no-fix-needed","product":"landairsea.com","severity":"high","severityNote":"337K accounts · passwords exposed · financial data exposed","slug":"landairsea-data-breach","stacks":[],"startedAt":"2025-02-11","status":"closed","summary":"In January 2025, the GPS tracking service LandAirSea suffered a data breach that exposed 337k unique customer email addresses alongside names, usernames and password hashes. The breach also exposed partial credit card data (card type, last 4 digits and expiration), and GPS device identifiers and locations. LandAirSea is aware of the breach and has remediated the underlying vulnerability. Exposed data: email addresses, names, partial credit card data, passwords, physical addresses, usernames. The breach dates from Jan 12, 2025; Have I Been Pwned loaded it on Feb 11, 2025.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","passwords","physical-addresses","usernames"],"title":"LandAirSea data breach: 337K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/landairsea-data-breach","vendor":"LandAirSea"},{"auto":true,"category":"breach","closedAt":"2025-02-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADOPTMETRADINGVALUES"],"json":"https://helix.ml/threat-watch/i/adoptmetradingvalues-data-breach.json","latestUpdate":{"date":"2025-02-10","title":"Have I Been Pwned loaded 86K breached Adopt Me Trading Values accounts"},"patchStatus":"no-fix-needed","product":"adoptmetradingvalues.com","severity":"high","severityNote":"86K accounts · passwords exposed","slug":"adoptmetradingvalues-data-breach","stacks":[],"startedAt":"2025-02-10","status":"closed","summary":"In July 2022, the Adopt Me Trading Values website for assessing the value of pet trades within the \"Adopt Me!\" Roblox game suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 86k unique email addresses along with usernames (and Roblox usernames), IP addresses and bcrypt password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2022; Have I Been Pwned loaded it on Feb 10, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Adopt Me Trading Values data breach: 86K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/adoptmetradingvalues-data-breach","vendor":"Adopt Me Trading Values"},{"auto":true,"category":"breach","closedAt":"2025-02-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YOUTHMANUAL"],"json":"https://helix.ml/threat-watch/i/youthmanual-data-breach.json","latestUpdate":{"date":"2025-02-09","title":"Have I Been Pwned loaded 937K breached Youthmanual accounts"},"patchStatus":"no-fix-needed","product":"youthmanual.com","severity":"high","severityNote":"937K accounts · passwords exposed","slug":"youthmanual-data-breach","stacks":[],"startedAt":"2025-02-09","status":"closed","summary":"In January 2019, the Indonesian college and career platform Youthmanual suffered a data breach that exposed 1.1M records of data. The breached included 938k unique email addresses along with extensive personal information including names, genders, dates and places of birth, phone numbers, physical addresses and salted SHA-1 password hashes. Exposed data: bios, dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, places of birth. The breach dates from Jan 31, 2019; Have I Been Pwned loaded it on Feb 9, 2025.","tags":["data-breach","hibp","bios","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","places-of-birth"],"title":"Youthmanual data breach: 937K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/youthmanual-data-breach","vendor":"Youthmanual"},{"auto":true,"category":"patch","closedAt":"2025-02-21","cveIds":["CVE-2025-0994"],"exploited":"in-the-wild","identifiers":["CVE-2025-0994"],"json":"https://helix.ml/threat-watch/i/trimble-cityworks-cve-2025-0994.json","latestUpdate":{"date":"2025-02-07","title":"CISA added CVE-2025-0994 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 28, 2025)"},"patchStatus":"unknown","product":"Cityworks","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trimble-cityworks-cve-2025-0994","stacks":[],"startedAt":"2025-02-07","status":"closed","summary":"Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server. CISA added CVE-2025-0994 to its Known Exploited Vulnerabilities catalog on Feb 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Trimble Cityworks Deserialization Vulnerability (CVE-2025-0994)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/trimble-cityworks-cve-2025-0994","vendor":"Trimble"},{"auto":true,"category":"patch","closedAt":"2025-02-20","cveIds":["CVE-2020-15069"],"exploited":"in-the-wild","identifiers":["CVE-2020-15069"],"json":"https://helix.ml/threat-watch/i/sophos-xg-firewall-cve-2020-15069.json","latestUpdate":{"date":"2025-02-06","title":"CISA added CVE-2020-15069 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2025)"},"patchStatus":"unknown","product":"XG Firewall","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sophos-xg-firewall-cve-2020-15069","stacks":["network"],"startedAt":"2025-02-06","status":"closed","summary":"Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the \"HTTP/S bookmark\" feature. CISA added CVE-2020-15069 to its Known Exploited Vulnerabilities catalog on Feb 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-120"],"title":"Sophos XG Firewall Buffer Overflow Vulnerability (CVE-2020-15069)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sophos-xg-firewall-cve-2020-15069","vendor":"Sophos"},{"auto":true,"category":"patch","closedAt":"2025-02-20","cveIds":["CVE-2020-29574"],"exploited":"in-the-wild","identifiers":["CVE-2020-29574"],"json":"https://helix.ml/threat-watch/i/sophos-cyberoamos-cve-2020-29574.json","latestUpdate":{"date":"2025-02-06","title":"CISA added CVE-2020-29574 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2025)"},"patchStatus":"unpatched","product":"CyberoamOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sophos-cyberoamos-cve-2020-29574","stacks":["network"],"startedAt":"2025-02-06","status":"closed","summary":"CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. CISA added CVE-2020-29574 to its Known Exploited Vulnerabilities catalog on Feb 6, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"CyberoamOS (CROS) SQL Injection Vulnerability (CVE-2020-29574)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sophos-cyberoamos-cve-2020-29574","vendor":"Sophos"},{"auto":true,"category":"patch","closedAt":"2025-02-20","cveIds":["CVE-2024-21413"],"exploited":"in-the-wild","identifiers":["CVE-2024-21413"],"json":"https://helix.ml/threat-watch/i/microsoft-office-outlook-cve-2024-21413.json","latestUpdate":{"date":"2025-02-06","title":"CISA added CVE-2024-21413 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2025)"},"patchStatus":"patched","product":"Office Outlook","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-outlook-cve-2024-21413","stacks":["windows"],"startedAt":"2025-02-06","status":"closed","summary":"Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. CISA added CVE-2024-21413 to its Known Exploited Vulnerabilities catalog on Feb 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Outlook Improper Input Validation Vulnerability (CVE-2024-21413)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-office-outlook-cve-2024-21413","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-02-20","cveIds":["CVE-2022-23748"],"exploited":"in-the-wild","identifiers":["CVE-2022-23748"],"json":"https://helix.ml/threat-watch/i/audinate-dante-discovery-cve-2022-23748.json","latestUpdate":{"date":"2025-02-06","title":"CISA added CVE-2022-23748 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2025)"},"patchStatus":"unknown","product":"Dante Discovery","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"audinate-dante-discovery-cve-2022-23748","stacks":[],"startedAt":"2025-02-06","status":"closed","summary":"Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code. CISA added CVE-2022-23748 to its Known Exploited Vulnerabilities catalog on Feb 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-114"],"title":"Dante Discovery Process Control Vulnerability (CVE-2022-23748)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/audinate-dante-discovery-cve-2022-23748","vendor":"Audinate"},{"auto":true,"category":"patch","closedAt":"2025-02-20","cveIds":["CVE-2025-0411"],"exploited":"in-the-wild","identifiers":["CVE-2025-0411"],"json":"https://helix.ml/threat-watch/i/7-zip-7-zip-cve-2025-0411.json","latestUpdate":{"date":"2025-02-06","title":"CISA added CVE-2025-0411 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2025)"},"patchStatus":"unknown","product":"7-Zip","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"7-zip-7-zip-cve-2025-0411","stacks":[],"startedAt":"2025-02-06","status":"closed","summary":"7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user. CISA added CVE-2025-0411 to its Known Exploited Vulnerabilities catalog on Feb 6, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-693"],"title":"7-Zip Mark of the Web Bypass Vulnerability (CVE-2025-0411)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/7-zip-7-zip-cve-2025-0411","vendor":"7-Zip"},{"auto":true,"category":"breach","closedAt":"2025-02-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HAKKO"],"json":"https://helix.ml/threat-watch/i/hakko-data-breach.json","latestUpdate":{"date":"2025-02-06","title":"Have I Been Pwned loaded 9665 breached Hakko Corporation accounts"},"patchStatus":"no-fix-needed","product":"hakko.com","severity":"high","severityNote":"9665 accounts · passwords exposed","slug":"hakko-data-breach","stacks":[],"startedAt":"2025-02-06","status":"closed","summary":"In March 2019, the Japanese solder-related business Hakko Corporation suffered a data breach. The incident exposed almost 10k customer records including email and physical addresses, phone numbers, names, usernames, genders, dates of birth and plain text passwords. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Mar 28, 2019; Have I Been Pwned loaded it on Feb 6, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Hakko Corporation data breach: 9665 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/hakko-data-breach","vendor":"Hakko Corporation"},{"auto":true,"category":"breach","closedAt":"2025-02-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THERMOMIX"],"json":"https://helix.ml/threat-watch/i/thermomix-data-breach.json","latestUpdate":{"date":"2025-02-06","title":"Have I Been Pwned loaded 3.1M breached Thermomix Recipe World Forum accounts"},"patchStatus":"no-fix-needed","product":"rezeptwelt.de","severity":"medium","severityNote":"3.1M accounts","slug":"thermomix-data-breach","stacks":[],"startedAt":"2025-02-06","status":"closed","summary":"In January 2025, the Rezeptwelt (German for \"recipe world\") forum for Thermomix owners suffered a data breach. The incident exposed 3.1M registered users' details including names, email and physical addresses, phone numbers, dates of birth and bios (usually cooking related). Exposed data: bios, dates of birth, email addresses, names, phone numbers, physical addresses, usernames. The breach dates from Jan 30, 2025; Have I Been Pwned loaded it on Feb 6, 2025.","tags":["data-breach","hibp","bios","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses","usernames"],"title":"Thermomix Recipe World Forum data breach: 3.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/thermomix-data-breach","vendor":"Thermomix Recipe World Forum"},{"auto":true,"category":"patch","closedAt":"2025-02-19","cveIds":["CVE-2024-53104"],"exploited":"in-the-wild","identifiers":["CVE-2024-53104"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-53104.json","latestUpdate":{"date":"2025-02-05","title":"CISA added CVE-2024-53104 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 26, 2025)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2024-53104","stacks":["linux"],"startedAt":"2025-02-05","status":"closed","summary":"Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege. CISA added CVE-2024-53104 to its Known Exploited Vulnerabilities catalog on Feb 5, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Linux Kernel Out-of-Bounds Write Vulnerability (CVE-2024-53104)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-53104","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2025-02-18","cveIds":["CVE-2018-19410"],"exploited":"in-the-wild","identifiers":["CVE-2018-19410"],"json":"https://helix.ml/threat-watch/i/paessler-prtg-network-monitor-cve-2018-19410.json","latestUpdate":{"date":"2025-02-04","title":"CISA added CVE-2018-19410 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 25, 2025)"},"patchStatus":"unknown","product":"PRTG Network Monitor","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"paessler-prtg-network-monitor-cve-2018-19410","stacks":[],"startedAt":"2025-02-04","status":"closed","summary":"Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator). CISA added CVE-2018-19410 to its Known Exploited Vulnerabilities catalog on Feb 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Paessler PRTG Network Monitor Local File Inclusion Vulnerability (CVE-2018-19410)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/paessler-prtg-network-monitor-cve-2018-19410","vendor":"Paessler"},{"auto":true,"category":"patch","closedAt":"2025-02-18","cveIds":["CVE-2018-9276"],"exploited":"in-the-wild","identifiers":["CVE-2018-9276"],"json":"https://helix.ml/threat-watch/i/paessler-prtg-network-monitor-cve-2018-9276.json","latestUpdate":{"date":"2025-02-04","title":"CISA added CVE-2018-9276 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 25, 2025)"},"patchStatus":"unknown","product":"PRTG Network Monitor","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"paessler-prtg-network-monitor-cve-2018-9276","stacks":[],"startedAt":"2025-02-04","status":"closed","summary":"Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console. CISA added CVE-2018-9276 to its Known Exploited Vulnerabilities catalog on Feb 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Paessler PRTG Network Monitor OS Command Injection Vulnerability (CVE-2018-9276)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/paessler-prtg-network-monitor-cve-2018-9276","vendor":"Paessler"},{"auto":true,"category":"patch","closedAt":"2025-02-18","cveIds":["CVE-2024-29059"],"exploited":"in-the-wild","identifiers":["CVE-2024-29059"],"json":"https://helix.ml/threat-watch/i/microsoft-net-framework-cve-2024-29059.json","latestUpdate":{"date":"2025-02-04","title":"CISA added CVE-2024-29059 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 25, 2025)"},"patchStatus":"unknown","product":".NET Framework","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-net-framework-cve-2024-29059","stacks":["dotnet"],"startedAt":"2025-02-04","status":"closed","summary":"Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. CISA added CVE-2024-29059 to its Known Exploited Vulnerabilities catalog on Feb 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-209"],"title":"Microsoft .NET Framework Information Disclosure Vulnerability (CVE-2024-29059)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-net-framework-cve-2024-29059","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-02-18","cveIds":["CVE-2024-45195"],"exploited":"in-the-wild","identifiers":["CVE-2024-45195"],"json":"https://helix.ml/threat-watch/i/apache-ofbiz-cve-2024-45195.json","latestUpdate":{"date":"2025-02-04","title":"CISA added CVE-2024-45195 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 25, 2025)"},"patchStatus":"unknown","product":"OFBiz","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-ofbiz-cve-2024-45195","stacks":[],"startedAt":"2025-02-04","status":"closed","summary":"Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access. CISA added CVE-2024-45195 to its Known Exploited Vulnerabilities catalog on Feb 4, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-425"],"title":"Apache OFBiz Forced Browsing Vulnerability (CVE-2024-45195)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-ofbiz-cve-2024-45195","vendor":"Apache"},{"auto":true,"category":"breach","closedAt":"2025-02-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POINCAMPUS"],"json":"https://helix.ml/threat-watch/i/poincampus-data-breach.json","latestUpdate":{"date":"2025-02-04","title":"Have I Been Pwned loaded 89K breached PoinCampus accounts"},"patchStatus":"no-fix-needed","product":"poincampus.com","severity":"medium","severityNote":"89K accounts","slug":"poincampus-data-breach","stacks":[],"startedAt":"2025-02-04","status":"closed","summary":"In November 2024, the South Korean education platform PoinCampus suffered a data breach which was later published to a popular hacking forum. The data included 89k unique email addresses, names and a small number of phone numbers and dates of birth. Exposed data: dates of birth, email addresses, names, phone numbers. The breach dates from Nov 14, 2024; Have I Been Pwned loaded it on Feb 4, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers"],"title":"PoinCampus data breach: 89K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/poincampus-data-breach","vendor":"PoinCampus"},{"auto":true,"category":"breach","closedAt":"2025-02-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DRAGONNEST"],"json":"https://helix.ml/threat-watch/i/dragonnest-data-breach.json","latestUpdate":{"date":"2025-02-03","title":"Have I Been Pwned loaded 511K breached DragonNest accounts"},"patchStatus":"no-fix-needed","product":"dragonnest.com","severity":"high","severityNote":"511K accounts · passwords exposed","slug":"dragonnest-data-breach","stacks":[],"startedAt":"2025-02-03","status":"closed","summary":"In August 2013, the massively multiplayer online role-playing game (MMORGP) DragonNest suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed over 500k unique email addresses along with usernames, IP addresses and plain text passwords. The service later suffered a massive data loss. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Aug 23, 2013; Have I Been Pwned loaded it on Feb 3, 2025.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"DragonNest data breach: 511K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/dragonnest-data-breach","vendor":"DragonNest"},{"auto":true,"category":"breach","closedAt":"2025-02-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:1WIN"],"json":"https://helix.ml/threat-watch/i/1win-data-breach.json","latestUpdate":{"date":"2025-02-03","title":"Have I Been Pwned loaded 96.2M breached 1win accounts"},"patchStatus":"no-fix-needed","product":"1win.com","severity":"high","severityNote":"96.2M accounts · passwords exposed","slug":"1win-data-breach","stacks":[],"startedAt":"2025-02-03","status":"closed","summary":"In November 2024, the online betting platform 1win suffered a data breach that exposed 96M users. The exposed data included email and IP addresses, phone numbers, dates of birth, country and SHA-256 password hashes. Exposed data: dates of birth, email addresses, geographic locations, ip addresses, passwords, phone numbers. The breach dates from Nov 2, 2024; Have I Been Pwned loaded it on Feb 3, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","ip-addresses","passwords","phone-numbers"],"title":"1win data breach: 96.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/1win-data-breach","vendor":"1win"},{"auto":true,"category":"breach","closedAt":"2025-02-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:9LIVES"],"json":"https://helix.ml/threat-watch/i/9lives-data-breach.json","latestUpdate":{"date":"2025-02-02","title":"Have I Been Pwned loaded 109K breached 9Lives accounts"},"patchStatus":"no-fix-needed","product":"9lives.be","severity":"high","severityNote":"109K accounts · passwords exposed","slug":"9lives-data-breach","stacks":[],"startedAt":"2025-02-02","status":"closed","summary":"In October 2014, the (now defunct) Belgian gaming news forum 9Lives suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 109k unique email addresses along with usernames and salted MD5 password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Oct 1, 2014; Have I Been Pwned loaded it on Feb 2, 2025.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"9Lives data breach: 109K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/9lives-data-breach","vendor":"9Lives"},{"auto":true,"category":"patch","closedAt":"2025-02-12","cveIds":["CVE-2025-24085"],"exploited":"in-the-wild","identifiers":["CVE-2025-24085"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-24085.json","latestUpdate":{"date":"2025-01-29","title":"CISA added CVE-2025-24085 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 19, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2025-24085","stacks":[],"startedAt":"2025-01-29","status":"closed","summary":"Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. CISA added CVE-2025-24085 to its Known Exploited Vulnerabilities catalog on Jan 29, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple Multiple Products Use-After-Free Vulnerability (CVE-2025-24085)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2025-24085","vendor":"Apple"},{"auto":true,"category":"breach","closedAt":"2025-02-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOXBINSCRAPE"],"json":"https://helix.ml/threat-watch/i/doxbinscrape-data-breach.json","latestUpdate":{"date":"2025-01-28","title":"Have I Been Pwned loaded 435K breached Doxbin Scrape accounts"},"patchStatus":"no-fix-needed","product":"doxbin.com","severity":"high","severityNote":"435K accounts","slug":"doxbinscrape-data-breach","stacks":[],"startedAt":"2025-01-28","status":"closed","summary":"In January 2025, 435k email addresses were scraped from the \"doxing\" service Doxbin. Posts to the service are usually intended to disclose the personal information of non-consensually third parties. Exposed data: email addresses. The breach dates from Jan 24, 2025; Have I Been Pwned loaded it on Jan 28, 2025.","tags":["data-breach","hibp","email-addresses"],"title":"Doxbin Scrape data breach: 435K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/doxbinscrape-data-breach","vendor":"Doxbin Scrape"},{"auto":true,"category":"breach","closedAt":"2025-02-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HEATGAMES"],"json":"https://helix.ml/threat-watch/i/heatgames-data-breach.json","latestUpdate":{"date":"2025-01-28","title":"Have I Been Pwned loaded 647K breached HeatGames accounts"},"patchStatus":"no-fix-needed","product":"heatgames.me","severity":"high","severityNote":"647K accounts · passwords exposed","slug":"heatgames-data-breach","stacks":[],"startedAt":"2025-01-28","status":"closed","summary":"In June 2021, the (now defunct) gaming website HeatGames suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed almost 650k unique email addresses along with IP addresses, country and salted MD5 password hashes. Exposed data: email addresses, geographic locations, ip addresses, passwords. The breach dates from Jun 12, 2021; Have I Been Pwned loaded it on Jan 28, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","passwords"],"title":"HeatGames data breach: 647K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/heatgames-data-breach","vendor":"HeatGames"},{"auto":true,"category":"patch","closedAt":"2025-02-07","cveIds":["CVE-2025-23006"],"exploited":"in-the-wild","identifiers":["CVE-2025-23006"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2025-23006.json","latestUpdate":{"date":"2025-01-24","title":"CISA added CVE-2025-23006 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 14, 2025)"},"patchStatus":"unknown","product":"SMA1000 Appliances","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma1000-appliances-cve-2025-23006","stacks":["vpn"],"startedAt":"2025-01-24","status":"closed","summary":"SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands. CISA added CVE-2025-23006 to its Known Exploited Vulnerabilities catalog on Jan 24, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"SonicWall SMA1000 Appliances Deserialization Vulnerability (CVE-2025-23006)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma1000-appliances-cve-2025-23006","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2025-02-06","cveIds":["CVE-2020-11023"],"exploited":"in-the-wild","identifiers":["CVE-2020-11023"],"json":"https://helix.ml/threat-watch/i/jquery-jquery-cve-2020-11023.json","latestUpdate":{"date":"2025-01-23","title":"CISA added CVE-2020-11023 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 13, 2025)"},"patchStatus":"patched","product":"JQuery","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"jquery-jquery-cve-2020-11023","stacks":[],"startedAt":"2025-01-23","status":"closed","summary":"JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser. CISA added CVE-2020-11023 to its Known Exploited Vulnerabilities catalog on Jan 23, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"JQuery Cross-Site Scripting (XSS) Vulnerability (CVE-2020-11023)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/jquery-jquery-cve-2020-11023","vendor":"JQuery"},{"auto":true,"category":"breach","closedAt":"2025-02-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WELHOF"],"json":"https://helix.ml/threat-watch/i/welhof-data-breach.json","latestUpdate":{"date":"2025-01-22","title":"Have I Been Pwned loaded 107K breached Welhof accounts"},"patchStatus":"no-fix-needed","product":"welhof.com","severity":"medium","severityNote":"107K accounts","slug":"welhof-data-breach","stacks":[],"startedAt":"2025-01-22","status":"closed","summary":"In late 2023, the Dutch appliance store Welhof suffered a data breach. The incident exposed over 100k unique email addresses along with names, physical addresses and the value of purchases made. Exposed data: email addresses, names, physical addresses, purchases. The breach dates from Dec 1, 2023; Have I Been Pwned loaded it on Jan 22, 2025.","tags":["data-breach","hibp","email-addresses","names","physical-addresses","purchases"],"title":"Welhof data breach: 107K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/welhof-data-breach","vendor":"Welhof"},{"auto":true,"category":"breach","closedAt":"2025-02-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FRAMEANDOPTIC"],"json":"https://helix.ml/threat-watch/i/frameandoptic-data-breach.json","latestUpdate":{"date":"2025-01-22","title":"Have I Been Pwned loaded 15K breached Frame \u0026 Optic accounts"},"patchStatus":"no-fix-needed","product":"frameandoptic.com","severity":"medium","severityNote":"15K accounts","slug":"frameandoptic-data-breach","stacks":[],"startedAt":"2025-01-22","status":"closed","summary":"In January 2025, the eyewear seller Frame \u0026 Optic suffered a data breach. The incident exposed almost 16k unique email addresses along with names, phone numbers and geolocation data including country, state and postcode. Exposed data: email addresses, geographic locations, names, phone numbers. The breach dates from Jan 16, 2025; Have I Been Pwned loaded it on Jan 22, 2025.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","phone-numbers"],"title":"Frame \u0026 Optic data breach: 15K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/frameandoptic-data-breach","vendor":"Frame \u0026 Optic"},{"auto":true,"category":"breach","closedAt":"2025-02-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OTELIER"],"json":"https://helix.ml/threat-watch/i/otelier-data-breach.json","latestUpdate":{"date":"2025-01-18","title":"Have I Been Pwned loaded 436K breached Otelier accounts"},"patchStatus":"no-fix-needed","product":"otelier.com","severity":"high","severityNote":"436K accounts · financial data exposed","slug":"otelier-data-breach","stacks":[],"startedAt":"2025-01-18","status":"closed","summary":"In July 2024, a threat actor gained access to the hotel management platform Otelier and retrieved customer data from well-known hotel brands including Marriott, Hilton, and Hyatt. The data included 437k customer email addresses (a further 868k generated email addresses from the booking.com and Expedia platforms were not loaded into HIBP), names, physical addresses, phone numbers, booking information related to travel plans, purchases recorded by the platform and in a small number of cases, partial credit card data. Exposed data: email addresses, names, partial credit card data, phone numbers, physical addresses, purchases, travel plans. The breach dates from Jul 1, 2024; Have I Been Pwned loaded it on Jan 18, 2025.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases","travel-plans"],"title":"Otelier data breach: 436K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/otelier-data-breach","vendor":"Otelier"},{"auto":true,"category":"breach","closedAt":"2025-01-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MSI"],"json":"https://helix.ml/threat-watch/i/msi-data-breach.json","latestUpdate":{"date":"2025-01-17","title":"Have I Been Pwned loaded 249K breached MSI accounts"},"patchStatus":"no-fix-needed","product":"msi.com","severity":"medium","severityNote":"249K accounts","slug":"msi-data-breach","stacks":[],"startedAt":"2025-01-17","status":"closed","summary":"In July 2024, MSI inadvertently exposed hundreds of thousands of customer records related to RMA claims that were subsequently found to be publicly accessible. The data included 250k unique email addresses alongside names, phone numbers, physical addresses and warranty claims. When contacted about the incident, MSI advised that \"there is no evidence the information was ever accessed\" and that \"the security incident we had did not trigger state data breach notification obligations\" due to the absence of \"(social security number, driver's license number….etc)\". Exposed data: email addresses, names, phone numbers, physical addresses, warranty claims. The breach dates from Jul 7, 2024; Have I Been Pwned loaded it on Jan 17, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","warranty-claims"],"title":"MSI data breach: 249K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/msi-data-breach","vendor":"MSI"},{"auto":true,"category":"patch","closedAt":"2025-01-30","cveIds":["CVE-2024-50603"],"exploited":"in-the-wild","identifiers":["CVE-2024-50603"],"json":"https://helix.ml/threat-watch/i/aviatrix-controllers-cve-2024-50603.json","latestUpdate":{"date":"2025-01-16","title":"CISA added CVE-2024-50603 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 6, 2025)"},"patchStatus":"unknown","product":"Controllers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"aviatrix-controllers-cve-2024-50603","stacks":[],"startedAt":"2025-01-16","status":"closed","summary":"Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test. CISA added CVE-2024-50603 to its Known Exploited Vulnerabilities catalog on Jan 16, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Aviatrix Controllers OS Command Injection Vulnerability (CVE-2024-50603)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/aviatrix-controllers-cve-2024-50603","vendor":"Aviatrix"},{"auto":true,"category":"breach","closedAt":"2025-01-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LECOQSPORTIF"],"json":"https://helix.ml/threat-watch/i/lecoqsportif-data-breach.json","latestUpdate":{"date":"2025-01-16","title":"Have I Been Pwned loaded 79K breached Le Coq Sportif Columbia accounts"},"patchStatus":"no-fix-needed","product":"lecoqsportif.com.co","severity":"high","severityNote":"79K accounts · passwords exposed","slug":"lecoqsportif-data-breach","stacks":[],"startedAt":"2025-01-16","status":"closed","summary":"In January 2025, a data breach from the Columbian website for Le Coq Sportif was posted to a popular hacking forum. The data included almost 80k unique email addresses with the breach dating back to May 2023. Impacted data included physical and IP addresses, names, purchases, genders, dates of birth and bcrypt password hashes. Exposed data: dates of birth, device information, email addresses, genders, ip addresses, names, passwords, physical addresses, purchases. The breach dates from May 1, 2023; Have I Been Pwned loaded it on Jan 16, 2025.","tags":["data-breach","hibp","dates-of-birth","device-information","email-addresses","genders","ip-addresses","names","passwords","physical-addresses","purchases"],"title":"Le Coq Sportif Columbia data breach: 79K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/lecoqsportif-data-breach","vendor":"Le Coq Sportif Columbia"},{"auto":true,"category":"patch","closedAt":"2025-01-28","cveIds":["CVE-2025-21335"],"exploited":"in-the-wild","identifiers":["CVE-2025-21335"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21335.json","latestUpdate":{"date":"2025-01-14","title":"CISA added CVE-2025-21335 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 4, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-21335","stacks":["linux","windows"],"startedAt":"2025-01-14","status":"closed","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. CISA added CVE-2025-21335 to its Known Exploited Vulnerabilities catalog on Jan 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (CVE-2025-21335)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21335","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-01-28","cveIds":["CVE-2025-21334"],"exploited":"in-the-wild","identifiers":["CVE-2025-21334"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21334.json","latestUpdate":{"date":"2025-01-14","title":"CISA added CVE-2025-21334 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 4, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-21334","stacks":["linux","windows"],"startedAt":"2025-01-14","status":"closed","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. CISA added CVE-2025-21334 to its Known Exploited Vulnerabilities catalog on Jan 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (CVE-2025-21334)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21334","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-01-28","cveIds":["CVE-2025-21333"],"exploited":"in-the-wild","identifiers":["CVE-2025-21333"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21333.json","latestUpdate":{"date":"2025-01-14","title":"CISA added CVE-2025-21333 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 4, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2025-21333","stacks":["linux","windows"],"startedAt":"2025-01-14","status":"closed","summary":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges. CISA added CVE-2025-21333 to its Known Exploited Vulnerabilities catalog on Jan 14, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability (CVE-2025-21333)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2025-21333","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2025-01-28","cveIds":["CVE-2024-55591"],"exploited":"in-the-wild","identifiers":["CVE-2024-55591"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591.json","latestUpdate":{"date":"2025-01-14","title":"CISA added CVE-2024-55591 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 21, 2025)"},"patchStatus":"unknown","product":"FortiOS and FortiProxy","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-and-fortiproxy-cve-2024-55591","stacks":["network","vpn"],"startedAt":"2025-01-14","status":"closed","summary":"Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. CISA added CVE-2024-55591 to its Known Exploited Vulnerabilities catalog on Jan 14, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-288"],"title":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (CVE-2024-55591)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2025-01-27","cveIds":["CVE-2023-48365"],"exploited":"in-the-wild","identifiers":["CVE-2023-48365"],"json":"https://helix.ml/threat-watch/i/qlik-sense-cve-2023-48365.json","latestUpdate":{"date":"2025-01-13","title":"CISA added CVE-2023-48365 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 3, 2025)"},"patchStatus":"unknown","product":"Sense","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"qlik-sense-cve-2023-48365","stacks":[],"startedAt":"2025-01-13","status":"closed","summary":"Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. CISA added CVE-2023-48365 to its Known Exploited Vulnerabilities catalog on Jan 13, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-444"],"title":"Qlik Sense HTTP Tunneling Vulnerability (CVE-2023-48365)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qlik-sense-cve-2023-48365","vendor":"Qlik"},{"auto":true,"category":"patch","closedAt":"2025-01-27","cveIds":["CVE-2024-12686"],"exploited":"in-the-wild","identifiers":["CVE-2024-12686"],"json":"https://helix.ml/threat-watch/i/beyondtrust-privileged-remote-access-pra-and-remote-support-rs-cve-2024-12686.json","latestUpdate":{"date":"2025-01-13","title":"CISA added CVE-2024-12686 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 3, 2025)"},"patchStatus":"unknown","product":"Privileged Remote Access (PRA) and Remote Support (RS)","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"beyondtrust-privileged-remote-access-pra-and-remote-support-rs-cve-2024-12686","stacks":["rust"],"startedAt":"2025-01-13","status":"closed","summary":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user. CISA added CVE-2024-12686 to its Known Exploited Vulnerabilities catalog on Jan 13, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability (CVE-2024-12686)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/beyondtrust-privileged-remote-access-pra-and-remote-support-rs-cve-2024-12686","vendor":"BeyondTrust"},{"auto":true,"category":"breach","closedAt":"2025-01-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SCHOLASTIC"],"json":"https://helix.ml/threat-watch/i/scholastic-data-breach.json","latestUpdate":{"date":"2025-01-13","title":"Have I Been Pwned loaded 4.2M breached Scholastic accounts"},"patchStatus":"no-fix-needed","product":"scholastic.com","severity":"medium","severityNote":"4.2M accounts","slug":"scholastic-data-breach","stacks":[],"startedAt":"2025-01-13","status":"closed","summary":"In January 2025, a data breach of the publishing company Scholastic surfaced. The breach contained 4.2M unique email addresses with many of the records also including name, phone number and physical address. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jan 8, 2025; Have I Been Pwned loaded it on Jan 13, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Scholastic data breach: 4.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/scholastic-data-breach","vendor":"Scholastic"},{"auto":true,"category":"breach","closedAt":"2025-01-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STEALERLOGSJAN2025"],"json":"https://helix.ml/threat-watch/i/stealerlogsjan2025-data-breach.json","latestUpdate":{"date":"2025-01-13","title":"Have I Been Pwned loaded 71.0M breached Stealer Logs, Jan 2025 accounts"},"patchStatus":"no-fix-needed","product":"Stealer Logs, Jan 2025","severity":"high","severityNote":"71.0M accounts · passwords exposed · infostealer logs","slug":"stealerlogsjan2025-data-breach","stacks":[],"startedAt":"2025-01-13","status":"closed","summary":"In January 2025, stealer logs with 71M email addresses were added to HIBP. Consisting of email address, password and the website the credentials were entered against, this breach marks the launch of a new HIBP feature enabling the retrieval of the specific websites the logs were collected against. The incident also resulted in 106M more passwords being added to the Pwned Passwords service. Exposed data: email addresses, passwords. The breach dates from Jan 13, 2025; Have I Been Pwned loaded it on Jan 13, 2025.","tags":["data-breach","hibp","stealer-log","email-addresses","passwords"],"title":"Stealer Logs, Jan 2025 data breach: 71.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/stealerlogsjan2025-data-breach","vendor":"Stealer Logs, Jan 2025"},{"auto":true,"category":"breach","closedAt":"2025-01-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUPERDRAFT"],"json":"https://helix.ml/threat-watch/i/superdraft-data-breach.json","latestUpdate":{"date":"2025-01-12","title":"Have I Been Pwned loaded 300K breached SuperDraft accounts"},"patchStatus":"no-fix-needed","product":"superdraft.io","severity":"high","severityNote":"300K accounts · passwords exposed","slug":"superdraft-data-breach","stacks":[],"startedAt":"2025-01-12","status":"closed","summary":"In October 2024, the fantasy sports platform SuperDraft suffered a data breach that exposed over 300k customer records. The breach contained 24GB of data including email addresses, usernames, purchases, latitudes and longitudes, dates of birth and bcrypt password hashes. Exposed data: dates of birth, email addresses, geographic locations, latitude and longitude pairs, passwords, purchases, usernames. The breach dates from Oct 27, 2024; Have I Been Pwned loaded it on Jan 12, 2025.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","latitude-and-longitude-pairs","passwords","purchases","usernames"],"title":"SuperDraft data breach: 300K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/superdraft-data-breach","vendor":"SuperDraft"},{"auto":true,"category":"patch","closedAt":"2025-01-22","cveIds":["CVE-2025-0282"],"exploited":"in-the-wild","identifiers":["CVE-2025-0282"],"json":"https://helix.ml/threat-watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-0282.json","latestUpdate":{"date":"2025-01-08","title":"CISA added CVE-2025-0282 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 15, 2025)"},"patchStatus":"unknown","product":"Connect Secure, Policy Secure, and ZTA Gateways","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-0282","stacks":["vpn"],"startedAt":"2025-01-08","status":"closed","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution. CISA added CVE-2025-0282 to its Known Exploited Vulnerabilities catalog on Jan 8, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-121"],"title":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability (CVE-2025-0282)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-0282","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2025-01-21","cveIds":["CVE-2020-2883"],"exploited":"in-the-wild","identifiers":["CVE-2020-2883"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-2883.json","latestUpdate":{"date":"2025-01-07","title":"CISA added CVE-2020-2883 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 28, 2025)"},"patchStatus":"unknown","product":"WebLogic Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2020-2883","stacks":["java"],"startedAt":"2025-01-07","status":"closed","summary":"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. CISA added CVE-2020-2883 to its Known Exploited Vulnerabilities catalog on Jan 7, 2025, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle WebLogic Server Unspecified Vulnerability (CVE-2020-2883)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-2883","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2025-01-21","cveIds":["CVE-2024-55550"],"exploited":"in-the-wild","identifiers":["CVE-2024-55550"],"json":"https://helix.ml/threat-watch/i/mitel-micollab-cve-2024-55550.json","latestUpdate":{"date":"2025-01-07","title":"CISA added CVE-2024-55550 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 28, 2025)"},"patchStatus":"unknown","product":"MiCollab","severity":"low","severityNote":"CVSS 2.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"mitel-micollab-cve-2024-55550","stacks":[],"startedAt":"2025-01-07","status":"closed","summary":"Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. CISA added CVE-2024-55550 to its Known Exploited Vulnerabilities catalog on Jan 7, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"Mitel MiCollab Path Traversal Vulnerability (CVE-2024-55550)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/mitel-micollab-cve-2024-55550","vendor":"Mitel"},{"auto":true,"category":"patch","closedAt":"2025-01-21","cveIds":["CVE-2024-41713"],"exploited":"in-the-wild","identifiers":["CVE-2024-41713"],"json":"https://helix.ml/threat-watch/i/mitel-micollab-cve-2024-41713.json","latestUpdate":{"date":"2025-01-07","title":"CISA added CVE-2024-41713 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 28, 2025)"},"patchStatus":"unknown","product":"MiCollab","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"mitel-micollab-cve-2024-41713","stacks":[],"startedAt":"2025-01-07","status":"closed","summary":"Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server. CISA added CVE-2024-41713 to its Known Exploited Vulnerabilities catalog on Jan 7, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"Mitel MiCollab Path Traversal Vulnerability (CVE-2024-41713)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/mitel-micollab-cve-2024-41713","vendor":"Mitel"},{"auto":true,"category":"breach","closedAt":"2025-01-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GLAMIRA"],"json":"https://helix.ml/threat-watch/i/glamira-data-breach.json","latestUpdate":{"date":"2025-01-03","title":"Have I Been Pwned loaded 874K breached GLAMIRA accounts"},"patchStatus":"no-fix-needed","product":"glamira.com","severity":"medium","severityNote":"874K accounts","slug":"glamira-data-breach","stacks":[],"startedAt":"2025-01-03","status":"closed","summary":"In late 2023, the online jewellery store GLAMIRA suffered a data breach they attributed to \"an unauthorised individual [who] briefly accessed one of our servers\". The data was subsequently published on a popular hacking forum and included 875k email addresses, names, phone numbers and purchases. Exposed data: email addresses, names, phone numbers, purchases. The breach dates from Dec 16, 2023; Have I Been Pwned loaded it on Jan 3, 2025.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","purchases"],"title":"GLAMIRA data breach: 874K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/glamira-data-breach","vendor":"GLAMIRA"},{"auto":true,"category":"patch","closedAt":"2025-01-13","cveIds":["CVE-2024-3393"],"exploited":"in-the-wild","identifiers":["CVE-2024-3393"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-3393.json","latestUpdate":{"date":"2024-12-30","title":"CISA added CVE-2024-3393 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 20, 2025)"},"patchStatus":"unknown","product":"PAN-OS","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2024-3393","stacks":["network"],"startedAt":"2024-12-30","status":"closed","summary":"Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. CISA added CVE-2024-3393 to its Known Exploited Vulnerabilities catalog on Dec 30, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-754"],"title":"Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability (CVE-2024-3393)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-3393","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2025-01-06","cveIds":["CVE-2021-44207"],"exploited":"in-the-wild","identifiers":["CVE-2021-44207"],"json":"https://helix.ml/threat-watch/i/acclaim-systems-usaherds-cve-2021-44207.json","latestUpdate":{"date":"2024-12-23","title":"CISA added CVE-2021-44207 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 13, 2025)"},"patchStatus":"unknown","product":"USAHERDS","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"acclaim-systems-usaherds-cve-2021-44207","stacks":[],"startedAt":"2024-12-23","status":"closed","summary":"Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel. CISA added CVE-2021-44207 to its Known Exploited Vulnerabilities catalog on Dec 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","hard-coded-credentials","cwe-798"],"title":"Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability (CVE-2021-44207)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/acclaim-systems-usaherds-cve-2021-44207","vendor":"Acclaim Systems"},{"auto":true,"category":"breach","closedAt":"2025-01-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FRENCHCITIZENS"],"json":"https://helix.ml/threat-watch/i/frenchcitizens-data-breach.json","latestUpdate":{"date":"2024-12-20","title":"Have I Been Pwned loaded 28.4M breached French Citizens accounts"},"patchStatus":"no-fix-needed","product":"French Citizens","severity":"high","severityNote":"28.4M accounts · financial data exposed","slug":"frenchcitizens-data-breach","stacks":[],"startedAt":"2024-12-20","status":"closed","summary":"In September 2024, over 90M rows of data on French Citizens was found left exposed in a publicly facing database. Compiled from various data breaches, the corpus contained 28M unique email addresses with the various source breaches each exposing different fields including name, physical and IP address, phone number and partial credit card data including payment type and last 4 digits. Exposed data: device information, email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses. The breach dates from Sep 25, 2024; Have I Been Pwned loaded it on Dec 20, 2024.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses"],"title":"French Citizens data breach: 28.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/frenchcitizens-data-breach","vendor":"French Citizens"},{"auto":true,"category":"patch","closedAt":"2025-01-02","cveIds":["CVE-2024-12356"],"exploited":"in-the-wild","identifiers":["CVE-2024-12356"],"json":"https://helix.ml/threat-watch/i/beyondtrust-privileged-remote-access-pra-and-remote-support-rs-cve-2024-12356.json","latestUpdate":{"date":"2024-12-19","title":"CISA added CVE-2024-12356 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 27, 2024)"},"patchStatus":"unknown","product":"Privileged Remote Access (PRA) and Remote Support (RS) ","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"beyondtrust-privileged-remote-access-pra-and-remote-support-rs-cve-2024-12356","stacks":["rust"],"startedAt":"2024-12-19","status":"closed","summary":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user. CISA added CVE-2024-12356 to its Known Exploited Vulnerabilities catalog on Dec 19, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability (CVE-2024-12356)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/beyondtrust-privileged-remote-access-pra-and-remote-support-rs-cve-2024-12356","vendor":"BeyondTrust"},{"auto":true,"category":"breach","closedAt":"2025-01-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BITVIEW"],"json":"https://helix.ml/threat-watch/i/bitview-data-breach.json","latestUpdate":{"date":"2024-12-19","title":"Have I Been Pwned loaded 63K breached BitView accounts"},"patchStatus":"no-fix-needed","product":"bitview.net","severity":"high","severityNote":"63K accounts · passwords exposed","slug":"bitview-data-breach","stacks":[],"startedAt":"2024-12-19","status":"closed","summary":"In December 2024, the video sharing Community BitView suffered a data breach that exposed 63k customer records. Attributed to a backup taken by a previous administrator earlier in the year, the breach exposed email and IP addresses, bcrypt password hashes, usernames, bios, private messages, video comments and for some records, gender, date of birth and country of location. Exposed data: bios, comments, dates of birth, email addresses, genders, geographic locations, ip addresses, passwords, private messages, usernames. The breach dates from Dec 14, 2024; Have I Been Pwned loaded it on Dec 19, 2024.","tags":["data-breach","hibp","bios","comments","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","passwords","private-messages","usernames"],"title":"BitView data breach: 63K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bitview-data-breach","vendor":"BitView"},{"auto":true,"category":"breach","closedAt":"2025-01-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SCHENKYOU"],"json":"https://helix.ml/threat-watch/i/schenkyou-data-breach.json","latestUpdate":{"date":"2024-12-19","title":"Have I Been Pwned loaded 237K breached schenkYOU accounts"},"patchStatus":"no-fix-needed","product":"schenkyou.de","severity":"high","severityNote":"237K accounts · passwords exposed","slug":"schenkyou-data-breach","stacks":[],"startedAt":"2024-12-19","status":"closed","summary":"In September 2024, data from the online German gift store schenkYOU was put up for sale on a popular hacking forum. Obtained the month before, the data included 237k unique email addresses alongside names, dates of birth and salted SHA-256 password hashes. The standalone store was subsequently shut down with all traffic redirected to their Amazon store. Exposed data: dates of birth, email addresses, names, passwords. The breach dates from Aug 15, 2024; Have I Been Pwned loaded it on Dec 19, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords"],"title":"schenkYOU data breach: 237K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/schenkyou-data-breach","vendor":"schenkYOU"},{"auto":true,"category":"breach","closedAt":"2025-01-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YOUNGLIVINGESSENTIALOILS"],"json":"https://helix.ml/threat-watch/i/younglivingessentialoils-data-breach.json","latestUpdate":{"date":"2024-12-19","title":"Have I Been Pwned loaded 1.1M breached Young Living Essential Oils accounts"},"patchStatus":"no-fix-needed","product":"youngliving.com","severity":"medium","severityNote":"1.1M accounts","slug":"younglivingessentialoils-data-breach","stacks":[],"startedAt":"2024-12-19","status":"closed","summary":"In December 2024, data claimed to be breached from the multi-level marketing company Young Living Essential Oils was posted to a popular hacking forum. The data contained 1.1M unique email addresses alongside names, the country of the account and in many cases, their date of birth. Young Living Essential Oils did not respond to multiple attempts to contact them about the data. Exposed data: dates of birth, email addresses, geographic locations, names. The breach dates from Dec 11, 2024; Have I Been Pwned loaded it on Dec 19, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","names"],"title":"Young Living Essential Oils data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/younglivingessentialoils-data-breach","vendor":"Young Living Essential Oils"},{"auto":true,"category":"patch","closedAt":"2025-01-01","cveIds":["CVE-2021-40407"],"exploited":"in-the-wild","identifiers":["CVE-2021-40407"],"json":"https://helix.ml/threat-watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407.json","latestUpdate":{"date":"2024-12-18","title":"CISA added CVE-2021-40407 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 8, 2025)"},"patchStatus":"unpatched","product":"RLC-410W IP Camera","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"reolink-rlc-410w-ip-camera-cve-2021-40407","stacks":[],"startedAt":"2024-12-18","status":"closed","summary":"Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. CISA added CVE-2021-40407 to its Known Exploited Vulnerabilities catalog on Dec 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Reolink RLC-410W IP Camera OS Command Injection Vulnerability (CVE-2021-40407)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407","vendor":"Reolink"},{"auto":true,"category":"patch","closedAt":"2025-01-01","cveIds":["CVE-2019-11001"],"exploited":"in-the-wild","identifiers":["CVE-2019-11001"],"json":"https://helix.ml/threat-watch/i/reolink-multiple-ip-cameras-cve-2019-11001.json","latestUpdate":{"date":"2024-12-18","title":"CISA added CVE-2019-11001 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 8, 2025)"},"patchStatus":"unpatched","product":"Multiple IP Cameras","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"reolink-multiple-ip-cameras-cve-2019-11001","stacks":[],"startedAt":"2024-12-18","status":"closed","summary":"Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the \"TestEmail\" functionality to inject and run OS commands as root. CISA added CVE-2019-11001 to its Known Exploited Vulnerabilities catalog on Dec 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Reolink Multiple IP Cameras OS Command Injection Vulnerability (CVE-2019-11001)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/reolink-multiple-ip-cameras-cve-2019-11001","vendor":"Reolink"},{"auto":true,"category":"patch","closedAt":"2025-01-01","cveIds":["CVE-2022-23227"],"exploited":"in-the-wild","identifiers":["CVE-2022-23227"],"json":"https://helix.ml/threat-watch/i/nuuo-nvrmini2-devices-cve-2022-23227.json","latestUpdate":{"date":"2024-12-18","title":"CISA added CVE-2022-23227 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 8, 2025)"},"patchStatus":"unpatched","product":"NVRmini2 Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nuuo-nvrmini2-devices-cve-2022-23227","stacks":[],"startedAt":"2024-12-18","status":"closed","summary":"NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. CISA added CVE-2022-23227 to its Known Exploited Vulnerabilities catalog on Dec 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"NUUO NVRmini2 Devices Missing Authentication Vulnerability (CVE-2022-23227)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/nuuo-nvrmini2-devices-cve-2022-23227","vendor":"NUUO"},{"auto":true,"category":"patch","closedAt":"2025-01-01","cveIds":["CVE-2018-14933"],"exploited":"in-the-wild","identifiers":["CVE-2018-14933"],"json":"https://helix.ml/threat-watch/i/nuuo-nvrmini-devices-cve-2018-14933.json","latestUpdate":{"date":"2024-12-18","title":"CISA added CVE-2018-14933 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 8, 2025)"},"patchStatus":"unpatched","product":"NVRmini Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nuuo-nvrmini-devices-cve-2018-14933","stacks":[],"startedAt":"2024-12-18","status":"closed","summary":"NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. CISA added CVE-2018-14933 to its Known Exploited Vulnerabilities catalog on Dec 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"NUUO NVRmini Devices OS Command Injection Vulnerability (CVE-2018-14933)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/nuuo-nvrmini-devices-cve-2018-14933","vendor":"NUUO"},{"auto":true,"category":"patch","closedAt":"2024-12-31","cveIds":["CVE-2024-55956"],"exploited":"in-the-wild","identifiers":["CVE-2024-55956"],"json":"https://helix.ml/threat-watch/i/cleo-multiple-products-cve-2024-55956.json","latestUpdate":{"date":"2024-12-17","title":"CISA added CVE-2024-55956 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 7, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cleo-multiple-products-cve-2024-55956","stacks":[],"startedAt":"2024-12-17","status":"closed","summary":"Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. CISA added CVE-2024-55956 to its Known Exploited Vulnerabilities catalog on Dec 17, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-276"],"title":"Cleo Multiple Products Unauthenticated File Upload Vulnerability (CVE-2024-55956)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cleo-multiple-products-cve-2024-55956","vendor":"Cleo"},{"auto":true,"category":"patch","closedAt":"2024-12-30","cveIds":["CVE-2024-35250"],"exploited":"in-the-wild","identifiers":["CVE-2024-35250"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-35250.json","latestUpdate":{"date":"2024-12-16","title":"CISA added CVE-2024-35250 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 6, 2025)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-35250","stacks":["linux","rust","windows"],"startedAt":"2024-12-16","status":"closed","summary":"Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges. CISA added CVE-2024-35250 to its Known Exploited Vulnerabilities catalog on Dec 16, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-822"],"title":"Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability (CVE-2024-35250)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-35250","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-12-30","cveIds":["CVE-2024-20767"],"exploited":"in-the-wild","identifiers":["CVE-2024-20767"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2024-20767.json","latestUpdate":{"date":"2024-12-16","title":"CISA added CVE-2024-20767 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 6, 2025)"},"patchStatus":"unknown","product":"ColdFusion","severity":"high","severityNote":"CVSS 7.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2024-20767","stacks":[],"startedAt":"2024-12-16","status":"closed","summary":"Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. CISA added CVE-2024-20767 to its Known Exploited Vulnerabilities catalog on Dec 16, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Adobe ColdFusion Improper Access Control Vulnerability (CVE-2024-20767)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2024-20767","vendor":"Adobe"},{"auto":true,"category":"breach","closedAt":"2024-12-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOPAMEDIA"],"json":"https://helix.ml/threat-watch/i/hopamedia-data-breach.json","latestUpdate":{"date":"2024-12-16","title":"Have I Been Pwned loaded 23.8M breached Hopamedia accounts"},"patchStatus":"no-fix-needed","product":"Hopamedia","severity":"medium","severityNote":"23.8M accounts","slug":"hopamedia-data-breach","stacks":[],"startedAt":"2024-12-16","status":"closed","summary":"In 2024, data relating to an unknown service referred to as \"Hopamedia\" and dating back to 2020 appeared in a publicly exposed database. The data included almost 24M records of email address, name, phone number, the country of the individual and their telecommunications carrier. Exposed data: email addresses, geographic locations, names, phone numbers, telecommunications carrier. The breach dates from Aug 30, 2020; Have I Been Pwned loaded it on Dec 16, 2024.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","phone-numbers","telecommunications-carrier"],"title":"Hopamedia data breach: 23.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/hopamedia-data-breach","vendor":"Hopamedia"},{"auto":true,"category":"breach","closedAt":"2024-12-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MC2DATA"],"json":"https://helix.ml/threat-watch/i/mc2data-data-breach.json","latestUpdate":{"date":"2024-12-15","title":"Have I Been Pwned loaded 2.1M breached MC2 Data accounts"},"patchStatus":"no-fix-needed","product":"MC2 Data","severity":"high","severityNote":"2.1M accounts · passwords exposed","slug":"mc2data-data-breach","stacks":[],"startedAt":"2024-12-15","status":"closed","summary":"In August 2024, data aggregator MC2 Data left a database publicly accessible without a password which was subsequently discovered by a security researcher. The breach exposed the personal information of 2.1M subscribers to the service which was marketed under a series of different brand names. The data included email addresses, names and salted SHA-256 password hashes. Exposed data: email addresses, names, passwords. The breach dates from Aug 18, 2024; Have I Been Pwned loaded it on Dec 15, 2024.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"MC2 Data data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mc2data-data-breach","vendor":"MC2 Data"},{"auto":true,"category":"breach","closedAt":"2024-12-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TIBBER"],"json":"https://helix.ml/threat-watch/i/tibber-data-breach.json","latestUpdate":{"date":"2024-12-14","title":"Have I Been Pwned loaded 50K breached Tibber accounts"},"patchStatus":"no-fix-needed","product":"tibber.com","severity":"medium","severityNote":"50K accounts","slug":"tibber-data-breach","stacks":[],"startedAt":"2024-12-14","status":"closed","summary":"In November 2024, the German electricity provider Tibber suffered a data breach that exposed the personal information of 50k customers. The data included names, email addresses, geographic locations (city and postcode) and total spend on purchases. Exposed data: email addresses, geographic locations, names, purchases. The breach dates from Nov 10, 2024; Have I Been Pwned loaded it on Dec 14, 2024.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","purchases"],"title":"Tibber data breach: 50K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tibber-data-breach","vendor":"Tibber"},{"auto":true,"category":"breach","closedAt":"2024-12-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YONEMA"],"json":"https://helix.ml/threat-watch/i/yonema-data-breach.json","latestUpdate":{"date":"2024-12-14","title":"Have I Been Pwned loaded 35K breached Yonéma accounts"},"patchStatus":"no-fix-needed","product":"yonema.com","severity":"high","severityNote":"35K accounts · passwords exposed","slug":"yonema-data-breach","stacks":[],"startedAt":"2024-12-14","status":"closed","summary":"In November 2024, data from the Senegalese payment platform Yonéma was posted to a popular hacking forum. The data included 36k unique email addresses alongside phone numbers, names and what appears to be encrypted passwords and dates of birth. Exposed data: dates of birth, device information, email addresses, ip addresses, names, passwords, phone numbers. The breach dates from Nov 21, 2024; Have I Been Pwned loaded it on Dec 14, 2024.","tags":["data-breach","hibp","dates-of-birth","device-information","email-addresses","ip-addresses","names","passwords","phone-numbers"],"title":"Yonéma data breach: 35K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/yonema-data-breach","vendor":"Yonéma"},{"auto":true,"category":"patch","closedAt":"2024-12-27","cveIds":["CVE-2024-50623"],"exploited":"in-the-wild","identifiers":["CVE-2024-50623"],"json":"https://helix.ml/threat-watch/i/cleo-multiple-products-cve-2024-50623.json","latestUpdate":{"date":"2024-12-13","title":"CISA added CVE-2024-50623 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 3, 2025)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cleo-multiple-products-cve-2024-50623","stacks":[],"startedAt":"2024-12-13","status":"closed","summary":"Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges. CISA added CVE-2024-50623 to its Known Exploited Vulnerabilities catalog on Dec 13, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-434"],"title":"Cleo Multiple Products Unrestricted File Upload Vulnerability (CVE-2024-50623)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cleo-multiple-products-cve-2024-50623","vendor":"Cleo"},{"auto":true,"category":"patch","closedAt":"2024-12-24","cveIds":["CVE-2024-49138"],"exploited":"in-the-wild","identifiers":["CVE-2024-49138"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-49138.json","latestUpdate":{"date":"2024-12-10","title":"CISA added CVE-2024-49138 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 31, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-49138","stacks":["windows"],"startedAt":"2024-12-10","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges. CISA added CVE-2024-49138 to its Known Exploited Vulnerabilities catalog on Dec 10, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-122"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability (CVE-2024-49138)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-49138","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-12-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LADIES"],"json":"https://helix.ml/threat-watch/i/ladies-data-breach.json","latestUpdate":{"date":"2024-12-09","title":"Have I Been Pwned loaded 118K breached Ladies.com accounts"},"patchStatus":"no-fix-needed","product":"ladies.com","severity":"high","severityNote":"118K accounts","slug":"ladies-data-breach","stacks":[],"startedAt":"2024-12-09","status":"closed","summary":"In 2024, the lesbian dating website ladies.com suffered a data breach. Attributed to an exposed Firebase database, the breach included extensive personal information on 119k users of the service including email addresses, photos, sexual orientation, genders, dates of birth and precise latitude and longitude, among other personal attributes. The website was shut down in mid-2024 and the breach later acknowledged by the site operator in December, along with a breach of the \"Senior Dating\" website run by the same organisation. Exposed data: bios, dates of birth, drinking habits, education levels, email addresses, family structure, genders, geographic locations, latitude and longitude pairs, photos, profile photos, relationship statuses, sexual orientations, smoking habits, tattoo status, usernames. The breach dates from Jul 3, 2024; Have I Been Pwned loaded it on Dec 9, 2024.","tags":["data-breach","hibp","bios","dates-of-birth","drinking-habits","education-levels","email-addresses","family-structure","genders","geographic-locations","latitude-and-longitude-pairs","photos","profile-photos","relationship-statuses"],"title":"Ladies.com data breach: 118K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ladies-data-breach","vendor":"Ladies.com"},{"auto":true,"category":"breach","closedAt":"2024-12-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SENIORDATING"],"json":"https://helix.ml/threat-watch/i/seniordating-data-breach.json","latestUpdate":{"date":"2024-12-09","title":"Have I Been Pwned loaded 765K breached Senior Dating accounts"},"patchStatus":"no-fix-needed","product":"seniordating.app","severity":"high","severityNote":"765K accounts","slug":"seniordating-data-breach","stacks":[],"startedAt":"2024-12-09","status":"closed","summary":"In 2024, the 40+ dating website Senior Dating suffered a data breach. Attributed to an exposed Firebase database, the breach included extensive personal information on 766k users of the service including email addresses, photos, genders, links to Facebook accounts, dates of birth and precise latitude and longitude, among other personal attributes. The website was shut down after the breach was acknowledged by the site operator in December, along with a breach of the \"ladies.com\" website run by the same organisation. Exposed data: bios, dates of birth, drinking habits, education levels, email addresses, genders, geographic locations, latitude and longitude pairs, occupations, profile photos, relationship statuses, smoking habits, social media profiles. The breach dates from Nov 23, 2024; Have I Been Pwned loaded it on Dec 9, 2024.","tags":["data-breach","hibp","bios","dates-of-birth","drinking-habits","education-levels","email-addresses","genders","geographic-locations","latitude-and-longitude-pairs","occupations","profile-photos","relationship-statuses","smoking-habits"],"title":"Senior Dating data breach: 765K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/seniordating-data-breach","vendor":"Senior Dating"},{"auto":true,"category":"patch","closedAt":"2024-12-18","cveIds":["CVE-2024-51378"],"exploited":"in-the-wild","identifiers":["CVE-2024-51378"],"json":"https://helix.ml/threat-watch/i/cyberpersons-cyberpanel-cve-2024-51378.json","latestUpdate":{"date":"2024-12-04","title":"CISA added CVE-2024-51378 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 25, 2024)"},"patchStatus":"patched","product":"CyberPanel","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cyberpersons-cyberpanel-cve-2024-51378","stacks":[],"startedAt":"2024-12-04","status":"closed","summary":"CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. CISA added CVE-2024-51378 to its Known Exploited Vulnerabilities catalog on Dec 4, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-276"],"title":"CyberPanel Incorrect Default Permissions Vulnerability (CVE-2024-51378)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cyberpersons-cyberpanel-cve-2024-51378","vendor":"CyberPersons"},{"auto":true,"category":"patch","closedAt":"2024-12-17","cveIds":["CVE-2024-11667"],"exploited":"in-the-wild","identifiers":["CVE-2024-11667"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2024-11667.json","latestUpdate":{"date":"2024-12-03","title":"CISA added CVE-2024-11667 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2024)"},"patchStatus":"unknown","product":"Multiple Firewalls","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-firewalls-cve-2024-11667","stacks":["network"],"startedAt":"2024-12-03","status":"closed","summary":"Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. CISA added CVE-2024-11667 to its Known Exploited Vulnerabilities catalog on Dec 3, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"Zyxel Multiple Firewalls Path Traversal Vulnerability (CVE-2024-11667)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2024-11667","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2024-12-17","cveIds":["CVE-2024-11680"],"exploited":"in-the-wild","identifiers":["CVE-2024-11680"],"json":"https://helix.ml/threat-watch/i/projectsend-projectsend-cve-2024-11680.json","latestUpdate":{"date":"2024-12-03","title":"CISA added CVE-2024-11680 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2024)"},"patchStatus":"patched","product":"ProjectSend","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"projectsend-projectsend-cve-2024-11680","stacks":[],"startedAt":"2024-12-03","status":"closed","summary":"ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. CISA added CVE-2024-11680 to its Known Exploited Vulnerabilities catalog on Dec 3, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"ProjectSend Improper Authentication Vulnerability (CVE-2024-11680)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/projectsend-projectsend-cve-2024-11680","vendor":"ProjectSend"},{"auto":true,"category":"patch","closedAt":"2024-12-17","cveIds":["CVE-2023-45727"],"exploited":"in-the-wild","identifiers":["CVE-2023-45727"],"json":"https://helix.ml/threat-watch/i/north-grid-proself-cve-2023-45727.json","latestUpdate":{"date":"2024-12-03","title":"CISA added CVE-2023-45727 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2024)"},"patchStatus":"unknown","product":"Proself","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"north-grid-proself-cve-2023-45727","stacks":[],"startedAt":"2024-12-03","status":"closed","summary":"North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack. CISA added CVE-2023-45727 to its Known Exploited Vulnerabilities catalog on Dec 3, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-611"],"title":"North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability (CVE-2023-45727)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/north-grid-proself-cve-2023-45727","vendor":"North Grid"},{"auto":true,"category":"patch","closedAt":"2024-12-09","cveIds":["CVE-2023-28461"],"exploited":"in-the-wild","identifiers":["CVE-2023-28461"],"json":"https://helix.ml/threat-watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461.json","latestUpdate":{"date":"2024-11-25","title":"CISA added CVE-2023-28461 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 16, 2024)"},"patchStatus":"unknown","product":"AG/vxAG ArrayOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"array-networks-ag-vxag-arrayos-cve-2023-28461","stacks":[],"startedAt":"2024-11-25","status":"closed","summary":"Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway. CISA added CVE-2023-28461 to its Known Exploited Vulnerabilities catalog on Nov 25, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-306"],"title":"Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability (CVE-2023-28461)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461","vendor":"Array Networks "},{"auto":true,"category":"breach","closedAt":"2024-12-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEREALWORLD"],"json":"https://helix.ml/threat-watch/i/therealworld-data-breach.json","latestUpdate":{"date":"2024-11-22","title":"Have I Been Pwned loaded 324K breached The Real World accounts"},"patchStatus":"no-fix-needed","product":"therealworld.net","severity":"medium","severityNote":"324K accounts","slug":"therealworld-data-breach","stacks":[],"startedAt":"2024-11-22","status":"closed","summary":"In November 2024, the online course founded by Andrew Tate known as \"The Real World\" (previously \"Hustler's University\" suffered a data breach that exposed almost 325k users of the platform. The impacted data was limited to usernames, email addresses and chat logs. Exposed data: chat logs, email addresses, usernames. The breach dates from Nov 15, 2024; Have I Been Pwned loaded it on Nov 22, 2024.","tags":["data-breach","hibp","chat-logs","email-addresses","usernames"],"title":"The Real World data breach: 324K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/therealworld-data-breach","vendor":"The Real World"},{"auto":true,"category":"patch","closedAt":"2024-12-05","cveIds":["CVE-2024-21287"],"exploited":"in-the-wild","identifiers":["CVE-2024-21287"],"json":"https://helix.ml/threat-watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-21287.json","latestUpdate":{"date":"2024-11-21","title":"CISA added CVE-2024-21287 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 12, 2024)"},"patchStatus":"unknown","product":"Agile Product Lifecycle Management (PLM)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-agile-product-lifecycle-management-plm-cve-2024-21287","stacks":[],"startedAt":"2024-11-21","status":"closed","summary":"Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. CISA added CVE-2024-21287 to its Known Exploited Vulnerabilities catalog on Nov 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-863"],"title":"Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability (CVE-2024-21287)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-21287","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2024-12-05","cveIds":["CVE-2024-44309"],"exploited":"in-the-wild","identifiers":["CVE-2024-44309"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-44309.json","latestUpdate":{"date":"2024-11-21","title":"CISA added CVE-2024-44309 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 12, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"medium","severityNote":"CVSS 6.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2024-44309","stacks":[],"startedAt":"2024-11-21","status":"closed","summary":"Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. CISA added CVE-2024-44309 to its Known Exploited Vulnerabilities catalog on Nov 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability (CVE-2024-44309)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-44309","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2024-12-05","cveIds":["CVE-2024-44308"],"exploited":"in-the-wild","identifiers":["CVE-2024-44308"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-44308.json","latestUpdate":{"date":"2024-11-21","title":"CISA added CVE-2024-44308 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 12, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2024-44308","stacks":[],"startedAt":"2024-11-21","status":"closed","summary":"Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CISA added CVE-2024-44308 to its Known Exploited Vulnerabilities catalog on Nov 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Apple Multiple Products Code Execution Vulnerability (CVE-2024-44308)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-44308","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2024-12-04","cveIds":["CVE-2024-38813"],"exploited":"in-the-wild","identifiers":["CVE-2024-38813"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2024-38813.json","latestUpdate":{"date":"2024-11-20","title":"CISA added CVE-2024-38813 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 11, 2024)"},"patchStatus":"unknown","product":"vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2024-38813","stacks":["cloud"],"startedAt":"2024-11-20","status":"closed","summary":"VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. CISA added CVE-2024-38813 to its Known Exploited Vulnerabilities catalog on Nov 20, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-250","cwe-273"],"title":"VMware vCenter Server Privilege Escalation Vulnerability (CVE-2024-38813)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2024-38813","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2024-12-04","cveIds":["CVE-2024-38812"],"exploited":"in-the-wild","identifiers":["CVE-2024-38812"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2024-38812.json","latestUpdate":{"date":"2024-11-20","title":"CISA added CVE-2024-38812 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 11, 2024)"},"patchStatus":"unknown","product":"vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2024-38812","stacks":["cloud"],"startedAt":"2024-11-20","status":"closed","summary":"VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. CISA added CVE-2024-38812 to its Known Exploited Vulnerabilities catalog on Nov 20, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"VMware vCenter Server Heap-Based Buffer Overflow Vulnerability (CVE-2024-38812)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2024-38812","vendor":"VMware"},{"auto":true,"category":"breach","closedAt":"2024-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLIPACLIP"],"json":"https://helix.ml/threat-watch/i/flipaclip-data-breach.json","latestUpdate":{"date":"2024-11-20","title":"Have I Been Pwned loaded 892K breached FlipaClip accounts"},"patchStatus":"no-fix-needed","product":"flipaclip.com","severity":"medium","severityNote":"892K accounts","slug":"flipaclip-data-breach","stacks":[],"startedAt":"2024-11-20","status":"closed","summary":"In November 2024, the animation app FlipaClip suffered a data breach that exposed almost 900k records due to an exposed Firebase server. The impacted data included name, email address, country and date of birth. FlipaClip advised the issue has since been rectified. Exposed data: dates of birth, email addresses, geographic locations, names. The breach dates from Nov 18, 2024; Have I Been Pwned loaded it on Nov 20, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","names"],"title":"FlipaClip data breach: 892K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/flipaclip-data-breach","vendor":"FlipaClip"},{"auto":true,"category":"breach","closedAt":"2024-12-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FINSURE"],"json":"https://helix.ml/threat-watch/i/finsure-data-breach.json","latestUpdate":{"date":"2024-11-19","title":"Have I Been Pwned loaded 296K breached Finsure accounts"},"patchStatus":"no-fix-needed","product":"finsure.com.au","severity":"medium","severityNote":"296K accounts","slug":"finsure-data-breach","stacks":[],"startedAt":"2024-11-19","status":"closed","summary":"In October 2024, almost 300k unique email addresses from Australian mortgage broking group Finsure were obtained from the ActivePipe real estate marketing platform. The impacted data also included names, phone numbers and physical addresses. The incident did not directly affect any of Finsure's systems or expose any passwords or financial data. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Oct 15, 2024; Have I Been Pwned loaded it on Nov 19, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Finsure data breach: 296K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/finsure-data-breach","vendor":"Finsure"},{"auto":true,"category":"patch","closedAt":"2024-12-02","cveIds":["CVE-2024-9474"],"exploited":"in-the-wild","identifiers":["CVE-2024-9474"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-9474.json","latestUpdate":{"date":"2024-11-18","title":"CISA added CVE-2024-9474 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2024)"},"patchStatus":"unknown","product":"PAN-OS","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2024-9474","stacks":["network"],"startedAt":"2024-11-18","status":"closed","summary":"Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. CISA added CVE-2024-9474 to its Known Exploited Vulnerabilities catalog on Nov 18, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","privilege-escalation","cwe-77"],"title":"Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability (CVE-2024-9474)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-9474","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2024-12-02","cveIds":["CVE-2024-0012"],"exploited":"in-the-wild","identifiers":["CVE-2024-0012"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-0012.json","latestUpdate":{"date":"2024-11-18","title":"CISA added CVE-2024-0012 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2024)"},"patchStatus":"unknown","product":"PAN-OS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2024-0012","stacks":["network"],"startedAt":"2024-11-18","status":"closed","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CISA added CVE-2024-0012 to its Known Exploited Vulnerabilities catalog on Nov 18, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-306"],"title":"Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability (CVE-2024-0012)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-0012","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2024-12-02","cveIds":["CVE-2024-1212"],"exploited":"in-the-wild","identifiers":["CVE-2024-1212"],"json":"https://helix.ml/threat-watch/i/progress-kemp-loadmaster-cve-2024-1212.json","latestUpdate":{"date":"2024-11-18","title":"CISA added CVE-2024-1212 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2024)"},"patchStatus":"unknown","product":"Kemp LoadMaster","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-kemp-loadmaster-cve-2024-1212","stacks":[],"startedAt":"2024-11-18","status":"closed","summary":"Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. CISA added CVE-2024-1212 to its Known Exploited Vulnerabilities catalog on Nov 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Progress Kemp LoadMaster OS Command Injection Vulnerability (CVE-2024-1212)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/progress-kemp-loadmaster-cve-2024-1212","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2024-11-28","cveIds":["CVE-2024-9465"],"exploited":"in-the-wild","identifiers":["CVE-2024-9465"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-expedition-cve-2024-9465.json","latestUpdate":{"date":"2024-11-14","title":"CISA added CVE-2024-9465 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 5, 2024)"},"patchStatus":"unknown","product":"Expedition","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-expedition-cve-2024-9465","stacks":["network"],"startedAt":"2024-11-14","status":"closed","summary":"Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. CISA added CVE-2024-9465 to its Known Exploited Vulnerabilities catalog on Nov 14, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Palo Alto Networks Expedition SQL Injection Vulnerability (CVE-2024-9465)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-expedition-cve-2024-9465","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2024-11-28","cveIds":["CVE-2024-9463"],"exploited":"in-the-wild","identifiers":["CVE-2024-9463"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-expedition-cve-2024-9463.json","latestUpdate":{"date":"2024-11-14","title":"CISA added CVE-2024-9463 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 5, 2024)"},"patchStatus":"unknown","product":"Expedition","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-expedition-cve-2024-9463","stacks":["network"],"startedAt":"2024-11-14","status":"closed","summary":"Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. CISA added CVE-2024-9463 to its Known Exploited Vulnerabilities catalog on Nov 14, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Palo Alto Networks Expedition OS Command Injection Vulnerability (CVE-2024-9463)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-expedition-cve-2024-9463","vendor":"Palo Alto Networks"},{"auto":true,"category":"breach","closedAt":"2024-11-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DEMANDSCIENCE"],"json":"https://helix.ml/threat-watch/i/demandscience-data-breach.json","latestUpdate":{"date":"2024-11-13","title":"Have I Been Pwned loaded 121.8M breached DemandScience by Pure Incubation accounts"},"patchStatus":"no-fix-needed","product":"demandscience.com","severity":"high","severityNote":"121.8M accounts","slug":"demandscience-data-breach","stacks":[],"startedAt":"2024-11-13","status":"closed","summary":"In early 2024, a large corpus of data from DemandScience (a company owned by Pure Incubation), appeared for sale on a popular hacking forum. Later attributed to a leak from a decommissioned legacy system, the breach contained extensive data that was largely business contact information aggregated from public sources. Specifically, the data included 122M unique corporate email addresses, physical addresses, phone numbers, employers and job titles. It also included names and for many individuals, a link to their LinkedIn profile. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, social media profiles. The breach dates from Feb 28, 2024; Have I Been Pwned loaded it on Nov 13, 2024.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","social-media-profiles"],"title":"DemandScience by Pure Incubation data breach: 121.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/demandscience-data-breach","vendor":"DemandScience by Pure Incubation"},{"auto":true,"category":"patch","closedAt":"2024-11-26","cveIds":["CVE-2021-26086"],"exploited":"in-the-wild","identifiers":["CVE-2021-26086"],"json":"https://helix.ml/threat-watch/i/atlassian-jira-server-and-data-center-cve-2021-26086.json","latestUpdate":{"date":"2024-11-12","title":"CISA added CVE-2021-26086 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2024)"},"patchStatus":"unknown","product":"Jira Server and Data Center","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-jira-server-and-data-center-cve-2021-26086","stacks":["devtools","java"],"startedAt":"2024-11-12","status":"closed","summary":"Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint. CISA added CVE-2021-26086 to its Known Exploited Vulnerabilities catalog on Nov 12, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Atlassian Jira Server and Data Center Path Traversal Vulnerability (CVE-2021-26086)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/atlassian-jira-server-and-data-center-cve-2021-26086","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2024-11-26","cveIds":["CVE-2014-2120"],"exploited":"in-the-wild","identifiers":["CVE-2014-2120"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120.json","latestUpdate":{"date":"2024-11-12","title":"CISA added CVE-2014-2120 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2024)"},"patchStatus":"unknown","product":"Adaptive Security Appliance (ASA)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-cve-2014-2120","stacks":["network"],"startedAt":"2024-11-12","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. CISA added CVE-2014-2120 to its Known Exploited Vulnerabilities catalog on Nov 12, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability (CVE-2014-2120)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2024-11-26","cveIds":["CVE-2021-41277"],"exploited":"in-the-wild","identifiers":["CVE-2021-41277"],"json":"https://helix.ml/threat-watch/i/metabase-metabase-cve-2021-41277.json","latestUpdate":{"date":"2024-11-12","title":"CISA added CVE-2021-41277 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2024)"},"patchStatus":"patched","product":"Metabase","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"metabase-metabase-cve-2021-41277","stacks":[],"startedAt":"2024-11-12","status":"closed","summary":"Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. CISA added CVE-2021-41277 to its Known Exploited Vulnerabilities catalog on Nov 12, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Metabase GeoJSON API Local File Inclusion Vulnerability (CVE-2021-41277)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/metabase-metabase-cve-2021-41277","vendor":"Metabase"},{"auto":true,"category":"patch","closedAt":"2024-11-26","cveIds":["CVE-2024-43451"],"exploited":"in-the-wild","identifiers":["CVE-2024-43451"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43451.json","latestUpdate":{"date":"2024-11-12","title":"CISA added CVE-2024-43451 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2024)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-43451","stacks":["windows"],"startedAt":"2024-11-12","status":"closed","summary":"Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. CISA added CVE-2024-43451 to its Known Exploited Vulnerabilities catalog on Nov 12, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-73"],"title":"Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability (CVE-2024-43451)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43451","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-11-26","cveIds":["CVE-2024-49039"],"exploited":"in-the-wild","identifiers":["CVE-2024-49039"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-49039.json","latestUpdate":{"date":"2024-11-12","title":"CISA added CVE-2024-49039 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 3, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-49039","stacks":["windows"],"startedAt":"2024-11-12","status":"closed","summary":"Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. CISA added CVE-2024-49039 to its Known Exploited Vulnerabilities catalog on Nov 12, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-287"],"title":"Microsoft Windows Task Scheduler Privilege Escalation Vulnerability (CVE-2024-49039)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-49039","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-11-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOTTOPIC"],"json":"https://helix.ml/threat-watch/i/hottopic-data-breach.json","latestUpdate":{"date":"2024-11-11","title":"Have I Been Pwned loaded 56.9M breached Hot Topic accounts"},"patchStatus":"no-fix-needed","product":"hottopic.com","severity":"high","severityNote":"56.9M accounts · financial data exposed","slug":"hottopic-data-breach","stacks":[],"startedAt":"2024-11-11","status":"closed","summary":"In October 2024, retailer Hot Topic suffered a data breach that exposed 57 million unique email addresses. The impacted data also included physical addresses, phone numbers, purchases, genders, dates of birth and partial credit data containing card type, expiry and last 4 digits. Exposed data: dates of birth, email addresses, genders, names, partial credit card data, phone numbers, physical addresses, purchases, salutations. The breach dates from Oct 19, 2024; Have I Been Pwned loaded it on Nov 11, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases","salutations"],"title":"Hot Topic data breach: 56.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/hottopic-data-breach","vendor":"Hot Topic"},{"auto":true,"category":"patch","closedAt":"2024-11-21","cveIds":["CVE-2019-16278"],"exploited":"in-the-wild","identifiers":["CVE-2019-16278"],"json":"https://helix.ml/threat-watch/i/nostromo-nhttpd-cve-2019-16278.json","latestUpdate":{"date":"2024-11-07","title":"CISA added CVE-2019-16278 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 28, 2024)"},"patchStatus":"unknown","product":"nhttpd","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nostromo-nhttpd-cve-2019-16278","stacks":[],"startedAt":"2024-11-07","status":"closed","summary":"Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution. CISA added CVE-2019-16278 to its Known Exploited Vulnerabilities catalog on Nov 7, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"Nostromo nhttpd Directory Traversal Vulnerability (CVE-2019-16278)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/nostromo-nhttpd-cve-2019-16278","vendor":"Nostromo"},{"auto":true,"category":"patch","closedAt":"2024-11-21","cveIds":["CVE-2024-51567"],"exploited":"in-the-wild","identifiers":["CVE-2024-51567"],"json":"https://helix.ml/threat-watch/i/cyberpersons-cyberpanel-cve-2024-51567.json","latestUpdate":{"date":"2024-11-07","title":"CISA added CVE-2024-51567 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 28, 2024)"},"patchStatus":"patched","product":"CyberPanel","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cyberpersons-cyberpanel-cve-2024-51567","stacks":[],"startedAt":"2024-11-07","status":"closed","summary":"CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CISA added CVE-2024-51567 to its Known Exploited Vulnerabilities catalog on Nov 7, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-276"],"title":"CyberPanel Incorrect Default Permissions Vulnerability (CVE-2024-51567)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cyberpersons-cyberpanel-cve-2024-51567","vendor":"CyberPersons"},{"auto":true,"category":"patch","closedAt":"2024-11-21","cveIds":["CVE-2024-43093"],"exploited":"in-the-wild","identifiers":["CVE-2024-43093"],"json":"https://helix.ml/threat-watch/i/android-framework-cve-2024-43093.json","latestUpdate":{"date":"2024-11-07","title":"CISA added CVE-2024-43093 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 28, 2024)"},"patchStatus":"patched","product":"Framework","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-framework-cve-2024-43093","stacks":["android"],"startedAt":"2024-11-07","status":"closed","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2024-43093 to its Known Exploited Vulnerabilities catalog on Nov 7, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Android Framework Privilege Escalation Vulnerability (CVE-2024-43093)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-framework-cve-2024-43093","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2024-11-21","cveIds":["CVE-2024-5910"],"exploited":"in-the-wild","identifiers":["CVE-2024-5910"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-expedition-cve-2024-5910.json","latestUpdate":{"date":"2024-11-07","title":"CISA added CVE-2024-5910 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 28, 2024)"},"patchStatus":"unknown","product":"Expedition","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-expedition-cve-2024-5910","stacks":["network"],"startedAt":"2024-11-07","status":"closed","summary":"Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. CISA added CVE-2024-5910 to its Known Exploited Vulnerabilities catalog on Nov 7, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Palo Alto Networks Expedition Missing Authentication Vulnerability (CVE-2024-5910)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-expedition-cve-2024-5910","vendor":"Palo Alto Networks"},{"auto":true,"category":"breach","closedAt":"2024-11-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EARTH2"],"json":"https://helix.ml/threat-watch/i/earth2-data-breach.json","latestUpdate":{"date":"2024-11-07","title":"Have I Been Pwned loaded 420K breached Earth 2 accounts"},"patchStatus":"no-fix-needed","product":"earth2.io","severity":"medium","severityNote":"420K accounts","slug":"earth2-data-breach","stacks":[],"startedAt":"2024-11-07","status":"closed","summary":"In October 2024, 421k unique email addresses from the virtual earth game Earth 2 were derived from embedded Gravatar images. Appearing alongside player usernames, the root cause was related to how Gravatar presents links to avatars as MD5 hashes within consuming services, a feature Earth 2 advised has now been disabled on their platform. This incident did not expose any further personal information, passwords or financial data. Exposed data: email addresses, usernames. The breach dates from Oct 16, 2024; Have I Been Pwned loaded it on Nov 7, 2024.","tags":["data-breach","hibp","email-addresses","usernames"],"title":"Earth 2 data breach: 420K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/earth2-data-breach","vendor":"Earth 2"},{"auto":true,"category":"breach","closedAt":"2024-11-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ALTENEN"],"json":"https://helix.ml/threat-watch/i/altenen-data-breach.json","latestUpdate":{"date":"2024-11-05","title":"Have I Been Pwned loaded 1.3M breached Altenen accounts"},"patchStatus":"no-fix-needed","product":"altenens.is","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"altenen-data-breach","stacks":[],"startedAt":"2024-11-05","status":"closed","summary":"In June 2022, the malicious \"carding\" (referring to credit card fraud) website Altenen suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 1.3M unique email addresses, usernames, bcrypt password hashes and cryptocurrency wallet addresses. Exposed data: cryptocurrency wallet addresses, email addresses, passwords, usernames. The breach dates from Jun 24, 2022; Have I Been Pwned loaded it on Nov 5, 2024.","tags":["data-breach","hibp","cryptocurrency-wallet-addresses","email-addresses","passwords","usernames"],"title":"Altenen data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/altenen-data-breach","vendor":"Altenen"},{"auto":true,"category":"breach","closedAt":"2024-11-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DENNISKIRK"],"json":"https://helix.ml/threat-watch/i/denniskirk-data-breach.json","latestUpdate":{"date":"2024-11-05","title":"Have I Been Pwned loaded 1.4M breached Dennis Kirk accounts"},"patchStatus":"no-fix-needed","product":"denniskirk.com","severity":"medium","severityNote":"1.4M accounts","slug":"denniskirk-data-breach","stacks":[],"startedAt":"2024-11-05","status":"closed","summary":"In October 2024, almost 20GB of data containing 1.3M unique email addresses from motorcycle supplies store Dennis Kirk was circulated. Dating back to September 2021, the data also contained purchases from the online store along with customer names, phone numbers and postcodes. Dennis Kirk did not respond to multiple attempts to make contact about the breach. Exposed data: email addresses, geographic locations, names, phone numbers, purchases. The breach dates from Sep 4, 2021; Have I Been Pwned loaded it on Nov 5, 2024.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","phone-numbers","purchases"],"title":"Dennis Kirk data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/denniskirk-data-breach","vendor":"Dennis Kirk"},{"auto":true,"category":"patch","closedAt":"2024-11-18","cveIds":["CVE-2024-8956"],"exploited":"in-the-wild","identifiers":["CVE-2024-8956"],"json":"https://helix.ml/threat-watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956.json","latestUpdate":{"date":"2024-11-04","title":"CISA added CVE-2024-8956 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 25, 2024)"},"patchStatus":"unknown","product":"PT30X-SDI/NDI Cameras","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956","stacks":[],"startedAt":"2024-11-04","status":"closed","summary":"PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root. CISA added CVE-2024-8956 to its Known Exploited Vulnerabilities catalog on Nov 4, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-287"],"title":"PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability (CVE-2024-8956)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956","vendor":"PTZOptics"},{"auto":true,"category":"patch","closedAt":"2024-11-18","cveIds":["CVE-2024-8957"],"exploited":"in-the-wild","identifiers":["CVE-2024-8957"],"json":"https://helix.ml/threat-watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8957.json","latestUpdate":{"date":"2024-11-04","title":"CISA added CVE-2024-8957 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 25, 2024)"},"patchStatus":"unknown","product":"PT30X-SDI/NDI Cameras","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8957","stacks":[],"startedAt":"2024-11-04","status":"closed","summary":"PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script. CISA added CVE-2024-8957 to its Known Exploited Vulnerabilities catalog on Nov 4, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","privilege-escalation","cwe-78"],"title":"PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability (CVE-2024-8957)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8957","vendor":"PTZOptics"},{"auto":true,"category":"breach","closedAt":"2024-11-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZLIB"],"json":"https://helix.ml/threat-watch/i/zlib-data-breach.json","latestUpdate":{"date":"2024-11-04","title":"Have I Been Pwned loaded 9.7M breached Z-lib accounts"},"patchStatus":"no-fix-needed","product":"z-lib.is","severity":"high","severityNote":"9.7M accounts · passwords exposed","slug":"zlib-data-breach","stacks":[],"startedAt":"2024-11-04","status":"closed","summary":"In June 2024, almost 10M user records from Z-lib were discovered exposed online. Now defunct, Z-lib was a malicious clone of Z-Library, a well-known shadow online platform for pirating books and academic papers. The exposed data included usernames, email addresses, countries of residence, Bitcoin and Monero cryptocurrency wallet addresses, purchases and bcrypt password hashes. Exposed data: cryptocurrency wallet addresses, email addresses, geographic locations, passwords, purchases, usernames. The breach dates from Jun 20, 2024; Have I Been Pwned loaded it on Nov 4, 2024.","tags":["data-breach","hibp","cryptocurrency-wallet-addresses","email-addresses","geographic-locations","passwords","purchases","usernames"],"title":"Z-lib data breach: 9.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/zlib-data-breach","vendor":"Z-lib"},{"auto":true,"category":"breach","closedAt":"2024-11-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STALKERONLINE"],"json":"https://helix.ml/threat-watch/i/stalkeronline-data-breach.json","latestUpdate":{"date":"2024-10-31","title":"Have I Been Pwned loaded 1.4M breached Stalker Online accounts"},"patchStatus":"no-fix-needed","product":"stalker.so","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"stalkeronline-data-breach","stacks":[],"startedAt":"2024-10-31","status":"closed","summary":"In May 2020, over 1.3M records from the MMO game Stalker Online were breached. The data included email and IP addresses, usernames and hashed passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 5, 2020; Have I Been Pwned loaded it on Oct 31, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Stalker Online data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/stalkeronline-data-breach","vendor":"Stalker Online"},{"auto":true,"category":"breach","closedAt":"2024-11-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VIMEWORLD"],"json":"https://helix.ml/threat-watch/i/vimeworld-data-breach.json","latestUpdate":{"date":"2024-10-30","title":"Have I Been Pwned loaded 3.1M breached VimeWorld accounts"},"patchStatus":"no-fix-needed","product":"vimeworld.com","severity":"high","severityNote":"3.1M accounts · passwords exposed","slug":"vimeworld-data-breach","stacks":[],"startedAt":"2024-10-30","status":"closed","summary":"In October 2018, the Russian Minecraft service VimeWorld suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 3.1M records of usernames, email and IP addresses and passwords stored as either MD5 or bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 1, 2018; Have I Been Pwned loaded it on Oct 30, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"VimeWorld data breach: 3.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/vimeworld-data-breach","vendor":"VimeWorld"},{"auto":true,"category":"breach","closedAt":"2024-11-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TNAFLIX"],"json":"https://helix.ml/threat-watch/i/tnaflix-data-breach.json","latestUpdate":{"date":"2024-10-30","title":"Have I Been Pwned loaded 1.4M breached TNAFlix accounts"},"patchStatus":"no-fix-needed","product":"tnaflix.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"tnaflix-data-breach","stacks":[],"startedAt":"2024-10-30","status":"closed","summary":"In June 2022, the adult website TNAFlix suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 1.4M records of email and IP addresses, usernames and plain text passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jun 1, 2022; Have I Been Pwned loaded it on Oct 30, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"TNAFlix data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tnaflix-data-breach","vendor":"TNAFlix"},{"auto":true,"category":"breach","closedAt":"2024-11-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STREAMCRAFT"],"json":"https://helix.ml/threat-watch/i/streamcraft-data-breach.json","latestUpdate":{"date":"2024-10-27","title":"Have I Been Pwned loaded 1.8M breached StreamCraft accounts"},"patchStatus":"no-fix-needed","product":"streamcraft.net","severity":"high","severityNote":"1.8M accounts · passwords exposed","slug":"streamcraft-data-breach","stacks":[],"startedAt":"2024-10-27","status":"closed","summary":"In July 2020, the Russian Minecraft service StreamCraft suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 1.8M records of usernames, email and IP addresses and passwords stored as either MD5 or bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 6, 2020; Have I Been Pwned loaded it on Oct 27, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"StreamCraft data breach: 1.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/streamcraft-data-breach","vendor":"StreamCraft"},{"auto":true,"category":"breach","closedAt":"2024-11-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THECLUBPENGUINEXPERIENCE"],"json":"https://helix.ml/threat-watch/i/theclubpenguinexperience-data-breach.json","latestUpdate":{"date":"2024-10-26","title":"Have I Been Pwned loaded 6342 breached The Club Penguin Experience accounts"},"patchStatus":"no-fix-needed","product":"thecpexperience.com","severity":"high","severityNote":"6342 accounts · passwords exposed","slug":"theclubpenguinexperience-data-breach","stacks":[],"startedAt":"2024-10-26","status":"closed","summary":"In October 2024, The Club Penguin Experience (TCPE) suffered a data breach. The incident exposed over 6k subscribers' email addresses alongside usernames, age groups, passwords stored as bcrypt hashes and in some cases, plain text password hints. TCPE sent prompt disclosure notices to impacted customers following the breach. Exposed data: age groups, email addresses, password hints, passwords, usernames. The breach dates from Oct 14, 2024; Have I Been Pwned loaded it on Oct 26, 2024.","tags":["data-breach","hibp","age-groups","email-addresses","password-hints","passwords","usernames"],"title":"The Club Penguin Experience data breach: 6342 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/theclubpenguinexperience-data-breach","vendor":"The Club Penguin Experience"},{"auto":true,"category":"breach","closedAt":"2024-11-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DIGIDIRECT"],"json":"https://helix.ml/threat-watch/i/digidirect-data-breach.json","latestUpdate":{"date":"2024-10-25","title":"Have I Been Pwned loaded 304K breached digiDirect accounts"},"patchStatus":"no-fix-needed","product":"digidirect.com.au","severity":"medium","severityNote":"304K accounts","slug":"digidirect-data-breach","stacks":[],"startedAt":"2024-10-25","status":"closed","summary":"In September 2024, a data breach sourced from the Australian retailer digiDirect was published to a popular hacking forum. The breach exposed over 300k rows of data including email and physical address, name, phone number and date of birth. Approximately half the email addresses were on domains from external marketplaces including Amazon, eBay and Westfield. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Sep 29, 2024; Have I Been Pwned loaded it on Oct 25, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses"],"title":"digiDirect data breach: 304K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/digidirect-data-breach","vendor":"digiDirect"},{"auto":true,"category":"patch","closedAt":"2024-11-07","cveIds":["CVE-2024-37383"],"exploited":"in-the-wild","identifiers":["CVE-2024-37383"],"json":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2024-37383.json","latestUpdate":{"date":"2024-10-24","title":"CISA added CVE-2024-37383 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2024)"},"patchStatus":"patched","product":"Webmail","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-webmail-cve-2024-37383","stacks":[],"startedAt":"2024-10-24","status":"closed","summary":"RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code. CISA added CVE-2024-37383 to its Known Exploited Vulnerabilities catalog on Oct 24, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability (CVE-2024-37383)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2024-37383","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2024-11-07","cveIds":["CVE-2024-20481"],"exploited":"in-the-wild","identifiers":["CVE-2024-20481"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20481.json","latestUpdate":{"date":"2024-10-24","title":"CISA added CVE-2024-20481 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2024)"},"patchStatus":"unknown","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","severity":"medium","severityNote":"CVSS 5.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20481","stacks":["network"],"startedAt":"2024-10-24","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. CISA added CVE-2024-20481 to its Known Exploited Vulnerabilities catalog on Oct 24, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-772"],"title":"Cisco ASA and FTD Denial-of-Service Vulnerability (CVE-2024-20481)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20481","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2024-11-06","cveIds":["CVE-2024-47575"],"exploited":"in-the-wild","identifiers":["CVE-2024-47575"],"json":"https://helix.ml/threat-watch/i/fortinet-fortimanager-cve-2024-47575.json","latestUpdate":{"date":"2024-10-23","title":"CISA added CVE-2024-47575 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 13, 2024)"},"patchStatus":"unknown","product":"FortiManager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortimanager-cve-2024-47575","stacks":["network"],"startedAt":"2024-10-23","status":"closed","summary":"Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. CISA added CVE-2024-47575 to its Known Exploited Vulnerabilities catalog on Oct 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-306"],"title":"Fortinet FortiManager Missing Authentication Vulnerability (CVE-2024-47575)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-fortimanager-cve-2024-47575","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2024-11-05","cveIds":["CVE-2024-38094"],"exploited":"in-the-wild","identifiers":["CVE-2024-38094"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2024-38094.json","latestUpdate":{"date":"2024-10-22","title":"CISA added CVE-2024-38094 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 12, 2024)"},"patchStatus":"patched","product":"SharePoint","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2024-38094","stacks":["windows"],"startedAt":"2024-10-22","status":"closed","summary":"Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. CISA added CVE-2024-38094 to its Known Exploited Vulnerabilities catalog on Oct 22, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502"],"title":"Microsoft SharePoint Deserialization Vulnerability (CVE-2024-38094)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2024-38094","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-11-04","cveIds":["CVE-2024-9537"],"exploited":"in-the-wild","identifiers":["CVE-2024-9537"],"json":"https://helix.ml/threat-watch/i/sciencelogic-sl1-cve-2024-9537.json","latestUpdate":{"date":"2024-10-21","title":"CISA added CVE-2024-9537 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 11, 2024)"},"patchStatus":"unknown","product":"SL1","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sciencelogic-sl1-cve-2024-9537","stacks":[],"startedAt":"2024-10-21","status":"closed","summary":"ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component. CISA added CVE-2024-9537 to its Known Exploited Vulnerabilities catalog on Oct 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"ScienceLogic SL1 Unspecified Vulnerability (CVE-2024-9537)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sciencelogic-sl1-cve-2024-9537","vendor":"ScienceLogic"},{"auto":true,"category":"breach","closedAt":"2024-11-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FAIRVOTECANADA"],"json":"https://helix.ml/threat-watch/i/fairvotecanada-data-breach.json","latestUpdate":{"date":"2024-10-21","title":"Have I Been Pwned loaded 134K breached Fair Vote Canada accounts"},"patchStatus":"no-fix-needed","product":"fairvote.ca","severity":"medium","severityNote":"134K accounts","slug":"fairvotecanada-data-breach","stacks":[],"startedAt":"2024-10-21","status":"closed","summary":"In March 2024, the Canadian national citizens' campaign for proportional representation Fair Vote Canada suffered a data breach. The incident was attributed to \"a well-meaning volunteer\" who inadvertently exposed data from 2020 which included 134k unique email addresses, names, physical addresses, phone numbers and, for some individuals, date and amount of a donation. Exposed data: email addresses, names, phone numbers, physical addresses, political donations. The breach dates from Mar 2, 2024; Have I Been Pwned loaded it on Oct 21, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","political-donations"],"title":"Fair Vote Canada data breach: 134K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/fairvotecanada-data-breach","vendor":"Fair Vote Canada"},{"auto":true,"category":"patch","closedAt":"2024-10-31","cveIds":["CVE-2024-40711"],"exploited":"in-the-wild","identifiers":["CVE-2024-40711"],"json":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2024-40711.json","latestUpdate":{"date":"2024-10-17","title":"CISA added CVE-2024-40711 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 7, 2024)"},"patchStatus":"unknown","product":"Backup \u0026 Replication","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"veeam-backup-replication-cve-2024-40711","stacks":[],"startedAt":"2024-10-17","status":"closed","summary":"Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. CISA added CVE-2024-40711 to its Known Exploited Vulnerabilities catalog on Oct 17, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502"],"title":"Veeam Backup and Replication Deserialization Vulnerability (CVE-2024-40711)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2024-40711","vendor":"Veeam"},{"auto":true,"category":"breach","closedAt":"2024-10-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ALPINEREPLAY"],"json":"https://helix.ml/threat-watch/i/alpinereplay-data-breach.json","latestUpdate":{"date":"2024-10-17","title":"Have I Been Pwned loaded 898K breached AlpineReplay accounts"},"patchStatus":"no-fix-needed","product":"traceup.com","severity":"high","severityNote":"898K accounts · passwords exposed","slug":"alpinereplay-data-breach","stacks":[],"startedAt":"2024-10-17","status":"closed","summary":"In 2019, the snow sports tracking app AlpineReplay suffered a data breach that exposed 900k unique email addresses. Later rolled into the Trace service, the breach included names, usernames, genders, dates of birth, weights and passwords stored as either unsalted MD5 or bcrypt hashes. Exposed data: dates of birth, email addresses, genders, names, passwords, physical attributes, usernames. The breach dates from Aug 27, 2019; Have I Been Pwned loaded it on Oct 17, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","physical-attributes","usernames"],"title":"AlpineReplay data breach: 898K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/alpinereplay-data-breach","vendor":"AlpineReplay"},{"auto":true,"category":"patch","closedAt":"2024-10-29","cveIds":["CVE-2024-28987"],"exploited":"in-the-wild","identifiers":["CVE-2024-28987"],"json":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2024-28987.json","latestUpdate":{"date":"2024-10-15","title":"CISA added CVE-2024-28987 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 5, 2024)"},"patchStatus":"unknown","product":"Web Help Desk","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-web-help-desk-cve-2024-28987","stacks":[],"startedAt":"2024-10-15","status":"closed","summary":"SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data. CISA added CVE-2024-28987 to its Known Exploited Vulnerabilities catalog on Oct 15, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-798"],"title":"SolarWinds Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2024-28987","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2024-10-29","cveIds":["CVE-2024-9680"],"exploited":"in-the-wild","identifiers":["CVE-2024-9680"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2024-9680.json","latestUpdate":{"date":"2024-10-15","title":"CISA added CVE-2024-9680 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 5, 2024)"},"patchStatus":"patched","product":"Firefox","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-cve-2024-9680","stacks":["browser"],"startedAt":"2024-10-15","status":"closed","summary":"Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. CISA added CVE-2024-9680 to its Known Exploited Vulnerabilities catalog on Oct 15, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-416"],"title":"Mozilla Firefox Use-After-Free Vulnerability (CVE-2024-9680)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2024-9680","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2024-10-29","cveIds":["CVE-2024-30088"],"exploited":"in-the-wild","identifiers":["CVE-2024-30088"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-30088.json","latestUpdate":{"date":"2024-10-15","title":"CISA added CVE-2024-30088 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 5, 2024)"},"patchStatus":"patched","product":"Windows ","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-30088","stacks":["linux","windows"],"startedAt":"2024-10-15","status":"closed","summary":"Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. CISA added CVE-2024-30088 to its Known Exploited Vulnerabilities catalog on Oct 15, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-367"],"title":"Microsoft Windows Kernel TOCTOU Race Condition Vulnerability (CVE-2024-30088)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-30088","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-10-23","cveIds":["CVE-2024-9380"],"exploited":"in-the-wild","identifiers":["CVE-2024-9380"],"json":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-csa-cve-2024-9380.json","latestUpdate":{"date":"2024-10-09","title":"CISA added CVE-2024-9380 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 30, 2024)"},"patchStatus":"unpatched","product":"Cloud Services Appliance (CSA)","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-cloud-services-appliance-csa-cve-2024-9380","stacks":[],"startedAt":"2024-10-09","status":"closed","summary":"Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS. CISA added CVE-2024-9380 to its Known Exploited Vulnerabilities catalog on Oct 9, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability (CVE-2024-9380)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-csa-cve-2024-9380","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2024-10-23","cveIds":["CVE-2024-9379"],"exploited":"in-the-wild","identifiers":["CVE-2024-9379"],"json":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-csa-cve-2024-9379.json","latestUpdate":{"date":"2024-10-09","title":"CISA added CVE-2024-9379 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 30, 2024)"},"patchStatus":"unpatched","product":"Cloud Services Appliance (CSA)","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-cloud-services-appliance-csa-cve-2024-9379","stacks":[],"startedAt":"2024-10-09","status":"closed","summary":"Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements. CISA added CVE-2024-9379 to its Known Exploited Vulnerabilities catalog on Oct 9, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability (CVE-2024-9379)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-csa-cve-2024-9379","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2024-10-23","cveIds":["CVE-2024-23113"],"exploited":"in-the-wild","identifiers":["CVE-2024-23113"],"json":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2024-23113.json","latestUpdate":{"date":"2024-10-09","title":"CISA added CVE-2024-23113 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 30, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-multiple-products-cve-2024-23113","stacks":["network"],"startedAt":"2024-10-09","status":"closed","summary":"Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. CISA added CVE-2024-23113 to its Known Exploited Vulnerabilities catalog on Oct 9, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-134"],"title":"Fortinet Multiple Products Format String Vulnerability (CVE-2024-23113)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2024-23113","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2024-10-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INTERNETARCHIVE"],"json":"https://helix.ml/threat-watch/i/internetarchive-data-breach.json","latestUpdate":{"date":"2024-10-09","title":"Have I Been Pwned loaded 31.1M breached Internet Archive accounts"},"patchStatus":"no-fix-needed","product":"archive.org","severity":"high","severityNote":"31.1M accounts · passwords exposed","slug":"internetarchive-data-breach","stacks":[],"startedAt":"2024-10-09","status":"closed","summary":"In September 2024, the digital library of internet sites Internet Archive suffered a data breach that exposed 31M records. The breach exposed user records including email addresses, screen names and bcrypt password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Sep 28, 2024; Have I Been Pwned loaded it on Oct 9, 2024.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Internet Archive data breach: 31.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/internetarchive-data-breach","vendor":"Internet Archive"},{"auto":true,"category":"patch","closedAt":"2024-10-22","cveIds":["CVE-2024-43573"],"exploited":"in-the-wild","identifiers":["CVE-2024-43573"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43573.json","latestUpdate":{"date":"2024-10-08","title":"CISA added CVE-2024-43573 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 29, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-43573","stacks":["windows"],"startedAt":"2024-10-08","status":"closed","summary":"Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. CISA added CVE-2024-43573 to its Known Exploited Vulnerabilities catalog on Oct 8, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-79"],"title":"Microsoft Windows MSHTML Platform Spoofing Vulnerability (CVE-2024-43573)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43573","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-10-22","cveIds":["CVE-2024-43572"],"exploited":"in-the-wild","identifiers":["CVE-2024-43572"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43572.json","latestUpdate":{"date":"2024-10-08","title":"CISA added CVE-2024-43572 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 29, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-43572","stacks":["windows"],"startedAt":"2024-10-08","status":"closed","summary":"Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. CISA added CVE-2024-43572 to its Known Exploited Vulnerabilities catalog on Oct 8, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-707"],"title":"Microsoft Windows Management Console Remote Code Execution Vulnerability (CVE-2024-43572)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43572","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-10-22","cveIds":["CVE-2024-43047"],"exploited":"in-the-wild","identifiers":["CVE-2024-43047"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2024-43047.json","latestUpdate":{"date":"2024-10-08","title":"CISA added CVE-2024-43047 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 29, 2024)"},"patchStatus":"patched","product":"Multiple Chipsets ","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2024-43047","stacks":[],"startedAt":"2024-10-08","status":"closed","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory. CISA added CVE-2024-43047 to its Known Exploited Vulnerabilities catalog on Oct 8, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2024-43047)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2024-43047","vendor":"Qualcomm"},{"auto":true,"category":"breach","closedAt":"2024-10-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MUAH"],"json":"https://helix.ml/threat-watch/i/muah-data-breach.json","latestUpdate":{"date":"2024-10-08","title":"Have I Been Pwned loaded 1.9M breached Muah.AI accounts"},"patchStatus":"no-fix-needed","product":"muah.ai","severity":"high","severityNote":"1.9M accounts","slug":"muah-data-breach","stacks":[],"startedAt":"2024-10-08","status":"closed","summary":"In September 2024, the \"AI girlfriend\" website Muah.AI suffered a data breach. The breach exposed 1.9M email addresses alongside prompts to generate AI-based images. Many of the prompts were highly sexual in nature, with many also describing child exploitation scenarios. Exposed data: ai prompts, email addresses, sexual fetishes. The breach dates from Sep 17, 2024; Have I Been Pwned loaded it on Oct 8, 2024.","tags":["data-breach","hibp","ai-prompts","email-addresses","sexual-fetishes"],"title":"Muah.AI data breach: 1.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/muah-data-breach","vendor":"Muah.AI"},{"auto":true,"category":"breach","closedAt":"2024-10-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SWITCH"],"json":"https://helix.ml/threat-watch/i/switch-data-breach.json","latestUpdate":{"date":"2024-10-05","title":"Have I Been Pwned loaded 5397 breached Switch accounts"},"patchStatus":"no-fix-needed","product":"switchit.hu","severity":"low","severityNote":"5397 accounts","slug":"switch-data-breach","stacks":[],"startedAt":"2024-10-05","status":"closed","summary":"In October 2024, the Hungarian IT headhunting service Switch inadvertently exposed thousands of customer records via a public GitHub repository. The exposed data contained job applications with names, email addresses and in some cases, commentary on the applicant. Exposed data: email addresses, job applications, names, social media profiles. The breach dates from Oct 1, 2024; Have I Been Pwned loaded it on Oct 5, 2024.","tags":["data-breach","hibp","email-addresses","job-applications","names","social-media-profiles"],"title":"Switch data breach: 5397 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/switch-data-breach","vendor":"Switch"},{"auto":true,"category":"patch","closedAt":"2024-10-17","cveIds":["CVE-2024-45519"],"exploited":"in-the-wild","identifiers":["CVE-2024-45519"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2024-45519.json","latestUpdate":{"date":"2024-10-03","title":"CISA added CVE-2024-45519 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 24, 2024)"},"patchStatus":"unknown","product":"Zimbra Collaboration Suite (ZCS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2024-45519","stacks":[],"startedAt":"2024-10-03","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands. CISA added CVE-2024-45519 to its Known Exploited Vulnerabilities catalog on Oct 3, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability (CVE-2024-45519)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2024-45519","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2024-10-16","cveIds":["CVE-2024-29824"],"exploited":"in-the-wild","identifiers":["CVE-2024-29824"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-29824.json","latestUpdate":{"date":"2024-10-02","title":"CISA added CVE-2024-29824 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2024)"},"patchStatus":"unknown","product":"Endpoint Manager (EPM)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-epm-cve-2024-29824","stacks":[],"startedAt":"2024-10-02","status":"closed","summary":"Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code. CISA added CVE-2024-29824 to its Known Exploited Vulnerabilities catalog on Oct 2, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","sql-injection","cwe-89"],"title":"Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability (CVE-2024-29824)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-epm-cve-2024-29824","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2024-10-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BUDTRADER"],"json":"https://helix.ml/threat-watch/i/budtrader-data-breach.json","latestUpdate":{"date":"2024-10-01","title":"Have I Been Pwned loaded 2.7M breached BudTrader accounts"},"patchStatus":"no-fix-needed","product":"budtrader.com","severity":"high","severityNote":"2.7M accounts · passwords exposed","slug":"budtrader-data-breach","stacks":[],"startedAt":"2024-10-01","status":"closed","summary":"In July 2024, a data breach of the now defunct cannabis social platform BudTrader was posted for sale on a hacking forum. Dating back to the previous month, the breach of the website exposed 2.7M email addresses, usernames and WordPress password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Jun 27, 2024; Have I Been Pwned loaded it on Oct 1, 2024.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"BudTrader data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/budtrader-data-breach","vendor":"BudTrader"},{"auto":true,"category":"patch","closedAt":"2024-10-14","cveIds":["CVE-2019-0344"],"exploited":"in-the-wild","identifiers":["CVE-2019-0344"],"json":"https://helix.ml/threat-watch/i/sap-commerce-cloud-cve-2019-0344.json","latestUpdate":{"date":"2024-09-30","title":"CISA added CVE-2019-0344 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 21, 2024)"},"patchStatus":"unknown","product":"Commerce Cloud","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-commerce-cloud-cve-2019-0344","stacks":["rust"],"startedAt":"2024-09-30","status":"closed","summary":"SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection. CISA added CVE-2019-0344 to its Known Exploited Vulnerabilities catalog on Sep 30, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability (CVE-2019-0344)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sap-commerce-cloud-cve-2019-0344","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2024-10-14","cveIds":["CVE-2020-15415"],"exploited":"in-the-wild","identifiers":["CVE-2020-15415"],"json":"https://helix.ml/threat-watch/i/draytek-multiple-vigor-routers-cve-2020-15415.json","latestUpdate":{"date":"2024-09-30","title":"CISA added CVE-2020-15415 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 21, 2024)"},"patchStatus":"unknown","product":"Multiple Vigor Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"draytek-multiple-vigor-routers-cve-2020-15415","stacks":["network"],"startedAt":"2024-09-30","status":"closed","summary":"DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. CISA added CVE-2020-15415 to its Known Exploited Vulnerabilities catalog on Sep 30, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"DrayTek Multiple Vigor Routers OS Command Injection Vulnerability (CVE-2020-15415)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/draytek-multiple-vigor-routers-cve-2020-15415","vendor":"DrayTek"},{"auto":true,"category":"patch","closedAt":"2024-10-14","cveIds":["CVE-2023-25280"],"exploited":"in-the-wild","identifiers":["CVE-2023-25280"],"json":"https://helix.ml/threat-watch/i/d-link-dir-820-router-cve-2023-25280.json","latestUpdate":{"date":"2024-09-30","title":"CISA added CVE-2023-25280 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 21, 2024)"},"patchStatus":"unpatched","product":"DIR-820 Router","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-820-router-cve-2023-25280","stacks":["network"],"startedAt":"2024-09-30","status":"closed","summary":"D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. CISA added CVE-2023-25280 to its Known Exploited Vulnerabilities catalog on Sep 30, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","privilege-escalation","cwe-78"],"title":"D-Link DIR-820 Router OS Command Injection Vulnerability (CVE-2023-25280)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dir-820-router-cve-2023-25280","vendor":"D-Link"},{"auto":true,"category":"breach","closedAt":"2024-10-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CENTRALTICKETS"],"json":"https://helix.ml/threat-watch/i/centraltickets-data-breach.json","latestUpdate":{"date":"2024-09-30","title":"Have I Been Pwned loaded 722K breached Central Tickets accounts"},"patchStatus":"no-fix-needed","product":"centraltickets.co.uk","severity":"high","severityNote":"722K accounts · passwords exposed","slug":"centraltickets-data-breach","stacks":[],"startedAt":"2024-09-30","status":"closed","summary":"In September 2024, data from the ticketing service Central Tickets was publicly posted to a hacking forum. The data suggests the breach occurred several months earlier and exposed 723k unique email addresses alongside names, phone numbers, IP addresses, purchases and passwords stored as unsalted SHA-1 hashes. Exposed data: device information, email addresses, ip addresses, names, passwords, phone numbers, purchases. The breach dates from Jul 1, 2024; Have I Been Pwned loaded it on Sep 30, 2024.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","names","passwords","phone-numbers","purchases"],"title":"Central Tickets data breach: 722K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/centraltickets-data-breach","vendor":"Central Tickets"},{"auto":true,"category":"patch","closedAt":"2024-10-08","cveIds":["CVE-2024-7593"],"exploited":"in-the-wild","identifiers":["CVE-2024-7593"],"json":"https://helix.ml/threat-watch/i/ivanti-virtual-traffic-manager-cve-2024-7593.json","latestUpdate":{"date":"2024-09-24","title":"CISA added CVE-2024-7593 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 15, 2024)"},"patchStatus":"patched","product":"Virtual Traffic Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-virtual-traffic-manager-cve-2024-7593","stacks":[],"startedAt":"2024-09-24","status":"closed","summary":"Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. CISA added CVE-2024-7593 to its Known Exploited Vulnerabilities catalog on Sep 24, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287","cwe-303"],"title":"Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability (CVE-2024-7593)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-virtual-traffic-manager-cve-2024-7593","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2024-10-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMEVN"],"json":"https://helix.ml/threat-watch/i/gamevn-data-breach.json","latestUpdate":{"date":"2024-09-23","title":"Have I Been Pwned loaded 1.4M breached GameVN accounts"},"patchStatus":"no-fix-needed","product":"gamevn.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"gamevn-data-breach","stacks":[],"startedAt":"2024-09-23","status":"closed","summary":"In May 2016, the Vietnamese gaming forum GameVN suffered a data breach that was later redistributed as part of a larger corpus of data. Data breached from the XenForo-based forum included 1.4M unique email addresses, usernames, IP addresses and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 1, 2016; Have I Been Pwned loaded it on Sep 23, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"GameVN data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gamevn-data-breach","vendor":"GameVN"},{"auto":true,"category":"patch","closedAt":"2024-10-03","cveIds":["CVE-2024-8963"],"exploited":"in-the-wild","identifiers":["CVE-2024-8963"],"json":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-csa-cve-2024-8963.json","latestUpdate":{"date":"2024-09-19","title":"CISA added CVE-2024-8963 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 10, 2024)"},"patchStatus":"unpatched","product":"Cloud Services Appliance (CSA)","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-cloud-services-appliance-csa-cve-2024-8963","stacks":[],"startedAt":"2024-09-19","status":"closed","summary":"Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance. CISA added CVE-2024-8963 to its Known Exploited Vulnerabilities catalog on Sep 19, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability (CVE-2024-8963)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-csa-cve-2024-8963","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2024-10-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HUNTSTAND"],"json":"https://helix.ml/threat-watch/i/huntstand-data-breach.json","latestUpdate":{"date":"2024-09-19","title":"Have I Been Pwned loaded 2.8M breached HuntStand accounts"},"patchStatus":"no-fix-needed","product":"huntstand.com","severity":"medium","severityNote":"2.8M accounts","slug":"huntstand-data-breach","stacks":[],"startedAt":"2024-09-19","status":"closed","summary":"In March 2024, millions of records scraped from the hunting and land management service HuntStand were publicly posted to a popular hacking forum. The data included 2.8M unique email addresses with many records also containing name, date of birth and country. Exposed data: dates of birth, email addresses, geographic locations, names. The breach dates from Mar 8, 2024; Have I Been Pwned loaded it on Sep 19, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","names"],"title":"HuntStand data breach: 2.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/huntstand-data-breach","vendor":"HuntStand"},{"auto":true,"category":"patch","closedAt":"2024-10-02","cveIds":["CVE-2020-14644"],"exploited":"in-the-wild","identifiers":["CVE-2020-14644"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14644.json","latestUpdate":{"date":"2024-09-18","title":"CISA added CVE-2020-14644 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2024)"},"patchStatus":"unknown","product":"WebLogic Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2020-14644","stacks":["java"],"startedAt":"2024-09-18","status":"closed","summary":"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. CISA added CVE-2020-14644 to its Known Exploited Vulnerabilities catalog on Sep 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization"],"title":"Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14644)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14644","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2024-10-02","cveIds":["CVE-2022-21445"],"exploited":"in-the-wild","identifiers":["CVE-2022-21445"],"json":"https://helix.ml/threat-watch/i/oracle-adf-faces-cve-2022-21445.json","latestUpdate":{"date":"2024-09-18","title":"CISA added CVE-2022-21445 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2024)"},"patchStatus":"unknown","product":"ADF Faces","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-adf-faces-cve-2022-21445","stacks":["rust"],"startedAt":"2024-09-18","status":"closed","summary":"Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. CISA added CVE-2022-21445 to its Known Exploited Vulnerabilities catalog on Sep 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Oracle ADF Faces Deserialization of Untrusted Data Vulnerability (CVE-2022-21445)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/oracle-adf-faces-cve-2022-21445","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2024-10-02","cveIds":["CVE-2020-0618"],"exploited":"in-the-wild","identifiers":["CVE-2020-0618"],"json":"https://helix.ml/threat-watch/i/microsoft-sql-server-cve-2020-0618.json","latestUpdate":{"date":"2024-09-18","title":"CISA added CVE-2020-0618 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2024)"},"patchStatus":"patched","product":"SQL Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sql-server-cve-2020-0618","stacks":["database"],"startedAt":"2024-09-18","status":"closed","summary":"Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account. CISA added CVE-2020-0618 to its Known Exploited Vulnerabilities catalog on Sep 18, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502"],"title":"Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability (CVE-2020-0618)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-sql-server-cve-2020-0618","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-10-02","cveIds":["CVE-2024-27348"],"exploited":"in-the-wild","identifiers":["CVE-2024-27348"],"json":"https://helix.ml/threat-watch/i/apache-hugegraph-server-cve-2024-27348.json","latestUpdate":{"date":"2024-09-18","title":"CISA added CVE-2024-27348 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2024)"},"patchStatus":"unknown","product":"HugeGraph-Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-hugegraph-server-cve-2024-27348","stacks":[],"startedAt":"2024-09-18","status":"closed","summary":"Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. CISA added CVE-2024-27348 to its Known Exploited Vulnerabilities catalog on Sep 18, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-284"],"title":"Apache HugeGraph-Server Improper Access Control Vulnerability (CVE-2024-27348)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-hugegraph-server-cve-2024-27348","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2024-10-01","cveIds":["CVE-2014-0502"],"exploited":"in-the-wild","identifiers":["CVE-2014-0502"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-0502.json","latestUpdate":{"date":"2024-09-17","title":"CISA added CVE-2014-0502 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 8, 2024)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2014-0502","stacks":[],"startedAt":"2024-09-17","status":"closed","summary":"Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code. CISA added CVE-2014-0502 to its Known Exploited Vulnerabilities catalog on Sep 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-399"],"title":"Adobe Flash Player Double Free Vulnerablity (CVE-2014-0502)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-0502","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2024-10-01","cveIds":["CVE-2013-0648"],"exploited":"in-the-wild","identifiers":["CVE-2013-0648"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2013-0648.json","latestUpdate":{"date":"2024-09-17","title":"CISA added CVE-2013-0648 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 8, 2024)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2013-0648","stacks":[],"startedAt":"2024-09-17","status":"closed","summary":"Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content. CISA added CVE-2013-0648 to its Known Exploited Vulnerabilities catalog on Sep 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Adobe Flash Player Code Execution Vulnerability (CVE-2013-0648)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2013-0648","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2024-10-01","cveIds":["CVE-2013-0643"],"exploited":"in-the-wild","identifiers":["CVE-2013-0643"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2013-0643.json","latestUpdate":{"date":"2024-09-17","title":"CISA added CVE-2013-0643 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 8, 2024)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2013-0643","stacks":[],"startedAt":"2024-09-17","status":"closed","summary":"Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. CISA added CVE-2013-0643 to its Known Exploited Vulnerabilities catalog on Sep 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-264"],"title":"Adobe Flash Player Incorrect Default Permissions Vulnerability (CVE-2013-0643)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2013-0643","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2024-10-01","cveIds":["CVE-2014-0497"],"exploited":"in-the-wild","identifiers":["CVE-2014-0497"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-0497.json","latestUpdate":{"date":"2024-09-17","title":"CISA added CVE-2014-0497 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 8, 2024)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2014-0497","stacks":[],"startedAt":"2024-09-17","status":"closed","summary":"Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code. CISA added CVE-2014-0497 to its Known Exploited Vulnerabilities catalog on Sep 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-191"],"title":"Adobe Flash Player Integer Underflow Vulnerablity (CVE-2014-0497)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-0497","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2024-09-30","cveIds":["CVE-2024-6670"],"exploited":"in-the-wild","identifiers":["CVE-2024-6670"],"json":"https://helix.ml/threat-watch/i/progress-whatsup-gold-cve-2024-6670.json","latestUpdate":{"date":"2024-09-16","title":"CISA added CVE-2024-6670 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 7, 2024)"},"patchStatus":"unknown","product":"WhatsUp Gold","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-whatsup-gold-cve-2024-6670","stacks":[],"startedAt":"2024-09-16","status":"closed","summary":"Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. CISA added CVE-2024-6670 to its Known Exploited Vulnerabilities catalog on Sep 16, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"Progress WhatsUp Gold SQL Injection Vulnerability (CVE-2024-6670)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/progress-whatsup-gold-cve-2024-6670","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2024-09-30","cveIds":["CVE-2024-43461"],"exploited":"in-the-wild","identifiers":["CVE-2024-43461"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43461.json","latestUpdate":{"date":"2024-09-16","title":"CISA added CVE-2024-43461 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 7, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-43461","stacks":["windows"],"startedAt":"2024-09-16","status":"closed","summary":"Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112. CISA added CVE-2024-43461 to its Known Exploited Vulnerabilities catalog on Sep 16, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-451"],"title":"Microsoft Windows MSHTML Platform Spoofing Vulnerability (CVE-2024-43461)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-43461","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-09-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INSTITUTONACIONALDEDEPORTESDECHILE"],"json":"https://helix.ml/threat-watch/i/institutonacionaldedeportesdechile-data-breach.json","latestUpdate":{"date":"2024-09-16","title":"Have I Been Pwned loaded 319K breached Instituto Nacional de Deportes de Chile accounts"},"patchStatus":"no-fix-needed","product":"ind.cl","severity":"high","severityNote":"319K accounts · passwords exposed","slug":"institutonacionaldedeportesdechile-data-breach","stacks":[],"startedAt":"2024-09-16","status":"closed","summary":"In September 2024, the Instituto Nacional de Deportes de Chile (Chile's National Sports Institute) suffered a data breach. The incident exposed 1.7M rows of data with 320k unique email addresses alongside names, dates of birth, genders and bcrypt password hashes. The newest records in the data date back to August 2022, suggesting the breach may be of an older data set. Exposed data: dates of birth, email addresses, genders, names, passwords, usernames. The breach dates from Sep 12, 2024; Have I Been Pwned loaded it on Sep 16, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","usernames"],"title":"Instituto Nacional de Deportes de Chile data breach: 319K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/institutonacionaldedeportesdechile-data-breach","vendor":"Instituto Nacional de Deportes de Chile"},{"auto":true,"category":"breach","closedAt":"2024-09-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMESBOX"],"json":"https://helix.ml/threat-watch/i/gamesbox-data-breach.json","latestUpdate":{"date":"2024-09-15","title":"Have I Been Pwned loaded 1.4M breached Games Box accounts"},"patchStatus":"no-fix-needed","product":"gamesbox.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"gamesbox-data-breach","stacks":[],"startedAt":"2024-09-15","status":"closed","summary":"In September 2020, now defunct website Games Box suffered a data breach that was later redistributed as part of a larger corpus of data. The impacted data included 1.4M email addresses alongside usernames, genders, ages and passwords stored as either a hash or plain text. Exposed data: ages, email addresses, genders, passwords, usernames. The breach dates from Sep 21, 2020; Have I Been Pwned loaded it on Sep 15, 2024.","tags":["data-breach","hibp","ages","email-addresses","genders","passwords","usernames"],"title":"Games Box data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gamesbox-data-breach","vendor":"Games Box"},{"auto":true,"category":"patch","closedAt":"2024-09-27","cveIds":["CVE-2024-8190"],"exploited":"in-the-wild","identifiers":["CVE-2024-8190"],"json":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-cve-2024-8190.json","latestUpdate":{"date":"2024-09-13","title":"CISA added CVE-2024-8190 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 4, 2024)"},"patchStatus":"unpatched","product":"Cloud Services Appliance","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-cloud-services-appliance-cve-2024-8190","stacks":[],"startedAt":"2024-09-13","status":"closed","summary":"Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS. CISA added CVE-2024-8190 to its Known Exploited Vulnerabilities catalog on Sep 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Ivanti Cloud Services Appliance OS Command Injection Vulnerability (CVE-2024-8190)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-cloud-services-appliance-cve-2024-8190","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2024-09-24","cveIds":["CVE-2024-38217"],"exploited":"in-the-wild","identifiers":["CVE-2024-38217"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38217.json","latestUpdate":{"date":"2024-09-10","title":"CISA added CVE-2024-38217 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 1, 2024)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38217","stacks":["windows"],"startedAt":"2024-09-10","status":"closed","summary":"Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. CISA added CVE-2024-38217 to its Known Exploited Vulnerabilities catalog on Sep 10, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability (CVE-2024-38217)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38217","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-09-24","cveIds":["CVE-2024-38014"],"exploited":"in-the-wild","identifiers":["CVE-2024-38014"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38014.json","latestUpdate":{"date":"2024-09-10","title":"CISA added CVE-2024-38014 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 1, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38014","stacks":["windows"],"startedAt":"2024-09-10","status":"closed","summary":"Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges. CISA added CVE-2024-38014 to its Known Exploited Vulnerabilities catalog on Sep 10, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-269"],"title":"Microsoft Windows Installer Improper Privilege Management Vulnerability (CVE-2024-38014)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38014","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-09-24","cveIds":["CVE-2024-38226"],"exploited":"in-the-wild","identifiers":["CVE-2024-38226"],"json":"https://helix.ml/threat-watch/i/microsoft-publisher-cve-2024-38226.json","latestUpdate":{"date":"2024-09-10","title":"CISA added CVE-2024-38226 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 1, 2024)"},"patchStatus":"patched","product":"Publisher","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-publisher-cve-2024-38226","stacks":[],"startedAt":"2024-09-10","status":"closed","summary":"Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files. CISA added CVE-2024-38226 to its Known Exploited Vulnerabilities catalog on Sep 10, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"Microsoft Publisher Protection Mechanism Failure Vulnerability (CVE-2024-38226)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-publisher-cve-2024-38226","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-09-23","cveIds":["CVE-2024-40766"],"exploited":"in-the-wild","identifiers":["CVE-2024-40766"],"json":"https://helix.ml/threat-watch/i/sonicwall-sonicos-cve-2024-40766.json","latestUpdate":{"date":"2024-09-09","title":"CISA added CVE-2024-40766 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 30, 2024)"},"patchStatus":"unknown","product":"SonicOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sonicos-cve-2024-40766","stacks":["vpn"],"startedAt":"2024-09-09","status":"closed","summary":"SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash. CISA added CVE-2024-40766 to its Known Exploited Vulnerabilities catalog on Sep 9, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-284"],"title":"SonicWall SonicOS Improper Access Control Vulnerability (CVE-2024-40766)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sonicwall-sonicos-cve-2024-40766","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2024-09-23","cveIds":["CVE-2017-1000253"],"exploited":"in-the-wild","identifiers":["CVE-2017-1000253"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2017-1000253.json","latestUpdate":{"date":"2024-09-09","title":"CISA added CVE-2017-1000253 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 30, 2024)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2017-1000253","stacks":["linux"],"startedAt":"2024-09-09","status":"closed","summary":"Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. CISA added CVE-2017-1000253 to its Known Exploited Vulnerabilities catalog on Sep 9, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-119"],"title":"Linux Kernel PIE Stack Buffer Corruption Vulnerability (CVE-2017-1000253)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2017-1000253","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2024-09-23","cveIds":["CVE-2016-3714"],"exploited":"in-the-wild","identifiers":["CVE-2016-3714"],"json":"https://helix.ml/threat-watch/i/imagemagick-imagemagick-cve-2016-3714.json","latestUpdate":{"date":"2024-09-09","title":"CISA added CVE-2016-3714 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 30, 2024)"},"patchStatus":"patched","product":"ImageMagick","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"imagemagick-imagemagick-cve-2016-3714","stacks":[],"startedAt":"2024-09-09","status":"closed","summary":"ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image. CISA added CVE-2016-3714 to its Known Exploited Vulnerabilities catalog on Sep 9, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"ImageMagick Improper Input Validation Vulnerability (CVE-2016-3714)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/imagemagick-imagemagick-cve-2016-3714","vendor":"ImageMagick"},{"auto":true,"category":"patch","closedAt":"2024-09-17","cveIds":["CVE-2024-7262"],"exploited":"in-the-wild","identifiers":["CVE-2024-7262"],"json":"https://helix.ml/threat-watch/i/kingsoft-wps-office-cve-2024-7262.json","latestUpdate":{"date":"2024-09-03","title":"CISA added CVE-2024-7262 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 24, 2024)"},"patchStatus":"unknown","product":"WPS Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"kingsoft-wps-office-cve-2024-7262","stacks":[],"startedAt":"2024-09-03","status":"closed","summary":"Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library. CISA added CVE-2024-7262 to its Known Exploited Vulnerabilities catalog on Sep 3, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Kingsoft WPS Office Path Traversal Vulnerability (CVE-2024-7262)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/kingsoft-wps-office-cve-2024-7262","vendor":"Kingsoft"},{"auto":true,"category":"patch","closedAt":"2024-09-17","cveIds":["CVE-2021-20124"],"exploited":"in-the-wild","identifiers":["CVE-2021-20124"],"json":"https://helix.ml/threat-watch/i/draytek-vigorconnect-cve-2021-20124.json","latestUpdate":{"date":"2024-09-03","title":"CISA added CVE-2021-20124 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 24, 2024)"},"patchStatus":"unknown","product":"VigorConnect","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"draytek-vigorconnect-cve-2021-20124","stacks":["network"],"startedAt":"2024-09-03","status":"closed","summary":"Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CISA added CVE-2021-20124 to its Known Exploited Vulnerabilities catalog on Sep 3, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Draytek VigorConnect Path Traversal Vulnerability (CVE-2021-20124)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/draytek-vigorconnect-cve-2021-20124","vendor":"DrayTek"},{"auto":true,"category":"patch","closedAt":"2024-09-17","cveIds":["CVE-2021-20123"],"exploited":"in-the-wild","identifiers":["CVE-2021-20123"],"json":"https://helix.ml/threat-watch/i/draytek-vigorconnect-cve-2021-20123.json","latestUpdate":{"date":"2024-09-03","title":"CISA added CVE-2021-20123 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 24, 2024)"},"patchStatus":"unknown","product":"VigorConnect","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"draytek-vigorconnect-cve-2021-20123","stacks":["network"],"startedAt":"2024-09-03","status":"closed","summary":"Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CISA added CVE-2021-20123 to its Known Exploited Vulnerabilities catalog on Sep 3, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Draytek VigorConnect Path Traversal Vulnerability (CVE-2021-20123)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/draytek-vigorconnect-cve-2021-20123","vendor":"DrayTek"},{"auto":true,"category":"breach","closedAt":"2024-09-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BLOOMSTODAY"],"json":"https://helix.ml/threat-watch/i/bloomstoday-data-breach.json","latestUpdate":{"date":"2024-09-03","title":"Have I Been Pwned loaded 3.2M breached Blooms Today accounts"},"patchStatus":"no-fix-needed","product":"bloomstoday.com","severity":"high","severityNote":"3.2M accounts · financial data exposed","slug":"bloomstoday-data-breach","stacks":[],"startedAt":"2024-09-03","status":"closed","summary":"In April 2024, 15M records from the online florist Blooms Today were listed for sale on a popular hacking forum. The most recent data in the breach corpus was from November 2023 and appeared alongside 3.2M unique email addresses, names, phone numbers physical addresses and partial credit card data (card type, 4 digits of the number and expiry date). The breach did not expose sufficient card data to make purchases. Blooms Today did not respond when contacted about the incident. Exposed data: email addresses, names, partial credit card data, phone numbers, physical addresses. The breach dates from Nov 11, 2023; Have I Been Pwned loaded it on Sep 3, 2024.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses"],"title":"Blooms Today data breach: 3.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bloomstoday-data-breach","vendor":"Blooms Today"},{"auto":true,"category":"breach","closedAt":"2024-09-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MARKETMOVEIS"],"json":"https://helix.ml/threat-watch/i/marketmoveis-data-breach.json","latestUpdate":{"date":"2024-09-01","title":"Have I Been Pwned loaded 28K breached Market Moveis accounts"},"patchStatus":"no-fix-needed","product":"marketmoveis.pt","severity":"medium","severityNote":"28K accounts","slug":"marketmoveis-data-breach","stacks":[],"startedAt":"2024-09-01","status":"closed","summary":"In August 2023, the Portuguese home decor company Market Moveis suffered a data breach that impacted 28k records. The exposed records were limited to names and email addresses. Exposed data: email addresses, names. The breach dates from Aug 30, 2023; Have I Been Pwned loaded it on Sep 1, 2024.","tags":["data-breach","hibp","email-addresses","names"],"title":"Market Moveis data breach: 28K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/marketmoveis-data-breach","vendor":"Market Moveis"},{"auto":true,"category":"breach","closedAt":"2024-09-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LOOKIERO"],"json":"https://helix.ml/threat-watch/i/lookiero-data-breach.json","latestUpdate":{"date":"2024-08-30","title":"Have I Been Pwned loaded 5.0M breached Lookiero accounts"},"patchStatus":"no-fix-needed","product":"lookiero.com","severity":"medium","severityNote":"5.0M accounts","slug":"lookiero-data-breach","stacks":[],"startedAt":"2024-08-30","status":"closed","summary":"In August 2024, a data breach from the online styling service Lookiero was posted to a popular hacking forum. Dating back to March 2024, the data included 5M unique email addresses, with many of the records also including name, phone number and physical address. When contacted about the incident, Lookiero advised that they would \"look into it and get back to you if necessary\". Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Mar 27, 2024; Have I Been Pwned loaded it on Aug 30, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Lookiero data breach: 5.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/lookiero-data-breach","vendor":"Lookiero"},{"auto":true,"category":"patch","closedAt":"2024-09-11","cveIds":["CVE-2024-7965"],"exploited":"in-the-wild","identifiers":["CVE-2024-7965"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-7965.json","latestUpdate":{"date":"2024-08-28","title":"CISA added CVE-2024-7965 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 18, 2024)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2024-7965","stacks":["browser"],"startedAt":"2024-08-28","status":"closed","summary":"Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2024-7965 to its Known Exploited Vulnerabilities catalog on Aug 28, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-358"],"title":"Google Chromium V8 Inappropriate Implementation Vulnerability (CVE-2024-7965)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-7965","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2024-09-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPORT2000"],"json":"https://helix.ml/threat-watch/i/sport2000-data-breach.json","latestUpdate":{"date":"2024-08-28","title":"Have I Been Pwned loaded 3.2M breached Sport 2000 accounts"},"patchStatus":"no-fix-needed","product":"sport2000.fr","severity":"medium","severityNote":"3.2M accounts","slug":"sport2000-data-breach","stacks":[],"startedAt":"2024-08-28","status":"closed","summary":"In April 2024, the French sporting equipment manufacturer Sport 2000 announced it had suffered a data breach. The data was subsequently put up for sale on a popular hacking forum and included 4.4M rows with 3.2M unique email addresses alongside names, physical addresses, phone numbers, dates of birth and purchases made by store name. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses, purchases, salutations. The breach dates from Apr 18, 2024; Have I Been Pwned loaded it on Aug 28, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses","purchases","salutations"],"title":"Sport 2000 data breach: 3.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/sport2000-data-breach","vendor":"Sport 2000"},{"auto":true,"category":"patch","closedAt":"2024-09-10","cveIds":["CVE-2024-38856"],"exploited":"in-the-wild","identifiers":["CVE-2024-38856"],"json":"https://helix.ml/threat-watch/i/apache-ofbiz-cve-2024-38856.json","latestUpdate":{"date":"2024-08-27","title":"CISA added CVE-2024-38856 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 17, 2024)"},"patchStatus":"patched","product":"OFBiz","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-ofbiz-cve-2024-38856","stacks":[],"startedAt":"2024-08-27","status":"closed","summary":"Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. CISA added CVE-2024-38856 to its Known Exploited Vulnerabilities catalog on Aug 27, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-863"],"title":"Apache OFBiz Incorrect Authorization Vulnerability (CVE-2024-38856)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-ofbiz-cve-2024-38856","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2024-09-09","cveIds":["CVE-2024-7971"],"exploited":"in-the-wild","identifiers":["CVE-2024-7971"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-7971.json","latestUpdate":{"date":"2024-08-26","title":"CISA added CVE-2024-7971 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 16, 2024)"},"patchStatus":"patched","product":"Chromium V8","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2024-7971","stacks":["browser"],"startedAt":"2024-08-26","status":"closed","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2024-7971 to its Known Exploited Vulnerabilities catalog on Aug 26, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2024-7971)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-7971","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2024-09-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRADERIE"],"json":"https://helix.ml/threat-watch/i/traderie-data-breach.json","latestUpdate":{"date":"2024-08-25","title":"Have I Been Pwned loaded 364K breached Traderie accounts"},"patchStatus":"no-fix-needed","product":"traderie.com","severity":"medium","severityNote":"364K accounts","slug":"traderie-data-breach","stacks":[],"startedAt":"2024-08-25","status":"closed","summary":"In September 2022, the in-game trading marketplace Traderie suffered a data breach that exposed almost 400k records (this preceded a subsequent breach the following year). The incident exposed email and IP addresses, usernames and links to social media profiles. Exposed data: email addresses, ip addresses, social media profiles, usernames. The breach dates from Sep 24, 2022; Have I Been Pwned loaded it on Aug 25, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","social-media-profiles","usernames"],"title":"Traderie data breach: 364K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/traderie-data-breach","vendor":"Traderie"},{"auto":true,"category":"patch","closedAt":"2024-09-06","cveIds":["CVE-2024-39717"],"exploited":"in-the-wild","identifiers":["CVE-2024-39717"],"json":"https://helix.ml/threat-watch/i/versa-director-cve-2024-39717.json","latestUpdate":{"date":"2024-08-23","title":"CISA added CVE-2024-39717 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 13, 2024)"},"patchStatus":"unknown","product":"Director","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"versa-director-cve-2024-39717","stacks":[],"startedAt":"2024-08-23","status":"closed","summary":"The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image. CISA added CVE-2024-39717 to its Known Exploited Vulnerabilities catalog on Aug 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"Versa Director Dangerous File Type Upload Vulnerability (CVE-2024-39717)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/versa-director-cve-2024-39717","vendor":"Versa"},{"auto":true,"category":"patch","closedAt":"2024-09-04","cveIds":["CVE-2021-31196"],"exploited":"in-the-wild","identifiers":["CVE-2021-31196"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-31196.json","latestUpdate":{"date":"2024-08-21","title":"CISA added CVE-2021-31196 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2024)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-31196","stacks":["windows"],"startedAt":"2024-08-21","status":"closed","summary":"Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution. CISA added CVE-2021-31196 to its Known Exploited Vulnerabilities catalog on Aug 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Exchange Server Information Disclosure Vulnerability (CVE-2021-31196)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-31196","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-09-04","cveIds":["CVE-2022-0185"],"exploited":"in-the-wild","identifiers":["CVE-2022-0185"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0185.json","latestUpdate":{"date":"2024-08-21","title":"CISA added CVE-2022-0185 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2024)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2022-0185","stacks":["linux"],"startedAt":"2024-08-21","status":"closed","summary":"Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. CISA added CVE-2022-0185 to its Known Exploited Vulnerabilities catalog on Aug 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-190"],"title":"Linux Kernel Heap-Based Buffer Overflow Vulnerability (CVE-2022-0185)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0185","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2024-09-04","cveIds":["CVE-2021-33045"],"exploited":"in-the-wild","identifiers":["CVE-2021-33045"],"json":"https://helix.ml/threat-watch/i/dahua-ip-camera-firmware-cve-2021-33045.json","latestUpdate":{"date":"2024-08-21","title":"CISA added CVE-2021-33045 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2024)"},"patchStatus":"unknown","product":"IP Camera Firmware","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"dahua-ip-camera-firmware-cve-2021-33045","stacks":[],"startedAt":"2024-08-21","status":"closed","summary":"Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication. CISA added CVE-2021-33045 to its Known Exploited Vulnerabilities catalog on Aug 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Dahua IP Camera Authentication Bypass Vulnerability (CVE-2021-33045)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/dahua-ip-camera-firmware-cve-2021-33045","vendor":"Dahua"},{"auto":true,"category":"patch","closedAt":"2024-09-04","cveIds":["CVE-2021-33044"],"exploited":"in-the-wild","identifiers":["CVE-2021-33044"],"json":"https://helix.ml/threat-watch/i/dahua-ip-camera-firmware-cve-2021-33044.json","latestUpdate":{"date":"2024-08-21","title":"CISA added CVE-2021-33044 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2024)"},"patchStatus":"unknown","product":"IP Camera Firmware","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"dahua-ip-camera-firmware-cve-2021-33044","stacks":[],"startedAt":"2024-08-21","status":"closed","summary":"Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication. CISA added CVE-2021-33044 to its Known Exploited Vulnerabilities catalog on Aug 21, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Dahua IP Camera Authentication Bypass Vulnerability (CVE-2021-33044)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/dahua-ip-camera-firmware-cve-2021-33044","vendor":"Dahua"},{"auto":true,"category":"patch","closedAt":"2024-09-02","cveIds":["CVE-2024-23897"],"exploited":"in-the-wild","identifiers":["CVE-2024-23897"],"json":"https://helix.ml/threat-watch/i/jenkins-jenkins-command-line-interface-cli-cve-2024-23897.json","latestUpdate":{"date":"2024-08-19","title":"CISA added CVE-2024-23897 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 9, 2024)"},"patchStatus":"unknown","product":"Jenkins Command Line Interface (CLI)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jenkins-jenkins-command-line-interface-cli-cve-2024-23897","stacks":["devtools"],"startedAt":"2024-08-19","status":"closed","summary":"Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. CISA added CVE-2024-23897 to its Known Exploited Vulnerabilities catalog on Aug 19, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-27"],"title":"Jenkins Command Line Interface (CLI) Path Traversal Vulnerability (CVE-2024-23897)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/jenkins-jenkins-command-line-interface-cli-cve-2024-23897","vendor":"Jenkins"},{"auto":true,"category":"breach","closedAt":"2024-09-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EXPLORETALENTAUG2024"],"json":"https://helix.ml/threat-watch/i/exploretalentaug2024-data-breach.json","latestUpdate":{"date":"2024-08-19","title":"Have I Been Pwned loaded 8.9M breached Explore Talent (August 2024) accounts"},"patchStatus":"no-fix-needed","product":"exploretalent.com","severity":"medium","severityNote":"8.9M accounts","slug":"exploretalentaug2024-data-breach","stacks":[],"startedAt":"2024-08-19","status":"closed","summary":"In August 2024, a slew of security vulnerabilities were identified with a conglomerate of online services which included the talent network Explore Talent. A vulnerable API exposed the personal records of 11.4M users of the service of which 8.9M unique email addresses were provided to HIBP. This incident is separate to the Explore Talent breach which occurred in 2022 and was loaded into HIBP in July 2024. Exposed data: email addresses. The breach dates from Aug 15, 2024; Have I Been Pwned loaded it on Aug 19, 2024.","tags":["data-breach","hibp","email-addresses"],"title":"Explore Talent (August 2024) data breach: 8.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/exploretalentaug2024-data-breach","vendor":"Explore Talent (August 2024)"},{"auto":true,"category":"breach","closedAt":"2024-09-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRACKI"],"json":"https://helix.ml/threat-watch/i/tracki-data-breach.json","latestUpdate":{"date":"2024-08-19","title":"Have I Been Pwned loaded 372K breached Tracki accounts"},"patchStatus":"no-fix-needed","product":"tracki.com","severity":"medium","severityNote":"372K accounts","slug":"tracki-data-breach","stacks":[],"startedAt":"2024-08-19","status":"closed","summary":"In August 2024, a slew of security vulnerabilities were identified with a conglomerate of online services which included the GPS tracking service Tracki. Multiple vulnerabilities exposed the personal records of 372k users of the service including names and email addresses. Exposed data: email addresses, names. The breach dates from Aug 15, 2024; Have I Been Pwned loaded it on Aug 19, 2024.","tags":["data-breach","hibp","email-addresses","names"],"title":"Tracki data breach: 372K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tracki-data-breach","vendor":"Tracki"},{"auto":true,"category":"patch","closedAt":"2024-08-29","cveIds":["CVE-2024-28986"],"exploited":"in-the-wild","identifiers":["CVE-2024-28986"],"json":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2024-28986.json","latestUpdate":{"date":"2024-08-15","title":"CISA added CVE-2024-28986 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 5, 2024)"},"patchStatus":"unknown","product":"Web Help Desk","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-web-help-desk-cve-2024-28986","stacks":["rust"],"startedAt":"2024-08-15","status":"closed","summary":"SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. CISA added CVE-2024-28986 to its Known Exploited Vulnerabilities catalog on Aug 15, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (CVE-2024-28986)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/solarwinds-web-help-desk-cve-2024-28986","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2024-08-27","cveIds":["CVE-2024-38107"],"exploited":"in-the-wild","identifiers":["CVE-2024-38107"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38107.json","latestUpdate":{"date":"2024-08-13","title":"CISA added CVE-2024-38107 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 3, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38107","stacks":["windows"],"startedAt":"2024-08-13","status":"closed","summary":"Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CISA added CVE-2024-38107 to its Known Exploited Vulnerabilities catalog on Aug 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability (CVE-2024-38107)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38107","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-08-27","cveIds":["CVE-2024-38106"],"exploited":"in-the-wild","identifiers":["CVE-2024-38106"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38106.json","latestUpdate":{"date":"2024-08-13","title":"CISA added CVE-2024-38106 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 3, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38106","stacks":["linux","windows"],"startedAt":"2024-08-13","status":"closed","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CISA added CVE-2024-38106 to its Known Exploited Vulnerabilities catalog on Aug 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-591"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2024-38106)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38106","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-08-27","cveIds":["CVE-2024-38193"],"exploited":"in-the-wild","identifiers":["CVE-2024-38193"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38193.json","latestUpdate":{"date":"2024-08-13","title":"CISA added CVE-2024-38193 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 3, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38193","stacks":["windows"],"startedAt":"2024-08-13","status":"closed","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CISA added CVE-2024-38193 to its Known Exploited Vulnerabilities catalog on Aug 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability (CVE-2024-38193)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38193","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-08-27","cveIds":["CVE-2024-38213"],"exploited":"in-the-wild","identifiers":["CVE-2024-38213"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38213.json","latestUpdate":{"date":"2024-08-13","title":"CISA added CVE-2024-38213 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 3, 2024)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38213","stacks":["windows"],"startedAt":"2024-08-13","status":"closed","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. CISA added CVE-2024-38213 to its Known Exploited Vulnerabilities catalog on Aug 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2024-38213)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38213","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-08-27","cveIds":["CVE-2024-38178"],"exploited":"in-the-wild","identifiers":["CVE-2024-38178"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38178.json","latestUpdate":{"date":"2024-08-13","title":"CISA added CVE-2024-38178 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 3, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38178","stacks":["windows"],"startedAt":"2024-08-13","status":"closed","summary":"Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CISA added CVE-2024-38178 to its Known Exploited Vulnerabilities catalog on Aug 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-843"],"title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability (CVE-2024-38178)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38178","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-08-27","cveIds":["CVE-2024-38189"],"exploited":"in-the-wild","identifiers":["CVE-2024-38189"],"json":"https://helix.ml/threat-watch/i/microsoft-project-cve-2024-38189.json","latestUpdate":{"date":"2024-08-13","title":"CISA added CVE-2024-38189 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 3, 2024)"},"patchStatus":"patched","product":"Project","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-project-cve-2024-38189","stacks":[],"startedAt":"2024-08-13","status":"closed","summary":"Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CISA added CVE-2024-38189 to its Known Exploited Vulnerabilities catalog on Aug 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Project Remote Code Execution Vulnerability (CVE-2024-38189)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-project-cve-2024-38189","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-08-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LDLC"],"json":"https://helix.ml/threat-watch/i/ldlc-data-breach.json","latestUpdate":{"date":"2024-08-13","title":"Have I Been Pwned loaded 1.3M breached LDLC accounts"},"patchStatus":"no-fix-needed","product":"ldlc.com","severity":"medium","severityNote":"1.3M accounts","slug":"ldlc-data-breach","stacks":[],"startedAt":"2024-08-13","status":"closed","summary":"In March 2024, French retailer LDLC disclosed a data breach that impacted customers of their physical stores. The data was previously listed for sale on a popular hacking forum and contained 1.26M unique email addresses along with names, phone numbers and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses, salutations. The breach dates from Feb 28, 2024; Have I Been Pwned loaded it on Aug 13, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","salutations"],"title":"LDLC data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ldlc-data-breach","vendor":"LDLC"},{"auto":true,"category":"breach","closedAt":"2024-08-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHRISLEONG"],"json":"https://helix.ml/threat-watch/i/chrisleong-data-breach.json","latestUpdate":{"date":"2024-08-13","title":"Have I Been Pwned loaded 27K breached Chris Leong accounts"},"patchStatus":"no-fix-needed","product":"chrisleong.com","severity":"medium","severityNote":"27K accounts","slug":"chrisleong-data-breach","stacks":[],"startedAt":"2024-08-13","status":"closed","summary":"In August 2024, the website of Master Chris Leong \"a leading Tit Tar practitioner in Malaysia\" suffered a data breach. The incident exposed 27k unique email addresses along with names, physical addresses, dates of birth, genders, nationalities and in many cases, links to Facebook profiles. The company did not respond when contacted about the breach. Exposed data: dates of birth, email addresses, genders, names, nationalities, phone numbers, physical addresses, purchases, social media profiles. The breach dates from Aug 10, 2024; Have I Been Pwned loaded it on Aug 13, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","nationalities","phone-numbers","physical-addresses","purchases","social-media-profiles"],"title":"Chris Leong data breach: 27K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/chrisleong-data-breach","vendor":"Chris Leong"},{"auto":true,"category":"breach","closedAt":"2024-08-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHADOW"],"json":"https://helix.ml/threat-watch/i/shadow-data-breach.json","latestUpdate":{"date":"2024-08-11","title":"Have I Been Pwned loaded 543K breached Shadow accounts"},"patchStatus":"no-fix-needed","product":"shadow.tech","severity":"medium","severityNote":"543K accounts","slug":"shadow-data-breach","stacks":[],"startedAt":"2024-08-11","status":"closed","summary":"In September 2023, the cloud gaming provider Shadow suffered a data breach that exposed over half a million customer records. The data included email and physical addresses, names and dates of birth. Exposed data: dates of birth, email addresses, names, physical addresses. The breach dates from Sep 28, 2023; Have I Been Pwned loaded it on Aug 11, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","physical-addresses"],"title":"Shadow data breach: 543K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/shadow-data-breach","vendor":"Shadow"},{"auto":true,"category":"breach","closedAt":"2024-08-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NOTSOCRADAR"],"json":"https://helix.ml/threat-watch/i/notsocradar-data-breach.json","latestUpdate":{"date":"2024-08-09","title":"Have I Been Pwned loaded 282.5M breached Not SOCRadar accounts"},"patchStatus":"no-fix-needed","product":"Not SOCRadar","severity":"high","severityNote":"282.5M accounts","slug":"notsocradar-data-breach","stacks":[],"startedAt":"2024-08-09","status":"closed","summary":"In August 2024, over 332M rows of email addresses were posted to a popular hacking forum. The post alleged the addresses were scraped from cybersecurity firm SOCRadar, however an investigation on their behalf concluded that \"the actor merely utilised functionalities inherent in the platform's standard offerings, designed to gather information from publicly available sources\". There is no suggestion the incident compromised SOCRadar's security or posed any risk to their customers. In total, the data set contained 282M unique addresses of valid email address format. Exposed data: email addresses. The breach dates from Aug 3, 2024; Have I Been Pwned loaded it on Aug 9, 2024.","tags":["data-breach","hibp","email-addresses"],"title":"Not SOCRadar data breach: 282.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/notsocradar-data-breach","vendor":"Not SOCRadar"},{"auto":true,"category":"patch","closedAt":"2024-08-21","cveIds":["CVE-2024-32113"],"exploited":"in-the-wild","identifiers":["CVE-2024-32113"],"json":"https://helix.ml/threat-watch/i/apache-ofbiz-cve-2024-32113.json","latestUpdate":{"date":"2024-08-07","title":"CISA added CVE-2024-32113 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 28, 2024)"},"patchStatus":"patched","product":"OFBiz","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-ofbiz-cve-2024-32113","stacks":[],"startedAt":"2024-08-07","status":"closed","summary":"Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. CISA added CVE-2024-32113 to its Known Exploited Vulnerabilities catalog on Aug 7, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"Apache OFBiz Path Traversal Vulnerability (CVE-2024-32113)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-ofbiz-cve-2024-32113","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2024-08-21","cveIds":["CVE-2024-36971"],"exploited":"in-the-wild","identifiers":["CVE-2024-36971"],"json":"https://helix.ml/threat-watch/i/android-kernel-cve-2024-36971.json","latestUpdate":{"date":"2024-08-07","title":"CISA added CVE-2024-36971 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 28, 2024)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-kernel-cve-2024-36971","stacks":["android","linux"],"startedAt":"2024-08-07","status":"closed","summary":"Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. CISA added CVE-2024-36971 to its Known Exploited Vulnerabilities catalog on Aug 7, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-416"],"title":"Android Kernel Remote Code Execution Vulnerability (CVE-2024-36971)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-kernel-cve-2024-36971","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2024-08-19","cveIds":["CVE-2018-0824"],"exploited":"in-the-wild","identifiers":["CVE-2018-0824"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-0824.json","latestUpdate":{"date":"2024-08-05","title":"CISA added CVE-2018-0824 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 26, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2018-0824","stacks":["rust","windows"],"startedAt":"2024-08-05","status":"closed","summary":"Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script. CISA added CVE-2018-0824 to its Known Exploited Vulnerabilities catalog on Aug 5, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","privilege-escalation","deserialization","cwe-502"],"title":"Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability (CVE-2018-0824)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-0824","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-08-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHOEZONE"],"json":"https://helix.ml/threat-watch/i/shoezone-data-breach.json","latestUpdate":{"date":"2024-08-05","title":"Have I Been Pwned loaded 46K breached Shoe Zone accounts"},"patchStatus":"no-fix-needed","product":"shoezone.com","severity":"high","severityNote":"46K accounts · financial data exposed","slug":"shoezone-data-breach","stacks":[],"startedAt":"2024-08-05","status":"closed","summary":"In June 2024, the UK footwear chain Shoe Zone disclosed a data breach that was subsequently posted for sale on a popular hacking forum. The data included over 100k orders containing names, addresses, partial credit card numbers (card type and last 4 digits), and 46k unique email addresses. Exposed data: email addresses, names, partial credit card data, physical addresses, purchases. The breach dates from Jun 28, 2024; Have I Been Pwned loaded it on Aug 5, 2024.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","physical-addresses","purchases"],"title":"Shoe Zone data breach: 46K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/shoezone-data-breach","vendor":"Shoe Zone"},{"auto":true,"category":"breach","closedAt":"2024-08-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LULU"],"json":"https://helix.ml/threat-watch/i/lulu-data-breach.json","latestUpdate":{"date":"2024-08-02","title":"Have I Been Pwned loaded 2.8M breached LuLu accounts"},"patchStatus":"no-fix-needed","product":"luluhypermarket.com","severity":"high","severityNote":"2.8M accounts · passwords exposed","slug":"lulu-data-breach","stacks":[],"startedAt":"2024-08-02","status":"closed","summary":"In July 2024, the Emirati-based LuLu retail store suffered a data breach. The impacted data included 190k email addresses and associated phone numbers which were subsequently shared on a popular hacking forum. The following month, the threat of leaking the full database was carried out and a backup from October 2022 with a further 2.6M unique email addresses appeared. This data also included names, physical addresses, orders and PBKDF2 password hashes. Exposed data: email addresses, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Jul 6, 2024; Have I Been Pwned loaded it on Aug 2, 2024.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses","purchases"],"title":"LuLu data breach: 2.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/lulu-data-breach","vendor":"LuLu"},{"auto":true,"category":"breach","closedAt":"2024-08-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TELEGRAMSTEALERLOGS"],"json":"https://helix.ml/threat-watch/i/telegramstealerlogs-data-breach.json","latestUpdate":{"date":"2024-08-01","title":"Have I Been Pwned loaded 26.1M breached Stealer Logs Posted to Telegram accounts"},"patchStatus":"no-fix-needed","product":"Stealer Logs Posted to Telegram","severity":"high","severityNote":"26.1M accounts · passwords exposed · infostealer logs","slug":"telegramstealerlogs-data-breach","stacks":[],"startedAt":"2024-08-01","status":"closed","summary":"In July 2024, info stealer logs with 26M unique email addresses were collated from malicious Telegram channels. The data contained 22GB of logs consisting of email addresses, passwords and the websites they were used on, all obtained by malware running on infected machines. Exposed data: email addresses, passwords. The breach dates from Jul 18, 2024; Have I Been Pwned loaded it on Aug 1, 2024.","tags":["data-breach","hibp","stealer-log","email-addresses","passwords"],"title":"Stealer Logs Posted to Telegram data breach: 26.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/telegramstealerlogs-data-breach","vendor":"Stealer Logs Posted to Telegram"},{"auto":true,"category":"breach","closedAt":"2024-08-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MULTIPLAYERIT"],"json":"https://helix.ml/threat-watch/i/multiplayerit-data-breach.json","latestUpdate":{"date":"2024-08-01","title":"Have I Been Pwned loaded 503K breached Multiplayer.it accounts"},"patchStatus":"no-fix-needed","product":"multiplayer.it","severity":"high","severityNote":"503K accounts · passwords exposed","slug":"multiplayerit-data-breach","stacks":[],"startedAt":"2024-08-01","status":"closed","summary":"In April 2024, over half a million records taken from the Italian gaming website Multiplayer.it were posted to a popular hacking forum. The impacted data included email addresses, usernames and salted MD5 password hashes. Multiplayer.it subsequently confirmed the breach dated back 6 years to September 2018 and was merely re-posted in 2024. Exposed data: email addresses, passwords. The breach dates from Sep 1, 2018; Have I Been Pwned loaded it on Aug 1, 2024.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Multiplayer.it data breach: 503K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/multiplayerit-data-breach","vendor":"Multiplayer.it"},{"auto":true,"category":"breach","closedAt":"2024-08-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANIMELEAGUE"],"json":"https://helix.ml/threat-watch/i/animeleague-data-breach.json","latestUpdate":{"date":"2024-07-31","title":"Have I Been Pwned loaded 192K breached AnimeLeague accounts"},"patchStatus":"no-fix-needed","product":"animeleague.net","severity":"high","severityNote":"192K accounts · passwords exposed","slug":"animeleague-data-breach","stacks":[],"startedAt":"2024-07-31","status":"closed","summary":"In July 2024, AnimeLeague disclosed a data breach of their services. The data was posted for sale on a popular hacking forum and included 2 databases covering both event registration records and a dump of the phpBB bulletin board. The impacted data included passwords in various hashed formats including SHA-1, salted md5 and bcrypt, as well as usernames, private messages, dates of birth, purchases and 192k unique email addresses. Exposed data: dates of birth, email addresses, ip addresses, passwords, phone numbers, private messages, purchases, usernames. The breach dates from Jul 4, 2024; Have I Been Pwned loaded it on Jul 31, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","phone-numbers","private-messages","purchases","usernames"],"title":"AnimeLeague data breach: 192K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/animeleague-data-breach","vendor":"AnimeLeague"},{"auto":true,"category":"patch","closedAt":"2024-08-13","cveIds":["CVE-2024-37085"],"exploited":"in-the-wild","identifiers":["CVE-2024-37085"],"json":"https://helix.ml/threat-watch/i/vmware-esxi-cve-2024-37085.json","latestUpdate":{"date":"2024-07-30","title":"CISA added CVE-2024-37085 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 20, 2024)"},"patchStatus":"patched","product":"ESXi","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-esxi-cve-2024-37085","stacks":["cloud"],"startedAt":"2024-07-30","status":"closed","summary":"VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. CISA added CVE-2024-37085 to its Known Exploited Vulnerabilities catalog on Jul 30, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-305"],"title":"VMware ESXi Authentication Bypass Vulnerability (CVE-2024-37085)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-esxi-cve-2024-37085","vendor":"VMware"},{"auto":true,"category":"breach","closedAt":"2024-08-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPYTECH"],"json":"https://helix.ml/threat-watch/i/spytech-data-breach.json","latestUpdate":{"date":"2024-07-30","title":"Have I Been Pwned loaded 5645 breached Spytech accounts"},"patchStatus":"no-fix-needed","product":"spytech-web.com","severity":"high","severityNote":"5645 accounts · passwords exposed","slug":"spytech-data-breach","stacks":[],"startedAt":"2024-07-30","status":"closed","summary":"In July 2024, spyware maker Spytech suffered a data breach that exposed data collected as recently as the previous month. Designed to \"invisibly record everything users do\", the breach exposed information related to both purchasers and targets of the product. Target data collection (and subsequent exposure) included the infected computer name, browsing history, applications used, usernames of authenticated users, keywords being monitored, file operations (creation and deletion), computer usage times and email addresses, often captured within the spyware's logs. The data also included the names, purchases and md5 password hashes of purchasers. Exposed data: browsing histories, device information, email addresses, names, passwords, purchases, usernames. The breach dates from Jun 4, 2024; Have I Been Pwned loaded it on Jul 30, 2024.","tags":["data-breach","hibp","browsing-histories","device-information","email-addresses","names","passwords","purchases","usernames"],"title":"Spytech data breach: 5645 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/spytech-data-breach","vendor":"Spytech"},{"auto":true,"category":"breach","closedAt":"2024-08-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UBOOK"],"json":"https://helix.ml/threat-watch/i/ubook-data-breach.json","latestUpdate":{"date":"2024-07-30","title":"Have I Been Pwned loaded 699K breached Ubook accounts"},"patchStatus":"no-fix-needed","product":"ubook.com","severity":"medium","severityNote":"699K accounts","slug":"ubook-data-breach","stacks":[],"startedAt":"2024-07-30","status":"closed","summary":"In July 2024, 700k unique email addresses from the audiobook platform Ubook were posted to a popular hacking forum. Allegedly scraped from the service, the data appears to be sourced from the Ubook Exchange (UBX) and also includes names, genders, dates of birth and links to profile photos. Exposed data: dates of birth, email addresses, genders, names, profile photos. The breach dates from Jul 28, 2024; Have I Been Pwned loaded it on Jul 30, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","profile-photos"],"title":"Ubook data breach: 699K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ubook-data-breach","vendor":"Ubook"},{"auto":true,"category":"patch","closedAt":"2024-08-12","cveIds":["CVE-2023-45249"],"exploited":"in-the-wild","identifiers":["CVE-2023-45249"],"json":"https://helix.ml/threat-watch/i/acronis-cyber-infrastructure-aci-cve-2023-45249.json","latestUpdate":{"date":"2024-07-29","title":"CISA added CVE-2023-45249 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 19, 2024)"},"patchStatus":"unknown","product":"Cyber Infrastructure (ACI)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"acronis-cyber-infrastructure-aci-cve-2023-45249","stacks":[],"startedAt":"2024-07-29","status":"closed","summary":"Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords. CISA added CVE-2023-45249 to its Known Exploited Vulnerabilities catalog on Jul 29, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1393"],"title":"Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability (CVE-2023-45249)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/acronis-cyber-infrastructure-aci-cve-2023-45249","vendor":"Acronis"},{"auto":true,"category":"patch","closedAt":"2024-08-12","cveIds":["CVE-2024-5217"],"exploited":"in-the-wild","identifiers":["CVE-2024-5217"],"json":"https://helix.ml/threat-watch/i/servicenow-utah-vancouver-and-washington-dc-now-platform-cve-2024-5217.json","latestUpdate":{"date":"2024-07-29","title":"CISA added CVE-2024-5217 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 19, 2024)"},"patchStatus":"unknown","product":"Utah, Vancouver, and Washington DC Now Platform","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"servicenow-utah-vancouver-and-washington-dc-now-platform-cve-2024-5217","stacks":[],"startedAt":"2024-07-29","status":"closed","summary":"ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely. CISA added CVE-2024-5217 to its Known Exploited Vulnerabilities catalog on Jul 29, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-184"],"title":"ServiceNow Incomplete List of Disallowed Inputs Vulnerability (CVE-2024-5217)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/servicenow-utah-vancouver-and-washington-dc-now-platform-cve-2024-5217","vendor":"ServiceNow"},{"auto":true,"category":"patch","closedAt":"2024-08-12","cveIds":["CVE-2024-4879"],"exploited":"in-the-wild","identifiers":["CVE-2024-4879"],"json":"https://helix.ml/threat-watch/i/servicenow-utah-vancouver-and-washington-dc-now-platform-cve-2024-4879.json","latestUpdate":{"date":"2024-07-29","title":"CISA added CVE-2024-4879 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 19, 2024)"},"patchStatus":"unknown","product":"Utah, Vancouver, and Washington DC Now Platform","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"servicenow-utah-vancouver-and-washington-dc-now-platform-cve-2024-4879","stacks":[],"startedAt":"2024-07-29","status":"closed","summary":"ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. CISA added CVE-2024-4879 to its Known Exploited Vulnerabilities catalog on Jul 29, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1287"],"title":"ServiceNow Improper Input Validation Vulnerability (CVE-2024-4879)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/servicenow-utah-vancouver-and-washington-dc-now-platform-cve-2024-4879","vendor":"ServiceNow"},{"auto":true,"category":"breach","closedAt":"2024-08-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EXPLORETALENT"],"json":"https://helix.ml/threat-watch/i/exploretalent-data-breach.json","latestUpdate":{"date":"2024-07-25","title":"Have I Been Pwned loaded 5.4M breached Explore Talent (July 2024) accounts"},"patchStatus":"no-fix-needed","product":"exploretalent.com","severity":"medium","severityNote":"5.4M accounts","slug":"exploretalent-data-breach","stacks":[],"startedAt":"2024-07-25","status":"closed","summary":"In July 2024, a data breach attributed to Explore Talent was publicly posted to a popular hacking forum. Containing 5.7M rows with 5.4M unique email addresses, the incident has been described by various sources as occurring between early 2022 to 2023 and also contains names, phone numbers and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Feb 28, 2022; Have I Been Pwned loaded it on Jul 25, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Explore Talent (July 2024) data breach: 5.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/exploretalent-data-breach","vendor":"Explore Talent (July 2024)"},{"auto":true,"category":"breach","closedAt":"2024-08-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CONDOCOM"],"json":"https://helix.ml/threat-watch/i/condocom-data-breach.json","latestUpdate":{"date":"2024-07-25","title":"Have I Been Pwned loaded 1.5M breached Condo.com accounts"},"patchStatus":"no-fix-needed","product":"condo.com","severity":"medium","severityNote":"1.5M accounts","slug":"condocom-data-breach","stacks":[],"startedAt":"2024-07-25","status":"closed","summary":"In June 2019, now defunct website Condo.com suffered a data breach that was later redistributed as part of a larger corpus of data. The impacted data included 1.5M email addresses alongside names, phone numbers and for a small number of records, physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jun 1, 2019; Have I Been Pwned loaded it on Jul 25, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Condo.com data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/condocom-data-breach","vendor":"Condo.com"},{"auto":true,"category":"patch","closedAt":"2024-08-06","cveIds":["CVE-2024-39891"],"exploited":"in-the-wild","identifiers":["CVE-2024-39891"],"json":"https://helix.ml/threat-watch/i/twilio-authy-cve-2024-39891.json","latestUpdate":{"date":"2024-07-23","title":"CISA added CVE-2024-39891 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 13, 2024)"},"patchStatus":"unknown","product":"Authy","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"twilio-authy-cve-2024-39891","stacks":[],"startedAt":"2024-07-23","status":"closed","summary":"Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy. CISA added CVE-2024-39891 to its Known Exploited Vulnerabilities catalog on Jul 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-203"],"title":"Twilio Authy Information Disclosure Vulnerability (CVE-2024-39891)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/twilio-authy-cve-2024-39891","vendor":"Twilio"},{"auto":true,"category":"patch","closedAt":"2024-08-06","cveIds":["CVE-2012-4792"],"exploited":"in-the-wild","identifiers":["CVE-2012-4792"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2012-4792.json","latestUpdate":{"date":"2024-07-23","title":"CISA added CVE-2012-4792 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 13, 2024)"},"patchStatus":"unpatched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2012-4792","stacks":["browser","windows"],"startedAt":"2024-07-23","status":"closed","summary":"Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object. CISA added CVE-2012-4792 to its Known Exploited Vulnerabilities catalog on Jul 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2012-4792)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2012-4792","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-08-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIFE360"],"json":"https://helix.ml/threat-watch/i/life360-data-breach.json","latestUpdate":{"date":"2024-07-20","title":"Have I Been Pwned loaded 442K breached Life360 accounts"},"patchStatus":"no-fix-needed","product":"life360.com","severity":"medium","severityNote":"442K accounts","slug":"life360-data-breach","stacks":[],"startedAt":"2024-07-20","status":"closed","summary":"In July 2024, data scraped from a misconfigured Life360 API was posted online after being obtained several months earlier. The records included 443k unique email addresses and in most cases, corresponding names and phone numbers (some records were null or obfuscated). Life360 promptly notified impacted users after the incident was discovered. Exposed data: email addresses, names, phone numbers. The breach dates from Mar 1, 2024; Have I Been Pwned loaded it on Jul 20, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers"],"title":"Life360 data breach: 442K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/life360-data-breach","vendor":"Life360"},{"auto":true,"category":"patch","closedAt":"2024-07-31","cveIds":["CVE-2022-22948"],"exploited":"in-the-wild","identifiers":["CVE-2022-22948"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2022-22948.json","latestUpdate":{"date":"2024-07-17","title":"CISA added CVE-2022-22948 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 7, 2024)"},"patchStatus":"patched","product":"vCenter Server","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2022-22948","stacks":["cloud"],"startedAt":"2024-07-17","status":"closed","summary":"VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. CISA added CVE-2022-22948 to its Known Exploited Vulnerabilities catalog on Jul 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-276"],"title":"VMware vCenter Server Incorrect Default File Permissions Vulnerability (CVE-2022-22948)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2022-22948","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2024-07-31","cveIds":["CVE-2024-28995"],"exploited":"in-the-wild","identifiers":["CVE-2024-28995"],"json":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2024-28995.json","latestUpdate":{"date":"2024-07-17","title":"CISA added CVE-2024-28995 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 7, 2024)"},"patchStatus":"unknown","product":"Serv-U","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-serv-u-cve-2024-28995","stacks":[],"startedAt":"2024-07-17","status":"closed","summary":"SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine. CISA added CVE-2024-28995 to its Known Exploited Vulnerabilities catalog on Jul 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"SolarWinds Serv-U Path Traversal Vulnerability (CVE-2024-28995)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2024-28995","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2024-07-31","cveIds":["CVE-2024-34102"],"exploited":"in-the-wild","identifiers":["CVE-2024-34102"],"json":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102.json","latestUpdate":{"date":"2024-07-17","title":"CISA added CVE-2024-34102 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 7, 2024)"},"patchStatus":"unknown","product":"Commerce and Magento Open Source","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-commerce-and-magento-open-source-cve-2024-34102","stacks":["php"],"startedAt":"2024-07-17","status":"closed","summary":"Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. CISA added CVE-2024-34102 to its Known Exploited Vulnerabilities catalog on Jul 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-611"],"title":"Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability (CVE-2024-34102)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2024-07-29","cveIds":["CVE-2024-36401"],"exploited":"in-the-wild","identifiers":["CVE-2024-36401"],"json":"https://helix.ml/threat-watch/i/osgeo-geoserver-cve-2024-36401.json","latestUpdate":{"date":"2024-07-15","title":"CISA added CVE-2024-36401 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 5, 2024)"},"patchStatus":"patched","product":"GeoServer","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"osgeo-geoserver-cve-2024-36401","stacks":[],"startedAt":"2024-07-15","status":"closed","summary":"OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. CISA added CVE-2024-36401 to its Known Exploited Vulnerabilities catalog on Jul 15, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-95"],"title":"OSGeo GeoServer GeoTools Eval Injection Vulnerability (CVE-2024-36401)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/osgeo-geoserver-cve-2024-36401","vendor":"OSGeo"},{"auto":true,"category":"breach","closedAt":"2024-07-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MSPY2024"],"json":"https://helix.ml/threat-watch/i/mspy2024-data-breach.json","latestUpdate":{"date":"2024-07-11","title":"Have I Been Pwned loaded 2.4M breached mSpy (2024) accounts"},"patchStatus":"no-fix-needed","product":"mspy.com","severity":"high","severityNote":"2.4M accounts","slug":"mspy2024-data-breach","stacks":[],"startedAt":"2024-07-11","status":"closed","summary":"In June 2024, a huge trove of data from spyware maker mSpy was obtained by hacktivists and published online. Comprising of 142GB of user data and support tickets along with 176GB of more than half a million attachments, the data contained 2.4M unique email addresses, IP addresses names and photos. The data was predominantly support tickets seeking help to install the spyware on target devices, whilst the attachments contained various data including screen grans of financial transactions, photos of credit cards and nude selfies. Exposed data: email addresses, ip addresses, names, photos. The breach dates from Jun 9, 2024; Have I Been Pwned loaded it on Jul 11, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","photos"],"title":"mSpy (2024) data breach: 2.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mspy2024-data-breach","vendor":"mSpy (2024)"},{"auto":true,"category":"breach","closedAt":"2024-07-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEHERITAGEFOUNDATION"],"json":"https://helix.ml/threat-watch/i/theheritagefoundation-data-breach.json","latestUpdate":{"date":"2024-07-10","title":"Have I Been Pwned loaded 72K breached The Heritage Foundation accounts"},"patchStatus":"no-fix-needed","product":"heritage.org","severity":"high","severityNote":"72K accounts · passwords exposed","slug":"theheritagefoundation-data-breach","stacks":[],"startedAt":"2024-07-10","status":"closed","summary":"In July 2024, hacktivists published almost 2GB of data taken from The Heritage Foundation and their media arm, The Daily Signal. The data contained 72k unique email addresses, primarily used for commenting on articles (along with names, IP addresses and the comments left) and by content contributors (along with usernames and passwords stored as either MD5 or phpass hashes). Exposed data: email addresses, ip addresses, names, passwords, usernames. The breach dates from Jul 9, 2024; Have I Been Pwned loaded it on Jul 10, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","usernames"],"title":"The Heritage Foundation data breach: 72K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/theheritagefoundation-data-breach","vendor":"The Heritage Foundation"},{"auto":true,"category":"patch","closedAt":"2024-07-23","cveIds":["CVE-2024-23692"],"exploited":"in-the-wild","identifiers":["CVE-2024-23692"],"json":"https://helix.ml/threat-watch/i/rejetto-http-file-server-cve-2024-23692.json","latestUpdate":{"date":"2024-07-09","title":"CISA added CVE-2024-23692 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 30, 2024)"},"patchStatus":"patched","product":"HTTP File Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"rejetto-http-file-server-cve-2024-23692","stacks":[],"startedAt":"2024-07-09","status":"closed","summary":"Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request. CISA added CVE-2024-23692 to its Known Exploited Vulnerabilities catalog on Jul 9, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-1336"],"title":"Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2024-23692)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/rejetto-http-file-server-cve-2024-23692","vendor":"Rejetto"},{"auto":true,"category":"patch","closedAt":"2024-07-23","cveIds":["CVE-2024-38080"],"exploited":"in-the-wild","identifiers":["CVE-2024-38080"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38080.json","latestUpdate":{"date":"2024-07-09","title":"CISA added CVE-2024-38080 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 30, 2024)"},"patchStatus":"patched","product":"Windows ","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38080","stacks":["windows"],"startedAt":"2024-07-09","status":"closed","summary":"Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CISA added CVE-2024-38080 to its Known Exploited Vulnerabilities catalog on Jul 9, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-190"],"title":"Microsoft Windows Hyper-V Privilege Escalation Vulnerability (CVE-2024-38080)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38080","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-07-23","cveIds":["CVE-2024-38112"],"exploited":"in-the-wild","identifiers":["CVE-2024-38112"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38112.json","latestUpdate":{"date":"2024-07-09","title":"CISA added CVE-2024-38112 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 30, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-38112","stacks":["windows"],"startedAt":"2024-07-09","status":"closed","summary":"Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. CISA added CVE-2024-38112 to its Known Exploited Vulnerabilities catalog on Jul 9, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-451"],"title":"Microsoft Windows MSHTML Platform Spoofing Vulnerability (CVE-2024-38112)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-38112","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-07-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NEIMANMARCUS"],"json":"https://helix.ml/threat-watch/i/neimanmarcus-data-breach.json","latestUpdate":{"date":"2024-07-09","title":"Have I Been Pwned loaded 31.2M breached Neiman Marcus accounts"},"patchStatus":"no-fix-needed","product":"neimanmarcus.com","severity":"high","severityNote":"31.2M accounts · financial data exposed","slug":"neimanmarcus-data-breach","stacks":[],"startedAt":"2024-07-09","status":"closed","summary":"In May 2024, the American luxury retailer Neiman Marcus suffered a data breach which was later posted to a popular hacking forum. The data included 31M unique email addresses, names, phone numbers, dates of birth, physical addresses and partial credit card data (note: this is insufficient to make purchases). The breach was traced back to a series of attacks against the Snowflake cloud service which impacted 165 organisations worldwide. Exposed data: dates of birth, email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Apr 14, 2024; Have I Been Pwned loaded it on Jul 9, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"Neiman Marcus data breach: 31.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/neimanmarcus-data-breach","vendor":"Neiman Marcus"},{"auto":true,"category":"breach","closedAt":"2024-07-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HUSKYOWNERS"],"json":"https://helix.ml/threat-watch/i/huskyowners-data-breach.json","latestUpdate":{"date":"2024-07-07","title":"Have I Been Pwned loaded 16K breached Husky Owners accounts"},"patchStatus":"no-fix-needed","product":"husky-owners.com","severity":"medium","severityNote":"16K accounts","slug":"huskyowners-data-breach","stacks":[],"startedAt":"2024-07-07","status":"closed","summary":"In July 2024, the Husky Owners forum website was defaced and linked to a breach of user data containing 16k records. The exposed data included usernames, email addresses, dates of birth and time zones. Exposed data: dates of birth, email addresses, time zones, usernames. The breach dates from Jul 4, 2024; Have I Been Pwned loaded it on Jul 7, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","time-zones","usernames"],"title":"Husky Owners data breach: 16K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/huskyowners-data-breach","vendor":"Husky Owners"},{"auto":true,"category":"breach","closedAt":"2024-07-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROBLOXDEVELOPERCONFERENCE2024"],"json":"https://helix.ml/threat-watch/i/robloxdeveloperconference2024-data-breach.json","latestUpdate":{"date":"2024-07-06","title":"Have I Been Pwned loaded 10K breached FNTECH accounts"},"patchStatus":"no-fix-needed","product":"fntech.com","severity":"medium","severityNote":"10K accounts","slug":"robloxdeveloperconference2024-data-breach","stacks":[],"startedAt":"2024-07-06","status":"closed","summary":"In July 2024, the events management platform FNTECH suffered a data breach that exposed 10k unique email addresses. The data contained registrants from various events, including participants of the Roblox Developer Conference registration list. The data also included names and IP addresses. Exposed data: email addresses, ip addresses, names. The breach dates from Jul 4, 2024; Have I Been Pwned loaded it on Jul 6, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","names"],"title":"FNTECH data breach: 10K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/robloxdeveloperconference2024-data-breach","vendor":"FNTECH"},{"auto":true,"category":"breach","closedAt":"2024-07-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DATEHOTBRUNETTES"],"json":"https://helix.ml/threat-watch/i/datehotbrunettes-data-breach.json","latestUpdate":{"date":"2024-07-04","title":"Have I Been Pwned loaded 1.5M breached Date Hot Brunettes accounts"},"patchStatus":"no-fix-needed","product":"datehotbrunettes.com","severity":"high","severityNote":"1.5M accounts · passwords exposed","slug":"datehotbrunettes-data-breach","stacks":[],"startedAt":"2024-07-04","status":"closed","summary":"In January 2021, the now defunct website Date Hot Brunettes which provided a service to \"Date Neglected Women Who Can Keep a Secret\", suffered a data breach. The incident exposed 1.5M unique email addresses along with IP addresses, usernames, user-entered bios and MD5 password hashes. Exposed data: bios, email addresses, ip addresses, passwords, usernames. The breach dates from Jan 12, 2021; Have I Been Pwned loaded it on Jul 4, 2024.","tags":["data-breach","hibp","bios","email-addresses","ip-addresses","passwords","usernames"],"title":"Date Hot Brunettes data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/datehotbrunettes-data-breach","vendor":"Date Hot Brunettes"},{"auto":true,"category":"patch","closedAt":"2024-07-16","cveIds":["CVE-2024-20399"],"exploited":"in-the-wild","identifiers":["CVE-2024-20399"],"json":"https://helix.ml/threat-watch/i/cisco-nx-os-cve-2024-20399.json","latestUpdate":{"date":"2024-07-02","title":"CISA added CVE-2024-20399 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 23, 2024)"},"patchStatus":"unknown","product":"NX-OS","severity":"medium","severityNote":"CVSS 6.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-nx-os-cve-2024-20399","stacks":["network"],"startedAt":"2024-07-02","status":"closed","summary":"Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. CISA added CVE-2024-20399 to its Known Exploited Vulnerabilities catalog on Jul 2, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Cisco NX-OS Command Injection Vulnerability (CVE-2024-20399)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-nx-os-cve-2024-20399","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2024-07-10","cveIds":["CVE-2020-13965"],"exploited":"in-the-wild","identifiers":["CVE-2020-13965"],"json":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2020-13965.json","latestUpdate":{"date":"2024-06-26","title":"CISA added CVE-2020-13965 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 17, 2024)"},"patchStatus":"patched","product":"Webmail","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-webmail-cve-2020-13965","stacks":[],"startedAt":"2024-06-26","status":"closed","summary":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment. CISA added CVE-2020-13965 to its Known Exploited Vulnerabilities catalog on Jun 26, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-80"],"title":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability (CVE-2020-13965)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2020-13965","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2024-07-10","cveIds":["CVE-2022-2586"],"exploited":"in-the-wild","identifiers":["CVE-2022-2586"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-2586.json","latestUpdate":{"date":"2024-06-26","title":"CISA added CVE-2022-2586 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 17, 2024)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2022-2586","stacks":["linux"],"startedAt":"2024-06-26","status":"closed","summary":"Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. CISA added CVE-2022-2586 to its Known Exploited Vulnerabilities catalog on Jun 26, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-416"],"title":"Linux Kernel Use-After-Free Vulnerability (CVE-2022-2586)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-2586","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2024-07-10","cveIds":["CVE-2022-24816"],"exploited":"in-the-wild","identifiers":["CVE-2022-24816"],"json":"https://helix.ml/threat-watch/i/osgeo-jai-ext-cve-2022-24816.json","latestUpdate":{"date":"2024-06-26","title":"CISA added CVE-2022-24816 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 17, 2024)"},"patchStatus":"patched","product":"JAI-EXT","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"osgeo-jai-ext-cve-2022-24816","stacks":[],"startedAt":"2024-06-26","status":"closed","summary":"OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution. CISA added CVE-2022-24816 to its Known Exploited Vulnerabilities catalog on Jun 26, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"OSGeo GeoServer JAI-EXT Code Injection Vulnerability (CVE-2022-24816)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/osgeo-jai-ext-cve-2022-24816","vendor":"OSGeo"},{"auto":true,"category":"breach","closedAt":"2024-07-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADVANCEAUTOPARTS"],"json":"https://helix.ml/threat-watch/i/advanceautoparts-data-breach.json","latestUpdate":{"date":"2024-06-24","title":"Have I Been Pwned loaded 79.2M breached Advance Auto Parts accounts"},"patchStatus":"no-fix-needed","product":"advanceautoparts.com","severity":"high","severityNote":"79.2M accounts","slug":"advanceautoparts-data-breach","stacks":[],"startedAt":"2024-06-24","status":"closed","summary":"In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum. Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees. In total, 79M unique email addresses were included in the breach, alongside names, phone numbers, addresses and further data attributes related to company employees. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jun 5, 2024; Have I Been Pwned loaded it on Jun 24, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Advance Auto Parts data breach: 79.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/advanceautoparts-data-breach","vendor":"Advance Auto Parts"},{"auto":true,"category":"breach","closedAt":"2024-07-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZADIGVOLTAIRE"],"json":"https://helix.ml/threat-watch/i/zadigvoltaire-data-breach.json","latestUpdate":{"date":"2024-06-17","title":"Have I Been Pwned loaded 586K breached Zadig \u0026 Voltaire accounts"},"patchStatus":"no-fix-needed","product":"zadig-et-voltaire.com","severity":"medium","severityNote":"586K accounts","slug":"zadigvoltaire-data-breach","stacks":[],"startedAt":"2024-06-17","status":"closed","summary":"In June 2024, a data brach sourced from French fashion brand Zadig \u0026 Voltaire was publicly posted to a popular hacking forum. The data included names, email and physical addresses, phone numbers and genders. When contacted about the incident, Zadig \u0026 Voltaire advised the incident had occurred more than 6 months ago and that \"all measures were taken quickly\". Exposed data: email addresses, genders, names, phone numbers, physical addresses. The breach dates from Nov 16, 2023; Have I Been Pwned loaded it on Jun 17, 2024.","tags":["data-breach","hibp","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"Zadig \u0026 Voltaire data breach: 586K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/zadigvoltaire-data-breach","vendor":"Zadig \u0026 Voltaire"},{"auto":true,"category":"patch","closedAt":"2024-06-27","cveIds":["CVE-2024-4358"],"exploited":"in-the-wild","identifiers":["CVE-2024-4358"],"json":"https://helix.ml/threat-watch/i/progress-telerik-report-server-cve-2024-4358.json","latestUpdate":{"date":"2024-06-13","title":"CISA added CVE-2024-4358 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 4, 2024)"},"patchStatus":"unknown","product":"Telerik Report Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-telerik-report-server-cve-2024-4358","stacks":[],"startedAt":"2024-06-13","status":"closed","summary":"Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. CISA added CVE-2024-4358 to its Known Exploited Vulnerabilities catalog on Jun 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-290"],"title":"Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability (CVE-2024-4358)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/progress-telerik-report-server-cve-2024-4358","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2024-06-27","cveIds":["CVE-2024-26169"],"exploited":"in-the-wild","identifiers":["CVE-2024-26169"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-26169.json","latestUpdate":{"date":"2024-06-13","title":"CISA added CVE-2024-26169 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 4, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-26169","stacks":["windows"],"startedAt":"2024-06-13","status":"closed","summary":"Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CISA added CVE-2024-26169 to its Known Exploited Vulnerabilities catalog on Jun 13, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-269"],"title":"Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability (CVE-2024-26169)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-26169","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-06-27","cveIds":["CVE-2024-32896"],"exploited":"in-the-wild","identifiers":["CVE-2024-32896"],"json":"https://helix.ml/threat-watch/i/android-pixel-cve-2024-32896.json","latestUpdate":{"date":"2024-06-13","title":"CISA added CVE-2024-32896 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 4, 2024)"},"patchStatus":"unknown","product":"Pixel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-pixel-cve-2024-32896","stacks":["android"],"startedAt":"2024-06-13","status":"closed","summary":"Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation. CISA added CVE-2024-32896 to its Known Exploited Vulnerabilities catalog on Jun 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-783"],"title":"Android Pixel Privilege Escalation Vulnerability (CVE-2024-32896)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-pixel-cve-2024-32896","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2024-06-26","cveIds":["CVE-2024-4577"],"exploited":"in-the-wild","identifiers":["CVE-2024-4577"],"json":"https://helix.ml/threat-watch/i/php-group-php-cve-2024-4577.json","latestUpdate":{"date":"2024-06-12","title":"CISA added CVE-2024-4577 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 3, 2024)"},"patchStatus":"patched","product":"PHP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"php-group-php-cve-2024-4577","stacks":["php"],"startedAt":"2024-06-12","status":"closed","summary":"PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823. CISA added CVE-2024-4577 to its Known Exploited Vulnerabilities catalog on Jun 12, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"PHP-CGI OS Command Injection Vulnerability (CVE-2024-4577)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/php-group-php-cve-2024-4577","vendor":"PHP Group"},{"auto":true,"category":"patch","closedAt":"2024-06-26","cveIds":["CVE-2024-4610"],"exploited":"in-the-wild","identifiers":["CVE-2024-4610"],"json":"https://helix.ml/threat-watch/i/arm-mali-gpu-kernel-driver-cve-2024-4610.json","latestUpdate":{"date":"2024-06-12","title":"CISA added CVE-2024-4610 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 3, 2024)"},"patchStatus":"unknown","product":"Mali GPU Kernel Driver","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-gpu-kernel-driver-cve-2024-4610","stacks":["linux"],"startedAt":"2024-06-12","status":"closed","summary":"Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. CISA added CVE-2024-4610 to its Known Exploited Vulnerabilities catalog on Jun 12, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (CVE-2024-4610)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/arm-mali-gpu-kernel-driver-cve-2024-4610","vendor":"Arm"},{"auto":true,"category":"patch","closedAt":"2024-06-17","cveIds":["CVE-2017-3506"],"exploited":"in-the-wild","identifiers":["CVE-2017-3506"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2017-3506.json","latestUpdate":{"date":"2024-06-03","title":"CISA added CVE-2017-3506 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 24, 2024)"},"patchStatus":"patched","product":"WebLogic Server","severity":"high","severityNote":"CVSS 7.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2017-3506","stacks":["java"],"startedAt":"2024-06-03","status":"closed","summary":"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. CISA added CVE-2017-3506 to its Known Exploited Vulnerabilities catalog on Jun 3, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Oracle WebLogic Server OS Command Injection Vulnerability (CVE-2017-3506)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2017-3506","vendor":"Oracle"},{"auto":true,"category":"breach","closedAt":"2024-06-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TELEGRAMCOMBOLISTS"],"json":"https://helix.ml/threat-watch/i/telegramcombolists-data-breach.json","latestUpdate":{"date":"2024-06-03","title":"Have I Been Pwned loaded 361.5M breached Combolists Posted to Telegram accounts"},"patchStatus":"no-fix-needed","product":"Combolists Posted to Telegram","severity":"critical","severityNote":"361.5M accounts · passwords exposed","slug":"telegramcombolists-data-breach","stacks":[],"startedAt":"2024-06-03","status":"closed","summary":"In May 2024, 2B rows of data with 361M unique email addresses were collated from malicious Telegram channels. The data contained 122GB across 1.7k files with email addresses, usernames, passwords and in many cases, the website they were entered into. The data appears to have been sourced from a combination of existing combolists and info stealer malware. Exposed data: email addresses, passwords, usernames. The breach dates from May 28, 2024; Have I Been Pwned loaded it on Jun 3, 2024.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Combolists Posted to Telegram data breach: 361.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/telegramcombolists-data-breach","vendor":"Combolists Posted to Telegram"},{"auto":true,"category":"patch","closedAt":"2024-06-13","cveIds":["CVE-2024-1086"],"exploited":"in-the-wild","identifiers":["CVE-2024-1086"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-1086.json","latestUpdate":{"date":"2024-05-30","title":"CISA added CVE-2024-1086 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 20, 2024)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2024-1086","stacks":["linux"],"startedAt":"2024-05-30","status":"closed","summary":"Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. CISA added CVE-2024-1086 to its Known Exploited Vulnerabilities catalog on May 30, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","memory-corruption","cwe-416"],"title":"Linux Kernel Use-After-Free Vulnerability (CVE-2024-1086)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2024-1086","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2024-06-13","cveIds":["CVE-2024-24919"],"exploited":"in-the-wild","identifiers":["CVE-2024-24919"],"json":"https://helix.ml/threat-watch/i/check-point-quantum-security-gateways-cve-2024-24919.json","latestUpdate":{"date":"2024-05-30","title":"CISA added CVE-2024-24919 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 20, 2024)"},"patchStatus":"patched","product":"Quantum Security Gateways","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"check-point-quantum-security-gateways-cve-2024-24919","stacks":["network"],"startedAt":"2024-05-30","status":"closed","summary":"Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. CISA added CVE-2024-24919 to its Known Exploited Vulnerabilities catalog on May 30, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-200"],"title":"Check Point Quantum Security Gateways Information Disclosure Vulnerability (CVE-2024-24919)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/check-point-quantum-security-gateways-cve-2024-24919","vendor":"Check Point"},{"auto":true,"category":"breach","closedAt":"2024-06-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OPERATIONENDGAME"],"json":"https://helix.ml/threat-watch/i/operationendgame-data-breach.json","latestUpdate":{"date":"2024-05-30","title":"Have I Been Pwned loaded 16.5M breached Operation Endgame accounts"},"patchStatus":"no-fix-needed","product":"Operation Endgame","severity":"high","severityNote":"16.5M accounts · passwords exposed","slug":"operationendgame-data-breach","stacks":[],"startedAt":"2024-05-30","status":"closed","summary":"In May 2024, a coalition of international law enforcement agencies took down a series of botnets in a campaign they coined \"Operation Endgame\". Data seized in the operation included impacted email addresses and passwords which were provided to HIBP to help victims learn of their exposure. Exposed data: email addresses, passwords. The breach dates from May 30, 2024; Have I Been Pwned loaded it on May 30, 2024.","tags":["data-breach","hibp","malware","email-addresses","passwords"],"title":"Operation Endgame data breach: 16.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/operationendgame-data-breach","vendor":"Operation Endgame"},{"auto":true,"category":"patch","closedAt":"2024-06-12","cveIds":["CVE-2024-4978"],"exploited":"in-the-wild","identifiers":["CVE-2024-4978"],"json":"https://helix.ml/threat-watch/i/justice-av-solutions-viewer-cve-2024-4978.json","latestUpdate":{"date":"2024-05-29","title":"CISA added CVE-2024-4978 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 19, 2024)"},"patchStatus":"unknown","product":"Viewer ","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"justice-av-solutions-viewer-cve-2024-4978","stacks":[],"startedAt":"2024-05-29","status":"closed","summary":"Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server. CISA added CVE-2024-4978 to its Known Exploited Vulnerabilities catalog on May 29, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-506"],"title":"Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability (CVE-2024-4978)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/justice-av-solutions-viewer-cve-2024-4978","vendor":"Justice AV Solutions"},{"auto":true,"category":"patch","closedAt":"2024-06-11","cveIds":["CVE-2024-5274"],"exploited":"in-the-wild","identifiers":["CVE-2024-5274"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-5274.json","latestUpdate":{"date":"2024-05-28","title":"CISA added CVE-2024-5274 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 18, 2024)"},"patchStatus":"unknown","product":"Chromium V8","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2024-5274","stacks":["browser"],"startedAt":"2024-05-28","status":"closed","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2024-5274 to its Known Exploited Vulnerabilities catalog on May 28, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2024-5274)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-5274","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2024-06-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PCTATTLETALE"],"json":"https://helix.ml/threat-watch/i/pctattletale-data-breach.json","latestUpdate":{"date":"2024-05-25","title":"Have I Been Pwned loaded 138K breached pcTattletale accounts"},"patchStatus":"no-fix-needed","product":"pctattletale.com","severity":"high","severityNote":"138K accounts · passwords exposed","slug":"pctattletale-data-breach","stacks":[],"startedAt":"2024-05-25","status":"closed","summary":"In May 2024, the spyware service pcTattletale suffered a data breach that defaced the website and posted tens of gigabytes of data to the homepage, allegedly due to pcTattletale not responding to a previous security vulnerability report. The breach exposed data including membership records, infected PC names, captured messages and extensive logs of IP addresses and device information. Exposed data: device information, email addresses, ip addresses, names, passwords, phone numbers, physical addresses, sms messages, usernames. The breach dates from May 25, 2024; Have I Been Pwned loaded it on May 25, 2024.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","sms-messages","usernames"],"title":"pcTattletale data breach: 138K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/pctattletale-data-breach","vendor":"pcTattletale"},{"auto":true,"category":"patch","closedAt":"2024-06-06","cveIds":["CVE-2020-17519"],"exploited":"in-the-wild","identifiers":["CVE-2020-17519"],"json":"https://helix.ml/threat-watch/i/apache-flink-cve-2020-17519.json","latestUpdate":{"date":"2024-05-23","title":"CISA added CVE-2020-17519 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2024)"},"patchStatus":"unknown","product":"Flink","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-flink-cve-2020-17519","stacks":[],"startedAt":"2024-05-23","status":"closed","summary":"Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. CISA added CVE-2020-17519 to its Known Exploited Vulnerabilities catalog on May 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-552"],"title":"Apache Flink Improper Access Control Vulnerability (CVE-2020-17519)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-flink-cve-2020-17519","vendor":"Apache"},{"auto":true,"category":"breach","closedAt":"2024-06-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOTA2"],"json":"https://helix.ml/threat-watch/i/dota2-data-breach.json","latestUpdate":{"date":"2024-05-23","title":"Have I Been Pwned loaded 1.9M breached Dota2 accounts"},"patchStatus":"no-fix-needed","product":"dev.dota2.com","severity":"high","severityNote":"1.9M accounts · passwords exposed","slug":"dota2-data-breach","stacks":[],"startedAt":"2024-05-23","status":"closed","summary":"In July 2016, the Dota2 official developers forum suffered a data breach that exposed almost 2 million users. The hack of the vBulletin forum led to the disclosure of email and IP addresses, usernames and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 10, 2016; Have I Been Pwned loaded it on May 23, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Dota2 data breach: 1.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/dota2-data-breach","vendor":"Dota2"},{"auto":true,"category":"patch","closedAt":"2024-06-03","cveIds":["CVE-2024-4947"],"exploited":"in-the-wild","identifiers":["CVE-2024-4947"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-4947.json","latestUpdate":{"date":"2024-05-20","title":"CISA added CVE-2024-4947 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2024)"},"patchStatus":"unknown","product":"Chromium V8","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2024-4947","stacks":["browser"],"startedAt":"2024-05-20","status":"closed","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. CISA added CVE-2024-4947 to its Known Exploited Vulnerabilities catalog on May 20, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2024-4947)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-4947","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2024-06-03","cveIds":["CVE-2023-43208"],"exploited":"in-the-wild","identifiers":["CVE-2023-43208"],"json":"https://helix.ml/threat-watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208.json","latestUpdate":{"date":"2024-05-20","title":"CISA added CVE-2023-43208 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2024)"},"patchStatus":"unknown","product":"Mirth Connect","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nextgen-healthcare-mirth-connect-cve-2023-43208","stacks":["rust"],"startedAt":"2024-05-20","status":"closed","summary":"NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. CISA added CVE-2023-43208 to its Known Exploited Vulnerabilities catalog on May 20, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502"],"title":"NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability (CVE-2023-43208)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208","vendor":"NextGen Healthcare"},{"auto":true,"category":"patch","closedAt":"2024-05-30","cveIds":["CVE-2024-4761"],"exploited":"in-the-wild","identifiers":["CVE-2024-4761"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-4761.json","latestUpdate":{"date":"2024-05-16","title":"CISA added CVE-2024-4761 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 6, 2024)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2024-4761","stacks":["browser"],"startedAt":"2024-05-16","status":"closed","summary":"Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2024-4761 to its Known Exploited Vulnerabilities catalog on May 16, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium V8 Out-of-Bounds Memory Write Vulnerability (CVE-2024-4761)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-4761","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2024-05-30","cveIds":["CVE-2021-40655"],"exploited":"in-the-wild","identifiers":["CVE-2021-40655"],"json":"https://helix.ml/threat-watch/i/d-link-dir-605-router-cve-2021-40655.json","latestUpdate":{"date":"2024-05-16","title":"CISA added CVE-2021-40655 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 6, 2024)"},"patchStatus":"unpatched","product":"DIR-605 Router","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-605-router-cve-2021-40655","stacks":["network"],"startedAt":"2024-05-16","status":"closed","summary":"D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. CISA added CVE-2021-40655 to its Known Exploited Vulnerabilities catalog on May 16, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-863"],"title":"D-Link DIR-605 Router Information Disclosure Vulnerability (CVE-2021-40655)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dir-605-router-cve-2021-40655","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2024-05-30","cveIds":["CVE-2014-100005"],"exploited":"in-the-wild","identifiers":["CVE-2014-100005"],"json":"https://helix.ml/threat-watch/i/d-link-dir-600-router-cve-2014-100005.json","latestUpdate":{"date":"2024-05-16","title":"CISA added CVE-2014-100005 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 6, 2024)"},"patchStatus":"unpatched","product":"DIR-600 Router","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-600-router-cve-2014-100005","stacks":["network"],"startedAt":"2024-05-16","status":"closed","summary":"D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session. CISA added CVE-2014-100005 to its Known Exploited Vulnerabilities catalog on May 16, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-352"],"title":"D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-100005)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dir-600-router-cve-2014-100005","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2024-05-28","cveIds":["CVE-2024-30040"],"exploited":"in-the-wild","identifiers":["CVE-2024-30040"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-30040.json","latestUpdate":{"date":"2024-05-14","title":"CISA added CVE-2024-30040 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 4, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-30040","stacks":["windows"],"startedAt":"2024-05-14","status":"closed","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CISA added CVE-2024-30040 to its Known Exploited Vulnerabilities catalog on May 14, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability (CVE-2024-30040)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-30040","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-05-28","cveIds":["CVE-2024-30051"],"exploited":"in-the-wild","identifiers":["CVE-2024-30051"],"json":"https://helix.ml/threat-watch/i/microsoft-dwm-core-library-cve-2024-30051.json","latestUpdate":{"date":"2024-05-14","title":"CISA added CVE-2024-30051 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 4, 2024)"},"patchStatus":"patched","product":"DWM Core Library","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-dwm-core-library-cve-2024-30051","stacks":[],"startedAt":"2024-05-14","status":"closed","summary":"Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. CISA added CVE-2024-30051 to its Known Exploited Vulnerabilities catalog on May 14, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-122"],"title":"Microsoft DWM Core Library Privilege Escalation Vulnerability (CVE-2024-30051)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-dwm-core-library-cve-2024-30051","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-05-27","cveIds":["CVE-2024-4671"],"exploited":"in-the-wild","identifiers":["CVE-2024-4671"],"json":"https://helix.ml/threat-watch/i/google-chromium-cve-2024-4671.json","latestUpdate":{"date":"2024-05-13","title":"CISA added CVE-2024-4671 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 3, 2024)"},"patchStatus":"unknown","product":"Chromium","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-cve-2024-4671","stacks":["browser"],"startedAt":"2024-05-13","status":"closed","summary":"Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2024-4671 to its Known Exploited Vulnerabilities catalog on May 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium Visuals Use-After-Free Vulnerability (CVE-2024-4671)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-cve-2024-4671","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2024-05-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEPOSTMILLENNIAL"],"json":"https://helix.ml/threat-watch/i/thepostmillennial-data-breach.json","latestUpdate":{"date":"2024-05-10","title":"Have I Been Pwned loaded 57.0M breached The Post Millennial accounts"},"patchStatus":"no-fix-needed","product":"thepostmillennial.com","severity":"high","severityNote":"57.0M accounts · passwords exposed","slug":"thepostmillennial-data-breach","stacks":[],"startedAt":"2024-05-10","status":"closed","summary":"In May 2024, the conservative news website The Post Millennial suffered a data breach. The breach resulted in the defacement of the website and links posted to 3 different corpuses of data including hundreds of writers and editors (IP, physical address and email exposed), tens of thousands of subscribers to the site (name, email, username, phone and plain text password exposed), and tens of millions of email addresses from thousands of mailing lists alleged to have been used by The Post Millennial (this has not been independently verified). The mailing lists appear to be sourced from various campaigns not necessarily run by The Post Millennial and contain a variety of different personal attributes including name, phone and physical address (depending on the campaign). The data was subsequently posted to a popular hacking forum and extensively torrented. Exposed data: email addresses, genders, ip addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from May 2, 2024; Have I Been Pwned loaded it on May 10, 2024.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"The Post Millennial data breach: 57.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/thepostmillennial-data-breach","vendor":"The Post Millennial"},{"auto":true,"category":"breach","closedAt":"2024-05-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TAPPWARE"],"json":"https://helix.ml/threat-watch/i/tappware-data-breach.json","latestUpdate":{"date":"2024-05-09","title":"Have I Been Pwned loaded 94K breached Tappware accounts"},"patchStatus":"no-fix-needed","product":"tappware.com","severity":"medium","severityNote":"94K accounts","slug":"tappware-data-breach","stacks":[],"startedAt":"2024-05-09","status":"closed","summary":"In April 2024, a substantial volume of data was taken from the Bangladeshi IT services provider Tappware and published to a popular hacking forum. Comprising of 95k unique email addresses, the data also included extensive labour information on local citizens including names, physical addresses, job titles, dates of birth, genders and scans of government issued national identity (NID) cards. Exposed data: dates of birth, email addresses, genders, government issued ids, job titles, names, phone numbers, physical addresses, religions. The breach dates from Apr 23, 2024; Have I Been Pwned loaded it on May 9, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","government-issued-ids","job-titles","names","phone-numbers","physical-addresses","religions"],"title":"Tappware data breach: 94K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tappware-data-breach","vendor":"Tappware"},{"auto":true,"category":"patch","closedAt":"2024-05-15","cveIds":["CVE-2023-7028"],"exploited":"in-the-wild","identifiers":["CVE-2023-7028"],"json":"https://helix.ml/threat-watch/i/gitlab-gitlab-ce-ee-cve-2023-7028.json","latestUpdate":{"date":"2024-05-01","title":"CISA added CVE-2023-7028 to the Known Exploited Vulnerabilities catalog (federal remediation due May 22, 2024)"},"patchStatus":"unknown","product":"GitLab CE/EE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gitlab-gitlab-ce-ee-cve-2023-7028","stacks":["devtools"],"startedAt":"2024-05-01","status":"closed","summary":"GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. CISA added CVE-2023-7028 to its Known Exploited Vulnerabilities catalog on May 1, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"GitLab Community and Enterprise Editions Improper Access Control Vulnerability (CVE-2023-7028)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/gitlab-gitlab-ce-ee-cve-2023-7028","vendor":"GitLab"},{"auto":true,"category":"patch","closedAt":"2024-05-14","cveIds":["CVE-2024-29988"],"exploited":"in-the-wild","identifiers":["CVE-2024-29988"],"json":"https://helix.ml/threat-watch/i/microsoft-smartscreen-prompt-cve-2024-29988.json","latestUpdate":{"date":"2024-04-30","title":"CISA added CVE-2024-29988 to the Known Exploited Vulnerabilities catalog (federal remediation due May 21, 2024)"},"patchStatus":"patched","product":"SmartScreen Prompt","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-smartscreen-prompt-cve-2024-29988","stacks":[],"startedAt":"2024-04-30","status":"closed","summary":"Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file. CISA added CVE-2024-29988 to its Known Exploited Vulnerabilities catalog on Apr 30, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-693"],"title":"Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability (CVE-2024-29988)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-smartscreen-prompt-cve-2024-29988","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-05-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MOVIEBOXPRO"],"json":"https://helix.ml/threat-watch/i/movieboxpro-data-breach.json","latestUpdate":{"date":"2024-04-30","title":"Have I Been Pwned loaded 6.0M breached MovieBoxPro accounts"},"patchStatus":"no-fix-needed","product":"movieboxpro.app","severity":"medium","severityNote":"6.0M accounts","slug":"movieboxpro-data-breach","stacks":[],"startedAt":"2024-04-30","status":"closed","summary":"In April 2024, over 6M records from the streaming service MovieBoxPro were scraped from a vulnerable API. Of questionable legality, the service provided no contact information to disclose the incident, although reportedly the vulnerability was rectified after being mass enumerated. Exposed data: email addresses, usernames. The breach dates from Apr 15, 2024; Have I Been Pwned loaded it on Apr 30, 2024.","tags":["data-breach","hibp","email-addresses","usernames"],"title":"MovieBoxPro data breach: 6.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/movieboxpro-data-breach","vendor":"MovieBoxPro"},{"auto":true,"category":"breach","closedAt":"2024-05-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PIPINGROCK"],"json":"https://helix.ml/threat-watch/i/pipingrock-data-breach.json","latestUpdate":{"date":"2024-04-26","title":"Have I Been Pwned loaded 2.1M breached Piping Rock accounts"},"patchStatus":"no-fix-needed","product":"pipingrock.com","severity":"medium","severityNote":"2.1M accounts","slug":"pipingrock-data-breach","stacks":[],"startedAt":"2024-04-26","status":"closed","summary":"In April 2024, 2.1M email addresses from the online health products store Piping Rock were publicly posted to a popular hacking forum. The data also included names, phone numbers and physical addresses. The account posting the data had previously posted multiple other data breaches which all appear to have been obtained from the Shopify service used by the respective websites. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Apr 24, 2024; Have I Been Pwned loaded it on Apr 26, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Piping Rock data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/pipingrock-data-breach","vendor":"Piping Rock"},{"auto":true,"category":"patch","closedAt":"2024-05-08","cveIds":["CVE-2024-4040"],"exploited":"in-the-wild","identifiers":["CVE-2024-4040"],"json":"https://helix.ml/threat-watch/i/crushftp-crushftp-cve-2024-4040.json","latestUpdate":{"date":"2024-04-24","title":"CISA added CVE-2024-4040 to the Known Exploited Vulnerabilities catalog (federal remediation due May 1, 2024)"},"patchStatus":"patched","product":"CrushFTP","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"crushftp-crushftp-cve-2024-4040","stacks":[],"startedAt":"2024-04-24","status":"closed","summary":"CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). CISA added CVE-2024-4040 to its Known Exploited Vulnerabilities catalog on Apr 24, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1336"],"title":"CrushFTP VFS Sandbox Escape Vulnerability (CVE-2024-4040)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/crushftp-crushftp-cve-2024-4040","vendor":"CrushFTP"},{"auto":true,"category":"patch","closedAt":"2024-05-08","cveIds":["CVE-2024-20359"],"exploited":"in-the-wild","identifiers":["CVE-2024-20359"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20359.json","latestUpdate":{"date":"2024-04-24","title":"CISA added CVE-2024-20359 to the Known Exploited Vulnerabilities catalog (federal remediation due May 1, 2024)"},"patchStatus":"unknown","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","severity":"medium","severityNote":"CVSS 6.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20359","stacks":["network"],"startedAt":"2024-04-24","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root. CISA added CVE-2024-20359 to its Known Exploited Vulnerabilities catalog on Apr 24, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-94"],"title":"Cisco ASA and FTD Privilege Escalation Vulnerability (CVE-2024-20359)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20359","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2024-05-08","cveIds":["CVE-2024-20353"],"exploited":"in-the-wild","identifiers":["CVE-2024-20353"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20353.json","latestUpdate":{"date":"2024-04-24","title":"CISA added CVE-2024-20353 to the Known Exploited Vulnerabilities catalog (federal remediation due May 1, 2024)"},"patchStatus":"unknown","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20353","stacks":["network"],"startedAt":"2024-04-24","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition. CISA added CVE-2024-20353 to its Known Exploited Vulnerabilities catalog on Apr 24, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-835"],"title":"Cisco ASA and FTD Denial of Service Vulnerability (CVE-2024-20353)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2024-20353","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2024-05-07","cveIds":["CVE-2022-38028"],"exploited":"in-the-wild","identifiers":["CVE-2022-38028"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-38028.json","latestUpdate":{"date":"2024-04-23","title":"CISA added CVE-2022-38028 to the Known Exploited Vulnerabilities catalog (federal remediation due May 14, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-38028","stacks":["windows"],"startedAt":"2024-04-23","status":"closed","summary":"Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions. CISA added CVE-2022-38028 to its Known Exploited Vulnerabilities catalog on Apr 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability (CVE-2022-38028)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-38028","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-05-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:T2"],"json":"https://helix.ml/threat-watch/i/t2-data-breach.json","latestUpdate":{"date":"2024-04-22","title":"Have I Been Pwned loaded 94K breached T2 accounts"},"patchStatus":"no-fix-needed","product":"t2tea.com","severity":"high","severityNote":"94K accounts · passwords exposed","slug":"t2-data-breach","stacks":[],"startedAt":"2024-04-22","status":"closed","summary":"In April 2024, 95k records from the T2 tea store were posted to a popular hacking forum. Data included email and physical addresses, names, phone numbers, dates of birth, purchases and passwords stored as scrypt hashes. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses, purchases, salutations. The breach dates from Apr 17, 2024; Have I Been Pwned loaded it on Apr 22, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","purchases","salutations"],"title":"T2 data breach: 94K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/t2-data-breach","vendor":"T2"},{"auto":true,"category":"breach","closedAt":"2024-05-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LESLIPFRANCAIS"],"json":"https://helix.ml/threat-watch/i/leslipfrancais-data-breach.json","latestUpdate":{"date":"2024-04-18","title":"Have I Been Pwned loaded 1.5M breached Le Slip Français accounts"},"patchStatus":"no-fix-needed","product":"leslipfrancais.fr","severity":"medium","severityNote":"1.5M accounts","slug":"leslipfrancais-data-breach","stacks":[],"startedAt":"2024-04-18","status":"closed","summary":"In April 2024, the French underwear maker Le Slip Français suffered a data breach. The breach included 1.5M email addresses, physical addresses, names and phone numbers. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Apr 13, 2024; Have I Been Pwned loaded it on Apr 18, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Le Slip Français data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/leslipfrancais-data-breach","vendor":"Le Slip Français"},{"auto":true,"category":"patch","closedAt":"2024-04-26","cveIds":["CVE-2024-3400"],"exploited":"in-the-wild","identifiers":["CVE-2024-3400"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-3400.json","latestUpdate":{"date":"2024-04-12","title":"CISA added CVE-2024-3400 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 19, 2024)"},"patchStatus":"unknown","product":"PAN-OS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2024-3400","stacks":["network"],"startedAt":"2024-04-12","status":"closed","summary":"Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. CISA added CVE-2024-3400 to its Known Exploited Vulnerabilities catalog on Apr 12, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-77"],"title":"Palo Alto Networks PAN-OS Command Injection Vulnerability (CVE-2024-3400)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2024-3400","vendor":"Palo Alto Networks"},{"auto":true,"category":"breach","closedAt":"2024-04-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GIANTTIGER"],"json":"https://helix.ml/threat-watch/i/gianttiger-data-breach.json","latestUpdate":{"date":"2024-04-12","title":"Have I Been Pwned loaded 2.8M breached Giant Tiger accounts"},"patchStatus":"no-fix-needed","product":"gianttiger.com","severity":"medium","severityNote":"2.8M accounts","slug":"gianttiger-data-breach","stacks":[],"startedAt":"2024-04-12","status":"closed","summary":"In March 2024, Canadian discount store Giant Tiger suffered a data breach that exposed 2.8M customer records. Attributed to a vendor of the retailer, the breach included physical and email addresses, names and phone numbers. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Mar 4, 2024; Have I Been Pwned loaded it on Apr 12, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Giant Tiger data breach: 2.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gianttiger-data-breach","vendor":"Giant Tiger"},{"auto":true,"category":"patch","closedAt":"2024-04-25","cveIds":["CVE-2024-3273"],"exploited":"in-the-wild","identifiers":["CVE-2024-3273"],"json":"https://helix.ml/threat-watch/i/d-link-multiple-nas-devices-cve-2024-3273.json","latestUpdate":{"date":"2024-04-11","title":"CISA added CVE-2024-3273 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2024)"},"patchStatus":"unpatched","product":"Multiple NAS Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-multiple-nas-devices-cve-2024-3273","stacks":["network"],"startedAt":"2024-04-11","status":"closed","summary":"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. CISA added CVE-2024-3273 to its Known Exploited Vulnerabilities catalog on Apr 11, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"D-Link Multiple NAS Devices Command Injection Vulnerability (CVE-2024-3273)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-multiple-nas-devices-cve-2024-3273","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2024-04-25","cveIds":["CVE-2024-3272"],"exploited":"in-the-wild","identifiers":["CVE-2024-3272"],"json":"https://helix.ml/threat-watch/i/d-link-multiple-nas-devices-cve-2024-3272.json","latestUpdate":{"date":"2024-04-11","title":"CISA added CVE-2024-3272 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2024)"},"patchStatus":"unpatched","product":"Multiple NAS Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-multiple-nas-devices-cve-2024-3272","stacks":["network"],"startedAt":"2024-04-11","status":"closed","summary":"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution. CISA added CVE-2024-3272 to its Known Exploited Vulnerabilities catalog on Apr 11, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","hard-coded-credentials","cwe-798"],"title":"D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability (CVE-2024-3272)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-multiple-nas-devices-cve-2024-3272","vendor":"D-Link"},{"auto":true,"category":"breach","closedAt":"2024-04-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SALVADORANCITIZENS"],"json":"https://helix.ml/threat-watch/i/salvadorancitizens-data-breach.json","latestUpdate":{"date":"2024-04-10","title":"Have I Been Pwned loaded 946K breached Salvadoran Citizens accounts"},"patchStatus":"no-fix-needed","product":"Salvadoran Citizens","severity":"medium","severityNote":"946K accounts","slug":"salvadorancitizens-data-breach","stacks":[],"startedAt":"2024-04-10","status":"closed","summary":"In April 2024, nearly 6 million records of Salvadoran citizens were published to a popular hacking forum. The data included names, dates of birth, phone numbers, physical addresses and nearly 1M unique email addresses. Further, over 5M corresponding profile photos were also included in the breach. Exposed data: dates of birth, email addresses, government issued ids, names, phone numbers, physical addresses, profile photos. The breach dates from Apr 2, 2024; Have I Been Pwned loaded it on Apr 10, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","government-issued-ids","names","phone-numbers","physical-addresses","profile-photos"],"title":"Salvadoran Citizens data breach: 946K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/salvadorancitizens-data-breach","vendor":"Salvadoran Citizens"},{"auto":true,"category":"breach","closedAt":"2024-04-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KASPERSKYCLUB"],"json":"https://helix.ml/threat-watch/i/kasperskyclub-data-breach.json","latestUpdate":{"date":"2024-04-09","title":"Have I Been Pwned loaded 55K breached Kaspersky Club accounts"},"patchStatus":"no-fix-needed","product":"kasperskyclub.ru","severity":"high","severityNote":"55K accounts · passwords exposed","slug":"kasperskyclub-data-breach","stacks":[],"startedAt":"2024-04-09","status":"closed","summary":"In March 2024, the independent fan forum Kaspersky Club suffered a data breach. The incident exposed 56k unique email addresses alongside usernames, IP addresses and passwords stored as either MD5 or bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Mar 24, 2024; Have I Been Pwned loaded it on Apr 9, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Kaspersky Club data breach: 55K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/kasperskyclub-data-breach","vendor":"Kaspersky Club"},{"auto":true,"category":"breach","closedAt":"2024-04-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOAT"],"json":"https://helix.ml/threat-watch/i/boat-data-breach.json","latestUpdate":{"date":"2024-04-08","title":"Have I Been Pwned loaded 7.5M breached boAt accounts"},"patchStatus":"no-fix-needed","product":"boat-lifestyle.com","severity":"medium","severityNote":"7.5M accounts","slug":"boat-data-breach","stacks":[],"startedAt":"2024-04-08","status":"closed","summary":"In March 2024, the Indian audio and wearables brand boAt suffered a data breach that exposed 7.5M customer records. The data included physical and email address, names and phone numbers, all of which were subsequently published to a popular clear web hacking forum. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Mar 25, 2024; Have I Been Pwned loaded it on Apr 8, 2024.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"boAt data breach: 7.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/boat-data-breach","vendor":"boAt"},{"auto":true,"category":"patch","closedAt":"2024-04-18","cveIds":["CVE-2024-29748"],"exploited":"in-the-wild","identifiers":["CVE-2024-29748"],"json":"https://helix.ml/threat-watch/i/android-pixel-cve-2024-29748.json","latestUpdate":{"date":"2024-04-04","title":"CISA added CVE-2024-29748 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 25, 2024)"},"patchStatus":"unknown","product":"Pixel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-pixel-cve-2024-29748","stacks":["android"],"startedAt":"2024-04-04","status":"closed","summary":"Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app. CISA added CVE-2024-29748 to its Known Exploited Vulnerabilities catalog on Apr 4, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-280"],"title":"Android Pixel Privilege Escalation Vulnerability (CVE-2024-29748)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-pixel-cve-2024-29748","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2024-04-18","cveIds":["CVE-2024-29745"],"exploited":"in-the-wild","identifiers":["CVE-2024-29745"],"json":"https://helix.ml/threat-watch/i/android-pixel-cve-2024-29745.json","latestUpdate":{"date":"2024-04-04","title":"CISA added CVE-2024-29745 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 25, 2024)"},"patchStatus":"unknown","product":"Pixel","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-pixel-cve-2024-29745","stacks":["android"],"startedAt":"2024-04-04","status":"closed","summary":"Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices. CISA added CVE-2024-29745 to its Known Exploited Vulnerabilities catalog on Apr 4, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-908"],"title":"Android Pixel Information Disclosure Vulnerability (CVE-2024-29745)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-pixel-cve-2024-29745","vendor":"Android"},{"auto":true,"category":"breach","closedAt":"2024-04-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SURVEYLAMA"],"json":"https://helix.ml/threat-watch/i/surveylama-data-breach.json","latestUpdate":{"date":"2024-04-02","title":"Have I Been Pwned loaded 4.4M breached SurveyLama accounts"},"patchStatus":"no-fix-needed","product":"surveylama.com","severity":"high","severityNote":"4.4M accounts · passwords exposed","slug":"surveylama-data-breach","stacks":[],"startedAt":"2024-04-02","status":"closed","summary":"In February 2024, the paid survey website SurveyLama suffered a data breach that exposed 4.4M customer email addresses. The incident also exposed names, physical and IP addresses, phone numbers, dates of birth and passwords stored as either salted SHA-1, bcrypt or argon2 hashes. When contacted about the incident, SurveyLama advised that they had already \"notified the users by email\". Exposed data: dates of birth, email addresses, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Feb 1, 2024; Have I Been Pwned loaded it on Apr 2, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"SurveyLama data breach: 4.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/surveylama-data-breach","vendor":"SurveyLama"},{"auto":true,"category":"breach","closedAt":"2024-04-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PANDABUY"],"json":"https://helix.ml/threat-watch/i/pandabuy-data-breach.json","latestUpdate":{"date":"2024-04-01","title":"Have I Been Pwned loaded 1.3M breached Pandabuy accounts"},"patchStatus":"no-fix-needed","product":"pandabuy.com","severity":"medium","severityNote":"1.3M accounts","slug":"pandabuy-data-breach","stacks":[],"startedAt":"2024-04-01","status":"closed","summary":"In March 2024, 1.3M unique email addresses from the online store for purchasing goods from China, Pandabuy, were posted to a popular hacking forum. The data also included IP and physical addresses, names, phone numbers and order enquiries. The breach was alleged to be attributed to \"Sanggiero\" and \"IntelBroker\". Exposed data: email addresses, ip addresses, names, phone numbers, physical addresses. The breach dates from Mar 31, 2024; Have I Been Pwned loaded it on Apr 1, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","phone-numbers","physical-addresses"],"title":"Pandabuy data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/pandabuy-data-breach","vendor":"Pandabuy"},{"auto":true,"category":"breach","closedAt":"2024-04-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WASHINGTONSTATEFOODWORKERCARD"],"json":"https://helix.ml/threat-watch/i/washingtonstatefoodworkercard-data-breach.json","latestUpdate":{"date":"2024-03-31","title":"Have I Been Pwned loaded 1.6M breached Washington State Food Worker Card accounts"},"patchStatus":"no-fix-needed","product":"foodworkercard.wa.gov","severity":"medium","severityNote":"1.6M accounts","slug":"washingtonstatefoodworkercard-data-breach","stacks":[],"startedAt":"2024-03-31","status":"closed","summary":"In June 2023, the Tacoma-Pierce County Health Department announced a data breach of their Washington State Food Worker Card online training system. The breach was published to a popular hacking forum the year before and dated back to a 2018 database backup. Included in the data were 1.6M unique email addresses along with names, post codes, dates of birth and approximately 9.5k driver's licence numbers. Exposed data: dates of birth, driver's licenses, email addresses, geographic locations, names. The breach dates from Nov 17, 2022; Have I Been Pwned loaded it on Mar 31, 2024.","tags":["data-breach","hibp","dates-of-birth","driver-s-licenses","email-addresses","geographic-locations","names"],"title":"Washington State Food Worker Card data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/washingtonstatefoodworkercard-data-breach","vendor":"Washington State Food Worker Card"},{"auto":true,"category":"breach","closedAt":"2024-04-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ECB"],"json":"https://helix.ml/threat-watch/i/ecb-data-breach.json","latestUpdate":{"date":"2024-03-29","title":"Have I Been Pwned loaded 43K breached England Cricket accounts"},"patchStatus":"no-fix-needed","product":"ecb.co.uk","severity":"high","severityNote":"43K accounts · passwords exposed","slug":"ecb-data-breach","stacks":[],"startedAt":"2024-03-29","status":"closed","summary":"In March 2024, English Cricket's icoachcricket website suffered a data breach that exposed over 40k records. The data included email addresses and passwords stored as either bcrypt hashes, salted MD5 hashes or both. Exposed data: email addresses, passwords. The breach dates from Mar 23, 2024; Have I Been Pwned loaded it on Mar 29, 2024.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"England Cricket data breach: 43K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ecb-data-breach","vendor":"England Cricket"},{"auto":true,"category":"breach","closedAt":"2024-04-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EXVAGOS"],"json":"https://helix.ml/threat-watch/i/exvagos-data-breach.json","latestUpdate":{"date":"2024-03-28","title":"Have I Been Pwned loaded 2.1M breached Exvagos accounts"},"patchStatus":"no-fix-needed","product":"exvagos.org","severity":"high","severityNote":"2.1M accounts · passwords exposed","slug":"exvagos-data-breach","stacks":[],"startedAt":"2024-03-28","status":"closed","summary":"In July 2022, the direct download website Exvagos suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 2.1M unique email addresses along with IP addresses, usernames, dates of birth and MD5 password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jul 21, 2022; Have I Been Pwned loaded it on Mar 28, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Exvagos data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/exvagos-data-breach","vendor":"Exvagos"},{"auto":true,"category":"breach","closedAt":"2024-04-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GSMHOSTING"],"json":"https://helix.ml/threat-watch/i/gsmhosting-data-breach.json","latestUpdate":{"date":"2024-03-27","title":"Have I Been Pwned loaded 2.6M breached GSM Hosting accounts"},"patchStatus":"no-fix-needed","product":"gsmhosting.com","severity":"high","severityNote":"2.6M accounts · passwords exposed","slug":"gsmhosting-data-breach","stacks":[],"startedAt":"2024-03-27","status":"closed","summary":"In August 2016, breached data from the vBulletin forum for GSM-Hosting appeared for sale alongside dozens of other hacked services. The breach impacted 2.6M users of the service and included email and IP addresses, usernames and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Aug 1, 2016; Have I Been Pwned loaded it on Mar 27, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"GSM Hosting data breach: 2.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gsmhosting-data-breach","vendor":"GSM Hosting"},{"auto":true,"category":"patch","closedAt":"2024-04-09","cveIds":["CVE-2023-24955"],"exploited":"in-the-wild","identifiers":["CVE-2023-24955"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2023-24955.json","latestUpdate":{"date":"2024-03-26","title":"CISA added CVE-2023-24955 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 16, 2024)"},"patchStatus":"patched","product":"SharePoint Server","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-server-cve-2023-24955","stacks":["windows"],"startedAt":"2024-03-26","status":"closed","summary":"Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely. CISA added CVE-2023-24955 to its Known Exploited Vulnerabilities catalog on Mar 26, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Microsoft SharePoint Server Code Injection Vulnerability (CVE-2023-24955)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2023-24955","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-04-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SWORDFANTASY"],"json":"https://helix.ml/threat-watch/i/swordfantasy-data-breach.json","latestUpdate":{"date":"2024-03-26","title":"Have I Been Pwned loaded 2.7M breached SwordFantasy accounts"},"patchStatus":"no-fix-needed","product":"swordfantasy.com","severity":"high","severityNote":"2.7M accounts · passwords exposed","slug":"swordfantasy-data-breach","stacks":[],"startedAt":"2024-03-26","status":"closed","summary":"In January 2019, the now defunct MMO and RPG game SwordFantasy suffered a data breach that exposed 2.7M unique email addresses. Other impacted data included username, IP address and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 20, 2017; Have I Been Pwned loaded it on Mar 26, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"SwordFantasy data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/swordfantasy-data-breach","vendor":"SwordFantasy"},{"auto":true,"category":"patch","closedAt":"2024-04-08","cveIds":["CVE-2019-7256"],"exploited":"in-the-wild","identifiers":["CVE-2019-7256"],"json":"https://helix.ml/threat-watch/i/nice-linear-emerge-e3-series-cve-2019-7256.json","latestUpdate":{"date":"2024-03-25","title":"CISA added CVE-2019-7256 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2024)"},"patchStatus":"unknown","product":"Linear eMerge E3-Series","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nice-linear-emerge-e3-series-cve-2019-7256","stacks":[],"startedAt":"2024-03-25","status":"closed","summary":"Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution. CISA added CVE-2019-7256 to its Known Exploited Vulnerabilities catalog on Mar 25, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Nice Linear eMerge E3-Series OS Command Injection Vulnerability (CVE-2019-7256)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/nice-linear-emerge-e3-series-cve-2019-7256","vendor":"Nice"},{"auto":true,"category":"patch","closedAt":"2024-04-08","cveIds":["CVE-2021-44529"],"exploited":"in-the-wild","identifiers":["CVE-2021-44529"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-cloud-service-appliance-epm-csa-cve-2021-44529.json","latestUpdate":{"date":"2024-03-25","title":"CISA added CVE-2021-44529 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2024)"},"patchStatus":"patched","product":"Endpoint Manager Cloud Service Appliance (EPM CSA)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-cloud-service-appliance-epm-csa-cve-2021-44529","stacks":[],"startedAt":"2024-03-25","status":"closed","summary":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). CISA added CVE-2021-44529 to its Known Exploited Vulnerabilities catalog on Mar 25, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability (CVE-2021-44529)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-cloud-service-appliance-epm-csa-cve-2021-44529","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2024-04-08","cveIds":["CVE-2023-48788"],"exploited":"in-the-wild","identifiers":["CVE-2023-48788"],"json":"https://helix.ml/threat-watch/i/fortinet-forticlient-ems-cve-2023-48788.json","latestUpdate":{"date":"2024-03-25","title":"CISA added CVE-2023-48788 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2024)"},"patchStatus":"unknown","product":"FortiClient EMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-forticlient-ems-cve-2023-48788","stacks":["network"],"startedAt":"2024-03-25","status":"closed","summary":"Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. CISA added CVE-2023-48788 to its Known Exploited Vulnerabilities catalog on Mar 25, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"Fortinet FortiClient EMS SQL Injection Vulnerability (CVE-2023-48788)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-forticlient-ems-cve-2023-48788","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2024-04-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MEDIAWORKS"],"json":"https://helix.ml/threat-watch/i/mediaworks-data-breach.json","latestUpdate":{"date":"2024-03-22","title":"Have I Been Pwned loaded 162K breached MediaWorks accounts"},"patchStatus":"no-fix-needed","product":"mediaworks.co.nz","severity":"medium","severityNote":"162K accounts","slug":"mediaworks-data-breach","stacks":[],"startedAt":"2024-03-22","status":"closed","summary":"In March 2024, millions of rows of data from the New Zealand media company MediaWorks was publicly posted to a popular hacking forum. The incident exposed 163k unique email addresses provided by visitors who filled out online competitions and included names, physical addresses, phone numbers, dates of birth, genders and the responses to questions in the competition. Some victims of the breach subsequently received ransom demands requesting payment to have their data deleted. Exposed data: dates of birth, email addresses, genders, phone numbers, physical addresses. The breach dates from Mar 15, 2023; Have I Been Pwned loaded it on Mar 22, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","phone-numbers","physical-addresses"],"title":"MediaWorks data breach: 162K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mediaworks-data-breach","vendor":"MediaWorks"},{"auto":true,"category":"breach","closedAt":"2024-04-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ALLEGEDATT"],"json":"https://helix.ml/threat-watch/i/allegedatt-data-breach.json","latestUpdate":{"date":"2024-03-19","title":"Have I Been Pwned loaded 49.1M breached AT\u0026T accounts"},"patchStatus":"no-fix-needed","product":"AT\u0026T","severity":"medium","severityNote":"49.1M accounts","slug":"allegedatt-data-breach","stacks":[],"startedAt":"2024-03-19","status":"closed","summary":"In March 2024, tens of millions of records allegedly breached from AT\u0026T were posted to a popular hacking forum. Dating back to August 2021, the data was originally posted for sale before later being freely released. At the time, AT\u0026T maintained that there had not been a breach of their systems and that the data originated from elsewhere. 12 days later, AT\u0026T acknowledged that data fields specific to them were in the breach and that it was not yet known whether the breach occurred at their end or that of a vendor. AT\u0026T also proceeded to reset customer account passcodes, an indicator that there was sufficient belief passcodes had been compromised. The incident exposed names, email and physical addresses, dates of birth, phone numbers and US social security numbers. Exposed data: dates of birth, email addresses, government issued ids, names, phone numbers, physical addresses. The breach dates from Aug 20, 2021; Have I Been Pwned loaded it on Mar 19, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","government-issued-ids","names","phone-numbers","physical-addresses"],"title":"AT\u0026T data breach: 49.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/allegedatt-data-breach","vendor":"AT\u0026T"},{"auto":true,"category":"breach","closedAt":"2024-03-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CLICKASNAP"],"json":"https://helix.ml/threat-watch/i/clickasnap-data-breach.json","latestUpdate":{"date":"2024-03-13","title":"Have I Been Pwned loaded 3.3M breached ClickASnap accounts"},"patchStatus":"no-fix-needed","product":"clickasnap.com","severity":"high","severityNote":"3.3M accounts · passwords exposed","slug":"clickasnap-data-breach","stacks":[],"startedAt":"2024-03-13","status":"closed","summary":"In September 2022, the online photo sharing platform ClickASnap suffered a data breach. The incident exposed almost 3.3M personal records including email addresses, usernames and passwords stored as SHA-512 hashes. Further, a collection of paid subscriptions were also included and contained names, physical addresses and amounts paid. Exposed data: email addresses, names, passwords, physical addresses, purchases, social media profiles, usernames. The breach dates from Sep 24, 2022; Have I Been Pwned loaded it on Mar 13, 2024.","tags":["data-breach","hibp","email-addresses","names","passwords","physical-addresses","purchases","social-media-profiles","usernames"],"title":"ClickASnap data breach: 3.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/clickasnap-data-breach","vendor":"ClickASnap"},{"auto":true,"category":"breach","closedAt":"2024-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:APKTW"],"json":"https://helix.ml/threat-watch/i/apktw-data-breach.json","latestUpdate":{"date":"2024-03-09","title":"Have I Been Pwned loaded 2.5M breached APK.TW accounts"},"patchStatus":"no-fix-needed","product":"apk.tw","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"apktw-data-breach","stacks":[],"startedAt":"2024-03-09","status":"closed","summary":"In September 2022, the Taiwanese Android forum APK.TW suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 2.5M unique email addresses along with IP addresses, usernames and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 3, 2022; Have I Been Pwned loaded it on Mar 9, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"APK.TW data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/apktw-data-breach","vendor":"APK.TW"},{"auto":true,"category":"patch","closedAt":"2024-03-21","cveIds":["CVE-2024-27198"],"exploited":"in-the-wild","identifiers":["CVE-2024-27198"],"json":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2024-27198.json","latestUpdate":{"date":"2024-03-07","title":"CISA added CVE-2024-27198 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 28, 2024)"},"patchStatus":"unknown","product":"TeamCity","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jetbrains-teamcity-cve-2024-27198","stacks":["devtools"],"startedAt":"2024-03-07","status":"closed","summary":"JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. CISA added CVE-2024-27198 to its Known Exploited Vulnerabilities catalog on Mar 7, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-288"],"title":"JetBrains TeamCity Authentication Bypass Vulnerability (CVE-2024-27198)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2024-27198","vendor":"JetBrains"},{"auto":true,"category":"breach","closedAt":"2024-03-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WOTLABS"],"json":"https://helix.ml/threat-watch/i/wotlabs-data-breach.json","latestUpdate":{"date":"2024-03-07","title":"Have I Been Pwned loaded 21K breached WoTLabs accounts"},"patchStatus":"no-fix-needed","product":"wotlabs.net","severity":"medium","severityNote":"21K accounts","slug":"wotlabs-data-breach","stacks":[],"startedAt":"2024-03-07","status":"closed","summary":"In March 2024, WoTLabs (World of Tanks Statistics and Resources) suffered a data breach and website defacement attributed to \"chromebook breachers\". The breach exposed 22k forum members' personal data including email and IP addresses, usernames, dates of birth and time zones. Exposed data: dates of birth, email addresses, ip addresses, time zones, usernames. The breach dates from Mar 3, 2024; Have I Been Pwned loaded it on Mar 7, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","time-zones","usernames"],"title":"WoTLabs data breach: 21K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/wotlabs-data-breach","vendor":"WoTLabs"},{"auto":true,"category":"breach","closedAt":"2024-03-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ONLINETRADE"],"json":"https://helix.ml/threat-watch/i/onlinetrade-data-breach.json","latestUpdate":{"date":"2024-03-07","title":"Have I Been Pwned loaded 3.8M breached Online Trade (Онлайн Трейд) accounts"},"patchStatus":"no-fix-needed","product":"onlinetrade.ru","severity":"high","severityNote":"3.8M accounts · passwords exposed","slug":"onlinetrade-data-breach","stacks":[],"startedAt":"2024-03-07","status":"closed","summary":"In September 2022, the Russian e-commerce website Online Trade (Онлайн Трейд) suffered a data breach that exposed 3.8M customer records. The data included email and IP addresses, names, phone numbers, dates of birth and MD5 password hashes. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, phone numbers. The breach dates from Sep 19, 2022; Have I Been Pwned loaded it on Mar 7, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","phone-numbers"],"title":"Online Trade (Онлайн Трейд) data breach: 3.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/onlinetrade-data-breach","vendor":"Online Trade (Онлайн Трейд)"},{"auto":true,"category":"patch","closedAt":"2024-03-20","cveIds":["CVE-2024-23225"],"exploited":"in-the-wild","identifiers":["CVE-2024-23225"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-23225.json","latestUpdate":{"date":"2024-03-06","title":"CISA added CVE-2024-23225 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 27, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2024-23225","stacks":[],"startedAt":"2024-03-06","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CISA added CVE-2024-23225 to its Known Exploited Vulnerabilities catalog on Mar 6, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2024-23225)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-23225","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2024-03-20","cveIds":["CVE-2024-23296"],"exploited":"in-the-wild","identifiers":["CVE-2024-23296"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-23296.json","latestUpdate":{"date":"2024-03-06","title":"CISA added CVE-2024-23296 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 27, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2024-23296","stacks":[],"startedAt":"2024-03-06","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CISA added CVE-2024-23296 to its Known Exploited Vulnerabilities catalog on Mar 6, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2024-23296)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-23296","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2024-03-19","cveIds":["CVE-2023-21237"],"exploited":"in-the-wild","identifiers":["CVE-2023-21237"],"json":"https://helix.ml/threat-watch/i/android-pixel-cve-2023-21237.json","latestUpdate":{"date":"2024-03-05","title":"CISA added CVE-2023-21237 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 26, 2024)"},"patchStatus":"unknown","product":"Pixel","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-pixel-cve-2023-21237","stacks":["android"],"startedAt":"2024-03-05","status":"closed","summary":"Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information. CISA added CVE-2023-21237 to its Known Exploited Vulnerabilities catalog on Mar 5, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Android Pixel Information Disclosure Vulnerability (CVE-2023-21237)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-pixel-cve-2023-21237","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2024-03-19","cveIds":["CVE-2021-36380"],"exploited":"in-the-wild","identifiers":["CVE-2021-36380"],"json":"https://helix.ml/threat-watch/i/sunhillo-sureline-cve-2021-36380.json","latestUpdate":{"date":"2024-03-05","title":"CISA added CVE-2021-36380 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 26, 2024)"},"patchStatus":"unknown","product":"SureLine","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sunhillo-sureline-cve-2021-36380","stacks":[],"startedAt":"2024-03-05","status":"closed","summary":"Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi. CISA added CVE-2021-36380 to its Known Exploited Vulnerabilities catalog on Mar 5, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Sunhillo SureLine OS Command Injection Vulnerablity (CVE-2021-36380)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sunhillo-sureline-cve-2021-36380","vendor":"Sunhillo"},{"auto":true,"category":"patch","closedAt":"2024-03-18","cveIds":["CVE-2024-21338"],"exploited":"in-the-wild","identifiers":["CVE-2024-21338"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-21338.json","latestUpdate":{"date":"2024-03-04","title":"CISA added CVE-2024-21338 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 25, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-21338","stacks":["linux","windows"],"startedAt":"2024-03-04","status":"closed","summary":"Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation. CISA added CVE-2024-21338 to its Known Exploited Vulnerabilities catalog on Mar 4, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-822"],"title":"Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability (CVE-2024-21338)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-21338","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MRGREENGAMING"],"json":"https://helix.ml/threat-watch/i/mrgreengaming-data-breach.json","latestUpdate":{"date":"2024-03-03","title":"Have I Been Pwned loaded 27K breached Mr. Green Gaming accounts"},"patchStatus":"no-fix-needed","product":"mrgreengaming.com","severity":"medium","severityNote":"27K accounts","slug":"mrgreengaming-data-breach","stacks":[],"startedAt":"2024-03-03","status":"closed","summary":"In March 2024, the online games community Mr. Green Gaming suffered a data breach that exposed 27k user records. Acknowledged on their Discord server, the incident exposed email and IP addresses, usernames, geographic locations and dates of birth. Exposed data: dates of birth, email addresses, geographic locations, ip addresses, usernames. The breach dates from Mar 1, 2024; Have I Been Pwned loaded it on Mar 3, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","ip-addresses","usernames"],"title":"Mr. Green Gaming data breach: 27K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mrgreengaming-data-breach","vendor":"Mr. Green Gaming"},{"auto":true,"category":"patch","closedAt":"2024-03-14","cveIds":["CVE-2023-29360"],"exploited":"in-the-wild","identifiers":["CVE-2023-29360"],"json":"https://helix.ml/threat-watch/i/microsoft-streaming-service-cve-2023-29360.json","latestUpdate":{"date":"2024-02-29","title":"CISA added CVE-2023-29360 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 21, 2024)"},"patchStatus":"patched","product":"Streaming Service","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-streaming-service-cve-2023-29360","stacks":["rust"],"startedAt":"2024-02-29","status":"closed","summary":"Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CISA added CVE-2023-29360 to its Known Exploited Vulnerabilities catalog on Feb 29, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-822"],"title":"Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability (CVE-2023-29360)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-streaming-service-cve-2023-29360","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2024-03-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TANGERINE"],"json":"https://helix.ml/threat-watch/i/tangerine-data-breach.json","latestUpdate":{"date":"2024-02-28","title":"Have I Been Pwned loaded 243K breached Tangerine accounts"},"patchStatus":"no-fix-needed","product":"tangerinetelecom.com.au","severity":"high","severityNote":"243K accounts · passwords exposed","slug":"tangerine-data-breach","stacks":[],"startedAt":"2024-02-28","status":"closed","summary":"In February 2024, the Australian Telco Tangerine suffered a data breach that exposed over 200k customer records. Attributed to a legacy customer database, the data included physical and email addresses, names, phone numbers and dates of birth. Whilst the Tangerine login process involves sending a one-time password after entering an email address and phone number, it previously used a traditional password which was also exposed as a bcrypt hash. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses, salutations. The breach dates from Feb 18, 2024; Have I Been Pwned loaded it on Feb 28, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","salutations"],"title":"Tangerine data breach: 243K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tangerine-data-breach","vendor":"Tangerine"},{"auto":true,"category":"breach","closedAt":"2024-03-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CUTOUTPRO"],"json":"https://helix.ml/threat-watch/i/cutoutpro-data-breach.json","latestUpdate":{"date":"2024-02-28","title":"Have I Been Pwned loaded 20.0M breached Cutout.Pro accounts"},"patchStatus":"no-fix-needed","product":"cutout.pro","severity":"high","severityNote":"20.0M accounts · passwords exposed","slug":"cutoutpro-data-breach","stacks":[],"startedAt":"2024-02-28","status":"closed","summary":"In February 2024, the AI-powered visual design platform Cutout.Pro suffered a data breach that exposed 20M records. The data included email and IP addresses, names and salted MD5 password hashes which were subsequently broadly distributed on a popular hacking forum and Telegram channels. Exposed data: email addresses, ip addresses, names, passwords. The breach dates from Feb 26, 2024; Have I Been Pwned loaded it on Feb 28, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords"],"title":"Cutout.Pro data breach: 20.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cutoutpro-data-breach","vendor":"Cutout.Pro"},{"auto":true,"category":"patch","closedAt":"2024-03-07","cveIds":["CVE-2024-1709"],"exploited":"in-the-wild","identifiers":["CVE-2024-1709"],"json":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2024-1709.json","latestUpdate":{"date":"2024-02-22","title":"CISA added CVE-2024-1709 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 29, 2024)"},"patchStatus":"patched","product":"ScreenConnect","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"connectwise-screenconnect-cve-2024-1709","stacks":[],"startedAt":"2024-02-22","status":"closed","summary":"ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices. CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities catalog on Feb 22, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-288"],"title":"ConnectWise ScreenConnect Authentication Bypass Vulnerability (CVE-2024-1709)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/connectwise-screenconnect-cve-2024-1709","vendor":"ConnectWise"},{"auto":true,"category":"breach","closedAt":"2024-03-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FACEBOOKMARKETPLACE"],"json":"https://helix.ml/threat-watch/i/facebookmarketplace-data-breach.json","latestUpdate":{"date":"2024-02-22","title":"Have I Been Pwned loaded 77K breached Facebook Marketplace accounts"},"patchStatus":"no-fix-needed","product":"facebook.com","severity":"high","severityNote":"77K accounts · passwords exposed","slug":"facebookmarketplace-data-breach","stacks":[],"startedAt":"2024-02-22","status":"closed","summary":"In February 2024, 200k Facebook Marketplace records allegedly obtained from a Meta contractor in October 2023 were posted to a popular hacking forum. The data contained 77k unique email addresses alongside names, phone numbers, Facebook profile IDs and geographic locations. The data also contained bcrypt password hashes, although there is no indication these belong to the corresponding Facebook accounts. Exposed data: email addresses, geographic locations, names, passwords, phone numbers, social media profiles. The breach dates from Oct 1, 2023; Have I Been Pwned loaded it on Feb 22, 2024.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","phone-numbers","social-media-profiles"],"title":"Facebook Marketplace data breach: 77K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/facebookmarketplace-data-breach","vendor":"Facebook Marketplace"},{"auto":true,"category":"patch","closedAt":"2024-02-29","cveIds":["CVE-2020-3259"],"exploited":"in-the-wild","identifiers":["CVE-2020-3259"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3259.json","latestUpdate":{"date":"2024-02-15","title":"CISA added CVE-2020-3259 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 7, 2024)"},"patchStatus":"unknown","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3259","stacks":["network"],"startedAt":"2024-02-15","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. CISA added CVE-2020-3259 to its Known Exploited Vulnerabilities catalog on Feb 15, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-200"],"title":"Cisco ASA and FTD Information Disclosure Vulnerability (CVE-2020-3259)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3259","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2024-02-29","cveIds":["CVE-2024-21410"],"exploited":"in-the-wild","identifiers":["CVE-2024-21410"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2024-21410.json","latestUpdate":{"date":"2024-02-15","title":"CISA added CVE-2024-21410 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 7, 2024)"},"patchStatus":"patched","product":"Exchange Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2024-21410","stacks":["windows"],"startedAt":"2024-02-15","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2024-21410 to its Known Exploited Vulnerabilities catalog on Feb 15, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-287"],"title":"Microsoft Exchange Server Privilege Escalation Vulnerability (CVE-2024-21410)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2024-21410","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-02-27","cveIds":["CVE-2024-21412"],"exploited":"in-the-wild","identifiers":["CVE-2024-21412"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-21412.json","latestUpdate":{"date":"2024-02-13","title":"CISA added CVE-2024-21412 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 5, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-21412","stacks":["windows"],"startedAt":"2024-02-13","status":"closed","summary":"Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. CISA added CVE-2024-21412 to its Known Exploited Vulnerabilities catalog on Feb 13, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-693"],"title":"Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability (CVE-2024-21412)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-21412","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-02-27","cveIds":["CVE-2024-21351"],"exploited":"in-the-wild","identifiers":["CVE-2024-21351"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-21351.json","latestUpdate":{"date":"2024-02-13","title":"CISA added CVE-2024-21351 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 5, 2024)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2024-21351","stacks":["windows"],"startedAt":"2024-02-13","status":"closed","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CISA added CVE-2024-21351 to its Known Exploited Vulnerabilities catalog on Feb 13, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-94"],"title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2024-21351)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2024-21351","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-02-26","cveIds":["CVE-2023-43770"],"exploited":"in-the-wild","identifiers":["CVE-2023-43770"],"json":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2023-43770.json","latestUpdate":{"date":"2024-02-12","title":"CISA added CVE-2023-43770 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 4, 2024)"},"patchStatus":"patched","product":"Webmail","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-webmail-cve-2023-43770","stacks":[],"startedAt":"2024-02-12","status":"closed","summary":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages. CISA added CVE-2023-43770 to its Known Exploited Vulnerabilities catalog on Feb 12, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (CVE-2023-43770)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2023-43770","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2024-02-23","cveIds":["CVE-2024-21762"],"exploited":"in-the-wild","identifiers":["CVE-2024-21762"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2024-21762.json","latestUpdate":{"date":"2024-02-09","title":"CISA added CVE-2024-21762 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2024)"},"patchStatus":"unknown","product":"FortiOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2024-21762","stacks":["network","vpn"],"startedAt":"2024-02-09","status":"closed","summary":"Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. CISA added CVE-2024-21762 to its Known Exploited Vulnerabilities catalog on Feb 9, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-787"],"title":"Fortinet FortiOS Out-of-Bound Write Vulnerability (CVE-2024-21762)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2024-21762","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2024-02-20","cveIds":["CVE-2023-4762"],"exploited":"in-the-wild","identifiers":["CVE-2023-4762"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2023-4762.json","latestUpdate":{"date":"2024-02-06","title":"CISA added CVE-2023-4762 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 27, 2024)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2023-4762","stacks":["browser"],"startedAt":"2024-02-06","status":"closed","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2023-4762 to its Known Exploited Vulnerabilities catalog on Feb 6, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2023-4762)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2023-4762","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2024-02-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPOUTIBLE"],"json":"https://helix.ml/threat-watch/i/spoutible-data-breach.json","latestUpdate":{"date":"2024-02-05","title":"Have I Been Pwned loaded 207K breached Spoutible accounts"},"patchStatus":"no-fix-needed","product":"spoutible.com","severity":"high","severityNote":"207K accounts · passwords exposed","slug":"spoutible-data-breach","stacks":[],"startedAt":"2024-02-05","status":"closed","summary":"In January 2024, Spoutible had 207k records scraped from a misconfigured API that inadvertently returned excessive personal information. The data included names, usernames, email and IP addresses, phone numbers (where provided to the platform), genders and bcrypt password hashes. The incident also exposed 2FA secrets and backup codes along with password reset tokens. Exposed data: email addresses, genders, ip addresses, names, passwords, phone numbers, usernames. The breach dates from Jan 31, 2024; Have I Been Pwned loaded it on Feb 5, 2024.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","names","passwords","phone-numbers","usernames"],"title":"Spoutible data breach: 207K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/spoutible-data-breach","vendor":"Spoutible"},{"auto":true,"category":"patch","closedAt":"2024-02-14","cveIds":["CVE-2022-48618"],"exploited":"in-the-wild","identifiers":["CVE-2022-48618"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2022-48618.json","latestUpdate":{"date":"2024-01-31","title":"CISA added CVE-2022-48618 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 21, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2022-48618","stacks":[],"startedAt":"2024-01-31","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. CISA added CVE-2022-48618 to its Known Exploited Vulnerabilities catalog on Jan 31, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-367"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2022-48618)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2022-48618","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2024-02-14","cveIds":["CVE-2024-21893"],"exploited":"in-the-wild","identifiers":["CVE-2024-21893"],"json":"https://helix.ml/threat-watch/i/ivanti-connect-secure-policy-secure-and-neurons-cve-2024-21893.json","latestUpdate":{"date":"2024-01-31","title":"CISA added CVE-2024-21893 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 2, 2024)"},"patchStatus":"unknown","product":"Connect Secure, Policy Secure, and Neurons","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-connect-secure-policy-secure-and-neurons-cve-2024-21893","stacks":["vpn"],"startedAt":"2024-01-31","status":"closed","summary":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication. CISA added CVE-2024-21893 to its Known Exploited Vulnerabilities catalog on Jan 31, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","ssrf","cwe-918"],"title":"Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability (CVE-2024-21893)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-policy-secure-and-neurons-cve-2024-21893","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2024-02-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYPERTAMINA"],"json":"https://helix.ml/threat-watch/i/mypertamina-data-breach.json","latestUpdate":{"date":"2024-01-27","title":"Have I Been Pwned loaded 6.0M breached MyPertamina accounts"},"patchStatus":"no-fix-needed","product":"mypertamina.id","severity":"medium","severityNote":"6.0M accounts","slug":"mypertamina-data-breach","stacks":[],"startedAt":"2024-01-27","status":"closed","summary":"In November 2022, the Indonesian oil and gas company Pertamina suffered a data breach of their MyPertamina service. The incident exposed 44M records with 6M unique email addresses along with names, dates of birth, genders, physical addresses and purchases. Exposed data: dates of birth, email addresses, genders, names, phone numbers, physical addresses, purchases. The breach dates from Nov 1, 2022; Have I Been Pwned loaded it on Jan 27, 2024.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","phone-numbers","physical-addresses","purchases"],"title":"MyPertamina data breach: 6.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/mypertamina-data-breach","vendor":"MyPertamina"},{"auto":true,"category":"patch","closedAt":"2024-02-07","cveIds":["CVE-2023-22527"],"exploited":"in-the-wild","identifiers":["CVE-2023-22527"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json","latestUpdate":{"date":"2024-01-24","title":"CISA added CVE-2023-22527 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 14, 2024)"},"patchStatus":"unknown","product":"Confluence Data Center and Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-data-center-and-server-cve-2023-22527","stacks":["devtools","java"],"startedAt":"2024-01-24","status":"closed","summary":"Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. CISA added CVE-2023-22527 to its Known Exploited Vulnerabilities catalog on Jan 24, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-74"],"title":"Atlassian Confluence Data Center and Server Template Injection Vulnerability (CVE-2023-22527)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2024-02-06","cveIds":["CVE-2024-23222"],"exploited":"in-the-wild","identifiers":["CVE-2024-23222"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-23222.json","latestUpdate":{"date":"2024-01-23","title":"CISA added CVE-2024-23222 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 13, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2024-23222","stacks":["browser","ios"],"startedAt":"2024-01-23","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2024-23222 to its Known Exploited Vulnerabilities catalog on Jan 23, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Apple Multiple Products WebKit Type Confusion Vulnerability (CVE-2024-23222)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2024-23222","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2024-02-05","cveIds":["CVE-2023-34048"],"exploited":"in-the-wild","identifiers":["CVE-2023-34048"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2023-34048.json","latestUpdate":{"date":"2024-01-22","title":"CISA added CVE-2023-34048 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 12, 2024)"},"patchStatus":"unknown","product":"vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2023-34048","stacks":["cloud"],"startedAt":"2024-01-22","status":"closed","summary":"VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. CISA added CVE-2023-34048 to its Known Exploited Vulnerabilities catalog on Jan 22, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"VMware vCenter Server Out-of-Bounds Write Vulnerability (CVE-2023-34048)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2023-34048","vendor":"VMware"},{"auto":true,"category":"breach","closedAt":"2024-02-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRELLO"],"json":"https://helix.ml/threat-watch/i/trello-data-breach.json","latestUpdate":{"date":"2024-01-22","title":"Have I Been Pwned loaded 15.1M breached Trello accounts"},"patchStatus":"no-fix-needed","product":"trello.com","severity":"medium","severityNote":"15.1M accounts","slug":"trello-data-breach","stacks":[],"startedAt":"2024-01-22","status":"closed","summary":"In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred. Exposed data: email addresses, names, usernames. The breach dates from Jan 16, 2024; Have I Been Pwned loaded it on Jan 22, 2024.","tags":["data-breach","hibp","email-addresses","names","usernames"],"title":"Trello data breach: 15.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/trello-data-breach","vendor":"Trello"},{"auto":true,"category":"patch","closedAt":"2024-02-01","cveIds":["CVE-2023-35082"],"exploited":"in-the-wild","identifiers":["CVE-2023-35082"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-core-cve-2023-35082.json","latestUpdate":{"date":"2024-01-18","title":"CISA added CVE-2023-35082 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 8, 2024)"},"patchStatus":"unknown","product":"Endpoint Manager Mobile (EPMM) and MobileIron Core","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-and-mobileiron-core-cve-2023-35082","stacks":[],"startedAt":"2024-01-18","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. CISA added CVE-2023-35082 to its Known Exploited Vulnerabilities catalog on Jan 18, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-287"],"title":"Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability (CVE-2023-35082)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-core-cve-2023-35082","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2024-01-31","cveIds":["CVE-2024-0519"],"exploited":"in-the-wild","identifiers":["CVE-2024-0519"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-0519.json","latestUpdate":{"date":"2024-01-17","title":"CISA added CVE-2024-0519 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 7, 2024)"},"patchStatus":"unknown","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2024-0519","stacks":["browser"],"startedAt":"2024-01-17","status":"closed","summary":"Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2024-0519 to its Known Exploited Vulnerabilities catalog on Jan 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium V8 Out-of-Bounds Memory Access Vulnerability (CVE-2024-0519)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2024-0519","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2024-01-31","cveIds":["CVE-2023-6549"],"exploited":"in-the-wild","identifiers":["CVE-2023-6549"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-6549.json","latestUpdate":{"date":"2024-01-17","title":"CISA added CVE-2023-6549 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 7, 2024)"},"patchStatus":"unknown","product":"NetScaler ADC and NetScaler Gateway","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-adc-and-netscaler-gateway-cve-2023-6549","stacks":["cloud","vpn"],"startedAt":"2024-01-17","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. CISA added CVE-2023-6549 to its Known Exploited Vulnerabilities catalog on Jan 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability (CVE-2023-6549)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-6549","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2024-01-31","cveIds":["CVE-2023-6548"],"exploited":"in-the-wild","identifiers":["CVE-2023-6548"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-6548.json","latestUpdate":{"date":"2024-01-17","title":"CISA added CVE-2023-6548 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 24, 2024)"},"patchStatus":"unknown","product":"NetScaler ADC and NetScaler Gateway","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-adc-and-netscaler-gateway-cve-2023-6548","stacks":["cloud","vpn"],"startedAt":"2024-01-17","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP. CISA added CVE-2023-6548 to its Known Exploited Vulnerabilities catalog on Jan 17, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability (CVE-2023-6548)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-6548","vendor":"Citrix"},{"auto":true,"category":"breach","closedAt":"2024-01-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NAZAPI"],"json":"https://helix.ml/threat-watch/i/nazapi-data-breach.json","latestUpdate":{"date":"2024-01-17","title":"Have I Been Pwned loaded 70.8M breached Naz.API accounts"},"patchStatus":"no-fix-needed","product":"Naz.API","severity":"high","severityNote":"70.8M accounts · passwords exposed","slug":"nazapi-data-breach","stacks":[],"startedAt":"2024-01-17","status":"closed","summary":"In September 2023, over 100GB of stealer logs and credential stuffing lists titled \"Naz.API\" was posted to a popular hacking forum. The incident contained a combination of email address and plain text password pairs alongside the service they were entered into, and standalone credential pairs obtained from unnamed sources. In total, the corpus of data included 71M unique email addresses and 100M unique passwords. Exposed data: email addresses, passwords. The breach dates from Sep 20, 2023; Have I Been Pwned loaded it on Jan 17, 2024.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Naz.API data breach: 70.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/nazapi-data-breach","vendor":"Naz.API"},{"auto":true,"category":"patch","closedAt":"2024-01-30","cveIds":["CVE-2018-15133"],"exploited":"in-the-wild","identifiers":["CVE-2018-15133"],"json":"https://helix.ml/threat-watch/i/laravel-laravel-framework-cve-2018-15133.json","latestUpdate":{"date":"2024-01-16","title":"CISA added CVE-2018-15133 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 6, 2024)"},"patchStatus":"unknown","product":"Laravel Framework","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"laravel-laravel-framework-cve-2018-15133","stacks":["php","rust"],"startedAt":"2024-01-16","status":"closed","summary":"Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable). CISA added CVE-2018-15133 to its Known Exploited Vulnerabilities catalog on Jan 16, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Laravel Deserialization of Untrusted Data Vulnerability (CVE-2018-15133)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/laravel-laravel-framework-cve-2018-15133","vendor":"Laravel"},{"auto":true,"category":"breach","closedAt":"2024-01-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HATHWAY"],"json":"https://helix.ml/threat-watch/i/hathway-data-breach.json","latestUpdate":{"date":"2024-01-12","title":"Have I Been Pwned loaded 4.7M breached Hathway accounts"},"patchStatus":"no-fix-needed","product":"hathway.com","severity":"high","severityNote":"4.7M accounts · passwords exposed","slug":"hathway-data-breach","stacks":[],"startedAt":"2024-01-12","status":"closed","summary":"In December 2023, hundreds of gigabytes of data allegedly taken from Indian ISP and digital TV provider Hathway appeared on a popular hacking website. The incident exposed extensive personal information including 4.7M unique email addresses along with names, physical and IP addresses, phone numbers, password hashes and support ticket logs. Exposed data: device information, email addresses, ip addresses, names, passwords, phone numbers, physical addresses, salutations, support tickets. The breach dates from Dec 17, 2023; Have I Been Pwned loaded it on Jan 12, 2024.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","salutations","support-tickets"],"title":"Hathway data breach: 4.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/hathway-data-breach","vendor":"Hathway"},{"auto":true,"category":"patch","closedAt":"2024-01-24","cveIds":["CVE-2023-29357"],"exploited":"in-the-wild","identifiers":["CVE-2023-29357"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2023-29357.json","latestUpdate":{"date":"2024-01-10","title":"CISA added CVE-2023-29357 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 31, 2024)"},"patchStatus":"patched","product":"SharePoint Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-server-cve-2023-29357","stacks":["windows"],"startedAt":"2024-01-10","status":"closed","summary":"Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. CISA added CVE-2023-29357 to its Known Exploited Vulnerabilities catalog on Jan 10, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-303"],"title":"Microsoft SharePoint Server Privilege Escalation Vulnerability (CVE-2023-29357)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-server-cve-2023-29357","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2024-01-24","cveIds":["CVE-2023-46805"],"exploited":"in-the-wild","identifiers":["CVE-2023-46805"],"json":"https://helix.ml/threat-watch/i/ivanti-connect-secure-and-policy-secure-cve-2023-46805.json","latestUpdate":{"date":"2024-01-10","title":"CISA added CVE-2023-46805 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 22, 2024)"},"patchStatus":"unknown","product":"Connect Secure and Policy Secure","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-connect-secure-and-policy-secure-cve-2023-46805","stacks":["vpn"],"startedAt":"2024-01-10","status":"closed","summary":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability. CISA added CVE-2023-46805 to its Known Exploited Vulnerabilities catalog on Jan 10, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","auth-bypass","cwe-287"],"title":"Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability (CVE-2023-46805)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-and-policy-secure-cve-2023-46805","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2024-01-24","cveIds":["CVE-2024-21887"],"exploited":"in-the-wild","identifiers":["CVE-2024-21887"],"json":"https://helix.ml/threat-watch/i/ivanti-connect-secure-and-policy-secure-cve-2024-21887.json","latestUpdate":{"date":"2024-01-10","title":"CISA added CVE-2024-21887 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 22, 2024)"},"patchStatus":"unknown","product":"Connect Secure and Policy Secure","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-connect-secure-and-policy-secure-cve-2024-21887","stacks":["vpn"],"startedAt":"2024-01-10","status":"closed","summary":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue. CISA added CVE-2024-21887 to its Known Exploited Vulnerabilities catalog on Jan 10, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-77"],"title":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability (CVE-2024-21887)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-and-policy-secure-cve-2024-21887","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2024-01-22","cveIds":["CVE-2023-23752"],"exploited":"in-the-wild","identifiers":["CVE-2023-23752"],"json":"https://helix.ml/threat-watch/i/joomla-joomla-cve-2023-23752.json","latestUpdate":{"date":"2024-01-08","title":"CISA added CVE-2023-23752 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 29, 2024)"},"patchStatus":"unknown","product":"Joomla!","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"joomla-joomla-cve-2023-23752","stacks":["php"],"startedAt":"2024-01-08","status":"closed","summary":"Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints. CISA added CVE-2023-23752 to its Known Exploited Vulnerabilities catalog on Jan 8, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Joomla! Improper Access Control Vulnerability (CVE-2023-23752)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/joomla-joomla-cve-2023-23752","vendor":"Joomla!"},{"auto":true,"category":"patch","closedAt":"2024-01-22","cveIds":["CVE-2016-20017"],"exploited":"in-the-wild","identifiers":["CVE-2016-20017"],"json":"https://helix.ml/threat-watch/i/d-link-dsl-2750b-devices-cve-2016-20017.json","latestUpdate":{"date":"2024-01-08","title":"CISA added CVE-2016-20017 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 29, 2024)"},"patchStatus":"patched","product":"DSL-2750B Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dsl-2750b-devices-cve-2016-20017","stacks":["network"],"startedAt":"2024-01-08","status":"closed","summary":"D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. CISA added CVE-2016-20017 to its Known Exploited Vulnerabilities catalog on Jan 8, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"D-Link DSL-2750B Devices Command Injection Vulnerability (CVE-2016-20017)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/d-link-dsl-2750b-devices-cve-2016-20017","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2024-01-22","cveIds":["CVE-2023-41990"],"exploited":"in-the-wild","identifiers":["CVE-2023-41990"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41990.json","latestUpdate":{"date":"2024-01-08","title":"CISA added CVE-2023-41990 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 29, 2024)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-41990","stacks":[],"startedAt":"2024-01-08","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. CISA added CVE-2023-41990 to its Known Exploited Vulnerabilities catalog on Jan 8, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple Multiple Products Code Execution Vulnerability (CVE-2023-41990)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41990","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2024-01-22","cveIds":["CVE-2023-27524"],"exploited":"in-the-wild","identifiers":["CVE-2023-27524"],"json":"https://helix.ml/threat-watch/i/apache-superset-cve-2023-27524.json","latestUpdate":{"date":"2024-01-08","title":"CISA added CVE-2023-27524 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 29, 2024)"},"patchStatus":"unknown","product":"Superset","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-superset-cve-2023-27524","stacks":[],"startedAt":"2024-01-08","status":"closed","summary":"Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. CISA added CVE-2023-27524 to its Known Exploited Vulnerabilities catalog on Jan 8, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1188"],"title":"Apache Superset Insecure Default Initialization of Resource Vulnerability (CVE-2023-27524)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-superset-cve-2023-27524","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2024-01-22","cveIds":["CVE-2023-29300"],"exploited":"in-the-wild","identifiers":["CVE-2023-29300"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-29300.json","latestUpdate":{"date":"2024-01-08","title":"CISA added CVE-2023-29300 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 29, 2024)"},"patchStatus":"unknown","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2023-29300","stacks":["rust"],"startedAt":"2024-01-08","status":"closed","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CISA added CVE-2023-29300 to its Known Exploited Vulnerabilities catalog on Jan 8, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-29300)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-29300","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2024-01-22","cveIds":["CVE-2023-38203"],"exploited":"in-the-wild","identifiers":["CVE-2023-38203"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-38203.json","latestUpdate":{"date":"2024-01-08","title":"CISA added CVE-2023-38203 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 29, 2024)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2023-38203","stacks":["rust"],"startedAt":"2024-01-08","status":"closed","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CISA added CVE-2023-38203 to its Known Exploited Vulnerabilities catalog on Jan 8, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-38203)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-38203","vendor":"Adobe"},{"auto":true,"category":"breach","closedAt":"2024-01-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEGENDASTV"],"json":"https://helix.ml/threat-watch/i/legendastv-data-breach.json","latestUpdate":{"date":"2024-01-04","title":"Have I Been Pwned loaded 3.9M breached Legendas.TV accounts"},"patchStatus":"no-fix-needed","product":"legendas.tv","severity":"high","severityNote":"3.9M accounts · passwords exposed","slug":"legendastv-data-breach","stacks":[],"startedAt":"2024-01-04","status":"closed","summary":"In October 2017, the now defunct Brazilian service for retrieving subtitles in Portuguese Legendas.TV suffered a data breach that exposed nearly 4M customer records. The impacted data included names, usernames, email and IP addresses and unsalted SHA-1 hashes. Exposed data: email addresses, ip addresses, names, passwords, usernames. The breach dates from Oct 1, 2017; Have I Been Pwned loaded it on Jan 4, 2024.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","usernames"],"title":"Legendas.TV data breach: 3.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/legendastv-data-breach","vendor":"Legendas.TV"},{"auto":true,"category":"patch","closedAt":"2024-01-16","cveIds":["CVE-2023-7101"],"exploited":"in-the-wild","identifiers":["CVE-2023-7101"],"json":"https://helix.ml/threat-watch/i/spreadsheet-parseexcel-spreadsheet-parseexcel-cve-2023-7101.json","latestUpdate":{"date":"2024-01-02","title":"CISA added CVE-2023-7101 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 23, 2024)"},"patchStatus":"patched","product":"Spreadsheet::ParseExcel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"spreadsheet-parseexcel-spreadsheet-parseexcel-cve-2023-7101","stacks":[],"startedAt":"2024-01-02","status":"closed","summary":"Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic. CISA added CVE-2023-7101 to its Known Exploited Vulnerabilities catalog on Jan 2, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-95"],"title":"Spreadsheet::ParseExcel Remote Code Execution Vulnerability (CVE-2023-7101)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/spreadsheet-parseexcel-spreadsheet-parseexcel-cve-2023-7101","vendor":"Spreadsheet::ParseExcel"},{"auto":true,"category":"patch","closedAt":"2024-01-16","cveIds":["CVE-2023-7024"],"exploited":"in-the-wild","identifiers":["CVE-2023-7024"],"json":"https://helix.ml/threat-watch/i/google-chromium-webrtc-cve-2023-7024.json","latestUpdate":{"date":"2024-01-02","title":"CISA added CVE-2023-7024 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 23, 2024)"},"patchStatus":"unknown","product":"Chromium WebRTC","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-webrtc-cve-2023-7024","stacks":["browser"],"startedAt":"2024-01-02","status":"closed","summary":"Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome. CISA added CVE-2023-7024 to its Known Exploited Vulnerabilities catalog on Jan 2, 2024, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium WebRTC Heap Buffer Overflow Vulnerability (CVE-2023-7024)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-webrtc-cve-2023-7024","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2024-01-04","cveIds":["CVE-2023-49897"],"exploited":"in-the-wild","identifiers":["CVE-2023-49897"],"json":"https://helix.ml/threat-watch/i/fxc-ae1021-ae1021pe-cve-2023-49897.json","latestUpdate":{"date":"2023-12-21","title":"CISA added CVE-2023-49897 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 11, 2024)"},"patchStatus":"unknown","product":"AE1021, AE1021PE","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fxc-ae1021-ae1021pe-cve-2023-49897","stacks":[],"startedAt":"2023-12-21","status":"closed","summary":"FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network. CISA added CVE-2023-49897 to its Known Exploited Vulnerabilities catalog on Dec 21, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"FXC AE1021, AE1021PE OS Command Injection Vulnerability (CVE-2023-49897)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/fxc-ae1021-ae1021pe-cve-2023-49897","vendor":"FXC"},{"auto":true,"category":"patch","closedAt":"2024-01-04","cveIds":["CVE-2023-47565"],"exploited":"in-the-wild","identifiers":["CVE-2023-47565"],"json":"https://helix.ml/threat-watch/i/qnap-viostor-nvr-cve-2023-47565.json","latestUpdate":{"date":"2023-12-21","title":"CISA added CVE-2023-47565 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 11, 2024)"},"patchStatus":"unknown","product":"VioStor NVR","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-viostor-nvr-cve-2023-47565","stacks":[],"startedAt":"2023-12-21","status":"closed","summary":"QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network. CISA added CVE-2023-47565 to its Known Exploited Vulnerabilities catalog on Dec 21, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"QNAP VioStor NVR OS Command Injection Vulnerability (CVE-2023-47565)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qnap-viostor-nvr-cve-2023-47565","vendor":"QNAP"},{"auto":true,"category":"breach","closedAt":"2023-12-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DCHEALTH"],"json":"https://helix.ml/threat-watch/i/dchealth-data-breach.json","latestUpdate":{"date":"2023-12-14","title":"Have I Been Pwned loaded 48K breached DC Health Link accounts"},"patchStatus":"no-fix-needed","product":"dchealthlink.com","severity":"high","severityNote":"48K accounts","slug":"dchealth-data-breach","stacks":[],"startedAt":"2023-12-14","status":"closed","summary":"In March 2023, DC Health Link discovered a data breach that was later publicly posted to a popular data breach forum. The impacted data included 48k unique email addresses alongside names, genders, dates of birth, home addresses, phone numbers and social security numbers.and \"IntelBroker\". Exposed data: citizenship statuses, dates of birth, email addresses, employers, ethnicities, genders, names, phone numbers, physical addresses, purchases, social security numbers. The breach dates from Mar 6, 2023; Have I Been Pwned loaded it on Dec 14, 2023.","tags":["data-breach","hibp","citizenship-statuses","dates-of-birth","email-addresses","employers","ethnicities","genders","names","phone-numbers","physical-addresses","purchases","social-security-numbers"],"title":"DC Health Link data breach: 48K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/dchealth-data-breach","vendor":"DC Health Link"},{"auto":true,"category":"breach","closedAt":"2023-12-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INFLATEVIDS"],"json":"https://helix.ml/threat-watch/i/inflatevids-data-breach.json","latestUpdate":{"date":"2023-12-12","title":"Have I Been Pwned loaded 13K breached InflateVids accounts"},"patchStatus":"no-fix-needed","product":"tube.inflatevids.xyz","severity":"high","severityNote":"13K accounts · passwords exposed","slug":"inflatevids-data-breach","stacks":[],"startedAt":"2023-12-12","status":"closed","summary":"In December 2023, the inflatable and balloon fetish videos website InflateVids suffered a data breach. The incident exposed over 13k unique email addresses alongside usernames, IP addresses, genders and SHA-1 password hashes. Exposed data: email addresses, genders, ip addresses, passwords, usernames. The breach dates from Dec 12, 2023; Have I Been Pwned loaded it on Dec 12, 2023.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","passwords","usernames"],"title":"InflateVids data breach: 13K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/inflatevids-data-breach","vendor":"InflateVids"},{"auto":true,"category":"patch","closedAt":"2023-12-25","cveIds":["CVE-2023-6448"],"exploited":"in-the-wild","identifiers":["CVE-2023-6448"],"json":"https://helix.ml/threat-watch/i/unitronics-vision-plc-and-hmi-cve-2023-6448.json","latestUpdate":{"date":"2023-12-11","title":"CISA added CVE-2023-6448 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 18, 2023)"},"patchStatus":"unknown","product":"Vision PLC and HMI","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"unitronics-vision-plc-and-hmi-cve-2023-6448","stacks":[],"startedAt":"2023-12-11","status":"closed","summary":"Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands. CISA added CVE-2023-6448 to its Known Exploited Vulnerabilities catalog on Dec 11, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1188"],"title":"Unitronics Vision PLC and HMI Insecure Default Password Vulnerability (CVE-2023-6448)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/unitronics-vision-plc-and-hmi-cve-2023-6448","vendor":"Unitronics"},{"auto":true,"category":"breach","closedAt":"2023-12-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GEMPLEX"],"json":"https://helix.ml/threat-watch/i/gemplex-data-breach.json","latestUpdate":{"date":"2023-12-09","title":"Have I Been Pwned loaded 4.6M breached Gemplex accounts"},"patchStatus":"no-fix-needed","product":"gemplex.tv","severity":"high","severityNote":"4.6M accounts · passwords exposed","slug":"gemplex-data-breach","stacks":[],"startedAt":"2023-12-09","status":"closed","summary":"In February 2021, the Indian streaming platform Gemplex suffered a data breach that exposed 4.6M user accounts. The impacted data included device information, names, phone numbers, email addresses and bcrypt password hashes. Exposed data: device information, email addresses, names, passwords, phone numbers. The breach dates from Feb 18, 2021; Have I Been Pwned loaded it on Dec 9, 2023.","tags":["data-breach","hibp","device-information","email-addresses","names","passwords","phone-numbers"],"title":"Gemplex data breach: 4.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gemplex-data-breach","vendor":"Gemplex"},{"auto":true,"category":"breach","closedAt":"2023-12-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KANEVA"],"json":"https://helix.ml/threat-watch/i/kaneva-data-breach.json","latestUpdate":{"date":"2023-12-09","title":"Have I Been Pwned loaded 3.9M breached Kaneva accounts"},"patchStatus":"no-fix-needed","product":"kaneva.com","severity":"high","severityNote":"3.9M accounts · passwords exposed","slug":"kaneva-data-breach","stacks":[],"startedAt":"2023-12-09","status":"closed","summary":"In July 2016, now defunct website Kaneva, the service to \"build and explore virtual worlds\", suffered a data breach that exposed 3.9M user records. The data included email addresses, usernames, dates of birth and salted MD5 password hashes. Exposed data: dates of birth, email addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Dec 9, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","passwords","usernames"],"title":"Kaneva data breach: 3.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/kaneva-data-breach","vendor":"Kaneva"},{"auto":true,"category":"breach","closedAt":"2023-12-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MOVIEFORUMS"],"json":"https://helix.ml/threat-watch/i/movieforums-data-breach.json","latestUpdate":{"date":"2023-12-08","title":"Have I Been Pwned loaded 39K breached Movie Forums accounts"},"patchStatus":"no-fix-needed","product":"movieforums.com","severity":"high","severityNote":"39K accounts · passwords exposed","slug":"movieforums-data-breach","stacks":[],"startedAt":"2023-12-08","status":"closed","summary":"In December 2022, the Movie Forums website suffered a data breach that affected 40k users. The breach exposed email and IP addresses, usernames, dates of birth and passwords stored as easily crackable salted MD5 hashes. The data was subsequently posted a popular clear web hacking forum. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Nov 24, 2022; Have I Been Pwned loaded it on Dec 8, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Movie Forums data breach: 39K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/movieforums-data-breach","vendor":"Movie Forums"},{"auto":true,"category":"patch","closedAt":"2023-12-21","cveIds":["CVE-2023-41266"],"exploited":"in-the-wild","identifiers":["CVE-2023-41266"],"json":"https://helix.ml/threat-watch/i/qlik-sense-cve-2023-41266.json","latestUpdate":{"date":"2023-12-07","title":"CISA added CVE-2023-41266 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 28, 2023)"},"patchStatus":"unknown","product":"Sense","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"qlik-sense-cve-2023-41266","stacks":[],"startedAt":"2023-12-07","status":"closed","summary":"Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints. CISA added CVE-2023-41266 to its Known Exploited Vulnerabilities catalog on Dec 7, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-20"],"title":"Qlik Sense Path Traversal Vulnerability (CVE-2023-41266)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qlik-sense-cve-2023-41266","vendor":"Qlik"},{"auto":true,"category":"patch","closedAt":"2023-12-21","cveIds":["CVE-2023-41265"],"exploited":"in-the-wild","identifiers":["CVE-2023-41265"],"json":"https://helix.ml/threat-watch/i/qlik-sense-cve-2023-41265.json","latestUpdate":{"date":"2023-12-07","title":"CISA added CVE-2023-41265 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 28, 2023)"},"patchStatus":"unknown","product":"Sense","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"qlik-sense-cve-2023-41265","stacks":[],"startedAt":"2023-12-07","status":"closed","summary":"Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. CISA added CVE-2023-41265 to its Known Exploited Vulnerabilities catalog on Dec 7, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-444"],"title":"Qlik Sense HTTP Tunneling Vulnerability (CVE-2023-41265)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qlik-sense-cve-2023-41265","vendor":"Qlik"},{"auto":true,"category":"breach","closedAt":"2023-12-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JOYGAMES"],"json":"https://helix.ml/threat-watch/i/joygames-data-breach.json","latestUpdate":{"date":"2023-12-07","title":"Have I Been Pwned loaded 4.5M breached JoyGames accounts"},"patchStatus":"no-fix-needed","product":"joygames.me","severity":"high","severityNote":"4.5M accounts · passwords exposed","slug":"joygames-data-breach","stacks":[],"startedAt":"2023-12-07","status":"closed","summary":"In December 2019, the forum for the JoyGames website suffered a data breach that exposed 4.5M unique email addresses. The impacted data also included usernames, IP addresses and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 14, 2019; Have I Been Pwned loaded it on Dec 7, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"JoyGames data breach: 4.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/joygames-data-breach","vendor":"JoyGames"},{"auto":true,"category":"patch","closedAt":"2023-12-19","cveIds":["CVE-2023-33107"],"exploited":"in-the-wild","identifiers":["CVE-2023-33107"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2023-33107.json","latestUpdate":{"date":"2023-12-05","title":"CISA added CVE-2023-33107 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 26, 2023)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2023-33107","stacks":[],"startedAt":"2023-12-05","status":"closed","summary":"Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. CISA added CVE-2023-33107 to its Known Exploited Vulnerabilities catalog on Dec 5, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-190"],"title":"Qualcomm Multiple Chipsets Integer Overflow Vulnerability (CVE-2023-33107)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2023-33107","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2023-12-19","cveIds":["CVE-2023-33106"],"exploited":"in-the-wild","identifiers":["CVE-2023-33106"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2023-33106.json","latestUpdate":{"date":"2023-12-05","title":"CISA added CVE-2023-33106 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 26, 2023)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2023-33106","stacks":[],"startedAt":"2023-12-05","status":"closed","summary":"Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. CISA added CVE-2023-33106 to its Known Exploited Vulnerabilities catalog on Dec 5, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-823"],"title":"Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability (CVE-2023-33106)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2023-33106","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2023-12-19","cveIds":["CVE-2023-33063"],"exploited":"in-the-wild","identifiers":["CVE-2023-33063"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2023-33063.json","latestUpdate":{"date":"2023-12-05","title":"CISA added CVE-2023-33063 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 26, 2023)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2023-33063","stacks":[],"startedAt":"2023-12-05","status":"closed","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP. CISA added CVE-2023-33063 to its Known Exploited Vulnerabilities catalog on Dec 5, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2023-33063)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2023-33063","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2023-12-19","cveIds":["CVE-2022-22071"],"exploited":"in-the-wild","identifiers":["CVE-2022-22071"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2022-22071.json","latestUpdate":{"date":"2023-12-05","title":"CISA added CVE-2022-22071 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 26, 2023)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2022-22071","stacks":[],"startedAt":"2023-12-05","status":"closed","summary":"Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress. CISA added CVE-2022-22071 to its Known Exploited Vulnerabilities catalog on Dec 5, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2022-22071)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2022-22071","vendor":"Qualcomm"},{"auto":true,"category":"breach","closedAt":"2023-12-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RAILYATRI"],"json":"https://helix.ml/threat-watch/i/railyatri-data-breach.json","latestUpdate":{"date":"2023-12-05","title":"Have I Been Pwned loaded 23.2M breached RailYatri accounts"},"patchStatus":"no-fix-needed","product":"railyatri.in","severity":"medium","severityNote":"23.2M accounts","slug":"railyatri-data-breach","stacks":[],"startedAt":"2023-12-05","status":"closed","summary":"In December 2022, India’s government-approved online travel agency RailYatri suffered a data breach. The incident impacted over 31M customers and exposed 23M unique email addresses. Also impacted were names, genders, phone numbers and tickets purchased, including travel information and fares. Exposed data: email addresses, genders, names, phone numbers, purchases. The breach dates from Dec 26, 2022; Have I Been Pwned loaded it on Dec 5, 2023.","tags":["data-breach","hibp","email-addresses","genders","names","phone-numbers","purchases"],"title":"RailYatri data breach: 23.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/railyatri-data-breach","vendor":"RailYatri"},{"auto":true,"category":"patch","closedAt":"2023-12-18","cveIds":["CVE-2023-42917"],"exploited":"in-the-wild","identifiers":["CVE-2023-42917"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-42917.json","latestUpdate":{"date":"2023-12-04","title":"CISA added CVE-2023-42917 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 25, 2023)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-42917","stacks":["browser","ios"],"startedAt":"2023-12-04","status":"closed","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-42917 to its Known Exploited Vulnerabilities catalog on Dec 4, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products WebKit Memory Corruption Vulnerability (CVE-2023-42917)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-42917","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-12-18","cveIds":["CVE-2023-42916"],"exploited":"in-the-wild","identifiers":["CVE-2023-42916"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-42916.json","latestUpdate":{"date":"2023-12-04","title":"CISA added CVE-2023-42916 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 25, 2023)"},"patchStatus":"unknown","product":"Multiple Products","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-42916","stacks":["browser","ios"],"startedAt":"2023-12-04","status":"closed","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-42916 to its Known Exploited Vulnerabilities catalog on Dec 4, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability (CVE-2023-42916)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-42916","vendor":"Apple"},{"auto":true,"category":"breach","closedAt":"2023-12-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SOARGAMES"],"json":"https://helix.ml/threat-watch/i/soargames-data-breach.json","latestUpdate":{"date":"2023-12-03","title":"Have I Been Pwned loaded 4.8M breached SoarGames accounts"},"patchStatus":"no-fix-needed","product":"soargames.com","severity":"high","severityNote":"4.8M accounts · passwords exposed","slug":"soargames-data-breach","stacks":[],"startedAt":"2023-12-03","status":"closed","summary":"In December 2019, the now defunct gaming website SoarGames suffered a data breach that exposed 4.8M unique email addresses. The impacted data included usernames, email and IP addresses and salted MD5 password hashes. A significant number of the email addresses appeared to have been generated as opposed to organically provided by the user. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 16, 2019; Have I Been Pwned loaded it on Dec 3, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"SoarGames data breach: 4.8M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/soargames-data-breach","vendor":"SoarGames"},{"auto":true,"category":"patch","closedAt":"2023-12-14","cveIds":["CVE-2023-6345"],"exploited":"in-the-wild","identifiers":["CVE-2023-6345"],"json":"https://helix.ml/threat-watch/i/google-chromium-skia-cve-2023-6345.json","latestUpdate":{"date":"2023-11-30","title":"CISA added CVE-2023-6345 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 21, 2023)"},"patchStatus":"unknown","product":"Chromium Skia","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-skia-cve-2023-6345","stacks":["browser"],"startedAt":"2023-11-30","status":"closed","summary":"Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. CISA added CVE-2023-6345 to its Known Exploited Vulnerabilities catalog on Nov 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-190"],"title":"Google Skia Integer Overflow Vulnerability (CVE-2023-6345)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-skia-cve-2023-6345","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2023-12-14","cveIds":["CVE-2023-49103"],"exploited":"in-the-wild","identifiers":["CVE-2023-49103"],"json":"https://helix.ml/threat-watch/i/owncloud-owncloud-graphapi-cve-2023-49103.json","latestUpdate":{"date":"2023-11-30","title":"CISA added CVE-2023-49103 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 21, 2023)"},"patchStatus":"unknown","product":"ownCloud graphapi","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"owncloud-owncloud-graphapi-cve-2023-49103","stacks":[],"startedAt":"2023-11-30","status":"closed","summary":"ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials. CISA added CVE-2023-49103 to its Known Exploited Vulnerabilities catalog on Nov 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"ownCloud graphapi Information Disclosure Vulnerability (CVE-2023-49103)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/owncloud-owncloud-graphapi-cve-2023-49103","vendor":"ownCloud"},{"auto":true,"category":"breach","closedAt":"2023-12-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GONINJA"],"json":"https://helix.ml/threat-watch/i/goninja-data-breach.json","latestUpdate":{"date":"2023-11-30","title":"Have I Been Pwned loaded 5.0M breached Go Ninja accounts"},"patchStatus":"no-fix-needed","product":"goninja.de","severity":"high","severityNote":"5.0M accounts · passwords exposed","slug":"goninja-data-breach","stacks":[],"startedAt":"2023-11-30","status":"closed","summary":"In December 2019, the now defunct German gaming website Go Ninja suffered a data breach that exposed 5M unique email addresses. The impacted data included usernames, email and IP addresses and salted MD5 password hashes. More than 4M of the email addresses appeared to have been generated as opposed to organically provided by the user. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 17, 2019; Have I Been Pwned loaded it on Nov 30, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Go Ninja data breach: 5.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/goninja-data-breach","vendor":"Go Ninja"},{"auto":true,"category":"breach","closedAt":"2023-12-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BLEACHANIME"],"json":"https://helix.ml/threat-watch/i/bleachanime-data-breach.json","latestUpdate":{"date":"2023-11-29","title":"Have I Been Pwned loaded 143K breached Bleach Anime Forum accounts"},"patchStatus":"no-fix-needed","product":"bleachanime.org","severity":"high","severityNote":"143K accounts · passwords exposed","slug":"bleachanime-data-breach","stacks":[],"startedAt":"2023-11-29","status":"closed","summary":"In 2015, the now defunct independent forum for the Bleach Anime series suffered a data breach that exposed 144k user records. The impacted data included usernames, email addresses and salted MD5 password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 1, 2015; Have I Been Pwned loaded it on Nov 29, 2023.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Bleach Anime Forum data breach: 143K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bleachanime-data-breach","vendor":"Bleach Anime Forum"},{"auto":true,"category":"breach","closedAt":"2023-12-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ESTANTEVIRTUAL"],"json":"https://helix.ml/threat-watch/i/estantevirtual-data-breach.json","latestUpdate":{"date":"2023-11-29","title":"Have I Been Pwned loaded 5.4M breached Estante Virtual accounts"},"patchStatus":"no-fix-needed","product":"estantevirtual.com.br","severity":"high","severityNote":"5.4M accounts · passwords exposed","slug":"estantevirtual-data-breach","stacks":[],"startedAt":"2023-11-29","status":"closed","summary":"In February 2019, the Brazilian book store Estante Virtual suffered a data breach that impacted 5.4M customers. The exposed data included names, usernames, email and physical addresses, phone numbers, dates of birth and unsalted SHA-1 password hashes. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Feb 28, 2019; Have I Been Pwned loaded it on Nov 29, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Estante Virtual data breach: 5.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/estantevirtual-data-breach","vendor":"Estante Virtual"},{"auto":true,"category":"breach","closedAt":"2023-12-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JAMTANGAN"],"json":"https://helix.ml/threat-watch/i/jamtangan-data-breach.json","latestUpdate":{"date":"2023-11-27","title":"Have I Been Pwned loaded 434K breached Jam Tangan accounts"},"patchStatus":"no-fix-needed","product":"jamtangan.com","severity":"high","severityNote":"434K accounts · passwords exposed","slug":"jamtangan-data-breach","stacks":[],"startedAt":"2023-11-27","status":"closed","summary":"In July 2021, the online Indonesian watch store, Jam Tangan (AKA Machtwatch), suffered a data breach that exposed over 400k customer records which were subsequently posted to a popular hacking forum. The data included email and IP addresses, names, phone numbers, physical addresses and passwords stored as either unsalted MD5 or bcrypt hashes. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jul 6, 2021; Have I Been Pwned loaded it on Nov 27, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Jam Tangan data breach: 434K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/jamtangan-data-breach","vendor":"Jam Tangan"},{"auto":true,"category":"breach","closedAt":"2023-12-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INDIHOME"],"json":"https://helix.ml/threat-watch/i/indihome-data-breach.json","latestUpdate":{"date":"2023-11-27","title":"Have I Been Pwned loaded 12.6M breached IndiHome accounts"},"patchStatus":"no-fix-needed","product":"indihome.co.id","severity":"medium","severityNote":"12.6M accounts","slug":"indihome-data-breach","stacks":[],"startedAt":"2023-11-27","status":"closed","summary":"In mid-2021, reports emerged of a data breach of Indonesia's telecommunications company, IndiHome. Over 26M rows of data alleged to have been sourced from the company was posted to a popular hacking forum and contained 12.6M unique email addresses alongside names, IP addresses, genders and geographic locations. The most recent data was stamped as being recorded in November 2019. Exposed data: device information, email addresses, genders, geographic locations, ip addresses, names. The breach dates from Nov 1, 2019; Have I Been Pwned loaded it on Nov 27, 2023.","tags":["data-breach","hibp","device-information","email-addresses","genders","geographic-locations","ip-addresses","names"],"title":"IndiHome data breach: 12.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/indihome-data-breach","vendor":"IndiHome"},{"auto":true,"category":"breach","closedAt":"2023-12-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KITCHENPAL"],"json":"https://helix.ml/threat-watch/i/kitchenpal-data-breach.json","latestUpdate":{"date":"2023-11-24","title":"Have I Been Pwned loaded 98K breached KitchenPal accounts"},"patchStatus":"no-fix-needed","product":"kitchenpalapp.com","severity":"high","severityNote":"98K accounts · passwords exposed","slug":"kitchenpal-data-breach","stacks":[],"startedAt":"2023-11-24","status":"closed","summary":"In November 2023, the kitchen management application KitchenPal suffered a data breach that exposed 146k lines of data. When contacted about the incident, KitchenPal advised the corpus of data came from a staging environment, although acknowledged it contained a small number of users for debugging purposes and included passwords that could not be used. Impacted data included almost 100k email addresses, names, geolocations and incomplete data on dates of birth, genders, height and weight, social media profile identifiers and bcrypt password hashes. Exposed data: dates of birth, email addresses, genders, geographic locations, names, passwords, physical attributes, social media profiles. The breach dates from Nov 14, 2023; Have I Been Pwned loaded it on Nov 24, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","passwords","physical-attributes","social-media-profiles"],"title":"KitchenPal data breach: 98K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/kitchenpal-data-breach","vendor":"KitchenPal"},{"auto":true,"category":"patch","closedAt":"2023-12-05","cveIds":["CVE-2023-4911"],"exploited":"in-the-wild","identifiers":["CVE-2023-4911"],"json":"https://helix.ml/threat-watch/i/gnu-gnu-c-library-cve-2023-4911.json","latestUpdate":{"date":"2023-11-21","title":"CISA added CVE-2023-4911 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 12, 2023)"},"patchStatus":"patched","product":"GNU C Library","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gnu-gnu-c-library-cve-2023-4911","stacks":[],"startedAt":"2023-11-21","status":"closed","summary":"GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges. CISA added CVE-2023-4911 to its Known Exploited Vulnerabilities catalog on Nov 21, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"GNU C Library Buffer Overflow Vulnerability (CVE-2023-4911)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/gnu-gnu-c-library-cve-2023-4911","vendor":"GNU"},{"auto":true,"category":"breach","closedAt":"2023-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OMGPOP"],"json":"https://helix.ml/threat-watch/i/omgpop-data-breach.json","latestUpdate":{"date":"2023-11-20","title":"Have I Been Pwned loaded 7.1M breached OMGPOP accounts"},"patchStatus":"no-fix-needed","product":"omgpop.com","severity":"high","severityNote":"7.1M accounts · passwords exposed","slug":"omgpop-data-breach","stacks":[],"startedAt":"2023-11-20","status":"closed","summary":"In approximately 2013, the maker of the Draw Something game OMGPOP suffered a data breach. Formerly known as i'minlikewithyou or iilwy and later purchased by Zynga, the breach exposed over 7M email address and plain text password pairs which were later leaked in 2019. Exposed data: email addresses, passwords. The breach dates from Jan 1, 2013; Have I Been Pwned loaded it on Nov 20, 2023.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"OMGPOP data breach: 7.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/omgpop-data-breach","vendor":"OMGPOP"},{"auto":true,"category":"patch","closedAt":"2023-11-30","cveIds":["CVE-2023-36584"],"exploited":"in-the-wild","identifiers":["CVE-2023-36584"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36584.json","latestUpdate":{"date":"2023-11-16","title":"CISA added CVE-2023-36584 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 7, 2023)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-36584","stacks":["windows"],"startedAt":"2023-11-16","status":"closed","summary":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. CISA added CVE-2023-36584 to its Known Exploited Vulnerabilities catalog on Nov 16, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability (CVE-2023-36584)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36584","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-11-30","cveIds":["CVE-2023-1671"],"exploited":"in-the-wild","identifiers":["CVE-2023-1671"],"json":"https://helix.ml/threat-watch/i/sophos-web-appliance-cve-2023-1671.json","latestUpdate":{"date":"2023-11-16","title":"CISA added CVE-2023-1671 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 7, 2023)"},"patchStatus":"unknown","product":"Web Appliance","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sophos-web-appliance-cve-2023-1671","stacks":["network"],"startedAt":"2023-11-16","status":"closed","summary":"Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. CISA added CVE-2023-1671 to its Known Exploited Vulnerabilities catalog on Nov 16, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Sophos Web Appliance Command Injection Vulnerability (CVE-2023-1671)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sophos-web-appliance-cve-2023-1671","vendor":"Sophos"},{"auto":true,"category":"patch","closedAt":"2023-11-30","cveIds":["CVE-2020-2551"],"exploited":"in-the-wild","identifiers":["CVE-2020-2551"],"json":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2020-2551.json","latestUpdate":{"date":"2023-11-16","title":"CISA added CVE-2020-2551 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 7, 2023)"},"patchStatus":"patched","product":"Fusion Middleware","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-fusion-middleware-cve-2020-2551","stacks":[],"startedAt":"2023-11-16","status":"closed","summary":"Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server. CISA added CVE-2020-2551 to its Known Exploited Vulnerabilities catalog on Nov 16, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle Fusion Middleware Unspecified Vulnerability (CVE-2020-2551)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2020-2551","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2023-11-28","cveIds":["CVE-2023-36033"],"exploited":"in-the-wild","identifiers":["CVE-2023-36033"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36033.json","latestUpdate":{"date":"2023-11-14","title":"CISA added CVE-2023-36033 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 5, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-36033","stacks":["windows"],"startedAt":"2023-11-14","status":"closed","summary":"Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-36033 to its Known Exploited Vulnerabilities catalog on Nov 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-822"],"title":"Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability (CVE-2023-36033)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36033","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-11-28","cveIds":["CVE-2023-36025"],"exploited":"in-the-wild","identifiers":["CVE-2023-36025"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36025.json","latestUpdate":{"date":"2023-11-14","title":"CISA added CVE-2023-36025 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 5, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-36025","stacks":["windows"],"startedAt":"2023-11-14","status":"closed","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. CISA added CVE-2023-36025 to its Known Exploited Vulnerabilities catalog on Nov 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2023-36025)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36025","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-11-28","cveIds":["CVE-2023-36036"],"exploited":"in-the-wild","identifiers":["CVE-2023-36036"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36036.json","latestUpdate":{"date":"2023-11-14","title":"CISA added CVE-2023-36036 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 5, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-36036","stacks":["windows"],"startedAt":"2023-11-14","status":"closed","summary":"Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges. CISA added CVE-2023-36036 to its Known Exploited Vulnerabilities catalog on Nov 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-122"],"title":"Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability (CVE-2023-36036)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36036","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2023-11-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AVITO"],"json":"https://helix.ml/threat-watch/i/avito-data-breach.json","latestUpdate":{"date":"2023-11-14","title":"Have I Been Pwned loaded 2.7M breached Avito accounts"},"patchStatus":"no-fix-needed","product":"avito.ma","severity":"medium","severityNote":"2.7M accounts","slug":"avito-data-breach","stacks":[],"startedAt":"2023-11-14","status":"closed","summary":"In November 2022, the Moroccan e-commerce service Avito suffered a data breach that exposed the personal information of 2.7M customers. The data included name, email, phone, IP address and geographic location. Exposed data: email addresses, geographic locations, ip addresses, names, phone numbers. The breach dates from Nov 18, 2022; Have I Been Pwned loaded it on Nov 14, 2023.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","names","phone-numbers"],"title":"Avito data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/avito-data-breach","vendor":"Avito"},{"auto":true,"category":"patch","closedAt":"2023-11-27","cveIds":["CVE-2023-47246"],"exploited":"in-the-wild","identifiers":["CVE-2023-47246"],"json":"https://helix.ml/threat-watch/i/sysaid-sysaid-server-cve-2023-47246.json","latestUpdate":{"date":"2023-11-13","title":"CISA added CVE-2023-47246 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 4, 2023)"},"patchStatus":"unknown","product":"SysAid Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sysaid-sysaid-server-cve-2023-47246","stacks":[],"startedAt":"2023-11-13","status":"closed","summary":"SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution. CISA added CVE-2023-47246 to its Known Exploited Vulnerabilities catalog on Nov 13, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"SysAid Server Path Traversal Vulnerability (CVE-2023-47246)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/sysaid-sysaid-server-cve-2023-47246","vendor":"SysAid"},{"auto":true,"category":"patch","closedAt":"2023-11-27","cveIds":["CVE-2023-36844"],"exploited":"in-the-wild","identifiers":["CVE-2023-36844"],"json":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36844.json","latestUpdate":{"date":"2023-11-13","title":"CISA added CVE-2023-36844 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2023)"},"patchStatus":"unknown","product":"Junos OS","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-junos-os-cve-2023-36844","stacks":["network","php"],"startedAt":"2023-11-13","status":"closed","summary":"Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities. CISA added CVE-2023-36844 to its Known Exploited Vulnerabilities catalog on Nov 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-473"],"title":"Juniper Junos OS EX Series PHP External Variable Modification Vulnerability (CVE-2023-36844)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36844","vendor":"Juniper"},{"auto":true,"category":"patch","closedAt":"2023-11-27","cveIds":["CVE-2023-36845"],"exploited":"in-the-wild","identifiers":["CVE-2023-36845"],"json":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36845.json","latestUpdate":{"date":"2023-11-13","title":"CISA added CVE-2023-36845 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2023)"},"patchStatus":"unknown","product":"Junos OS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-junos-os-cve-2023-36845","stacks":["network","php"],"startedAt":"2023-11-13","status":"closed","summary":"Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code. CISA added CVE-2023-36845 to its Known Exploited Vulnerabilities catalog on Nov 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-473"],"title":"Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability (CVE-2023-36845)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36845","vendor":"Juniper"},{"auto":true,"category":"patch","closedAt":"2023-11-27","cveIds":["CVE-2023-36846"],"exploited":"in-the-wild","identifiers":["CVE-2023-36846"],"json":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36846.json","latestUpdate":{"date":"2023-11-13","title":"CISA added CVE-2023-36846 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2023)"},"patchStatus":"unknown","product":"Junos OS","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-junos-os-cve-2023-36846","stacks":["network"],"startedAt":"2023-11-13","status":"closed","summary":"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. CISA added CVE-2023-36846 to its Known Exploited Vulnerabilities catalog on Nov 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability (CVE-2023-36846)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36846","vendor":"Juniper"},{"auto":true,"category":"patch","closedAt":"2023-11-27","cveIds":["CVE-2023-36847"],"exploited":"in-the-wild","identifiers":["CVE-2023-36847"],"json":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36847.json","latestUpdate":{"date":"2023-11-13","title":"CISA added CVE-2023-36847 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2023)"},"patchStatus":"unknown","product":"Junos OS","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-junos-os-cve-2023-36847","stacks":["network"],"startedAt":"2023-11-13","status":"closed","summary":"Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. CISA added CVE-2023-36847 to its Known Exploited Vulnerabilities catalog on Nov 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability (CVE-2023-36847)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36847","vendor":"Juniper"},{"auto":true,"category":"patch","closedAt":"2023-11-27","cveIds":["CVE-2023-36851"],"exploited":"in-the-wild","identifiers":["CVE-2023-36851"],"json":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36851.json","latestUpdate":{"date":"2023-11-13","title":"CISA added CVE-2023-36851 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2023)"},"patchStatus":"unknown","product":"Junos OS","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-junos-os-cve-2023-36851","stacks":["network"],"startedAt":"2023-11-13","status":"closed","summary":"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. CISA added CVE-2023-36851 to its Known Exploited Vulnerabilities catalog on Nov 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability (CVE-2023-36851)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2023-36851","vendor":"Juniper"},{"auto":true,"category":"breach","closedAt":"2023-11-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHESS"],"json":"https://helix.ml/threat-watch/i/chess-data-breach.json","latestUpdate":{"date":"2023-11-10","title":"Have I Been Pwned loaded 1.3M breached Chess.com (2023) accounts"},"patchStatus":"no-fix-needed","product":"chess.com","severity":"medium","severityNote":"1.3M accounts","slug":"chess-data-breach","stacks":[],"startedAt":"2023-11-10","status":"closed","summary":"In November 2023, over 800k user records were scraped from the Chess.com website and posted to a popular hacking forum. The data included email address, name, username and the geographic location of the user. A further 446k scraped records were later provided and added to HIBP. Exposed data: email addresses, geographic locations, names, usernames. The breach dates from Nov 8, 2023; Have I Been Pwned loaded it on Nov 10, 2023.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","usernames"],"title":"Chess.com (2023) data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/chess-data-breach","vendor":"Chess.com (2023)"},{"auto":true,"category":"patch","closedAt":"2023-11-22","cveIds":["CVE-2023-29552"],"exploited":"in-the-wild","identifiers":["CVE-2023-29552"],"json":"https://helix.ml/threat-watch/i/ietf-service-location-protocol-slp-cve-2023-29552.json","latestUpdate":{"date":"2023-11-08","title":"CISA added CVE-2023-29552 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 29, 2023)"},"patchStatus":"unknown","product":"Service Location Protocol (SLP)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ietf-service-location-protocol-slp-cve-2023-29552","stacks":[],"startedAt":"2023-11-08","status":"closed","summary":"The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor. CISA added CVE-2023-29552 to its Known Exploited Vulnerabilities catalog on Nov 8, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Service Location Protocol (SLP) Denial-of-Service Vulnerability (CVE-2023-29552)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ietf-service-location-protocol-slp-cve-2023-29552","vendor":"IETF"},{"auto":true,"category":"patch","closedAt":"2023-11-21","cveIds":["CVE-2023-22518"],"exploited":"in-the-wild","identifiers":["CVE-2023-22518"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-data-center-and-server-cve-2023-22518.json","latestUpdate":{"date":"2023-11-07","title":"CISA added CVE-2023-22518 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 28, 2023)"},"patchStatus":"unknown","product":"Confluence Data Center and Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-data-center-and-server-cve-2023-22518","stacks":["devtools","java"],"startedAt":"2023-11-07","status":"closed","summary":"Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data. CISA added CVE-2023-22518 to its Known Exploited Vulnerabilities catalog on Nov 7, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-863"],"title":"Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (CVE-2023-22518)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-data-center-and-server-cve-2023-22518","vendor":"Atlassian"},{"auto":true,"category":"breach","closedAt":"2023-11-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMINGMONK"],"json":"https://helix.ml/threat-watch/i/gamingmonk-data-breach.json","latestUpdate":{"date":"2023-11-05","title":"Have I Been Pwned loaded 654K breached GamingMonk accounts"},"patchStatus":"no-fix-needed","product":"gamingmonk.com","severity":"high","severityNote":"654K accounts · passwords exposed","slug":"gamingmonk-data-breach","stacks":[],"startedAt":"2023-11-05","status":"closed","summary":"In December 2020, India's \"largest esports community\" GamingMonk (since acquired by and redirected to MPL Esports), suffered a data breach. The incident exposed 655k unique email addresses along with names, usernames, phone numbers, dates of birth and bcrypt password hashes. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, usernames. The breach dates from Dec 2, 2020; Have I Been Pwned loaded it on Nov 5, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","usernames"],"title":"GamingMonk data breach: 654K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gamingmonk-data-breach","vendor":"GamingMonk"},{"auto":true,"category":"breach","closedAt":"2023-11-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FITMART"],"json":"https://helix.ml/threat-watch/i/fitmart-data-breach.json","latestUpdate":{"date":"2023-11-03","title":"Have I Been Pwned loaded 214K breached Fitmart accounts"},"patchStatus":"no-fix-needed","product":"fitmart.de","severity":"high","severityNote":"214K accounts · passwords exposed","slug":"fitmart-data-breach","stacks":[],"startedAt":"2023-11-03","status":"closed","summary":"In October 2021, data from the German fitness supplies store Fitmart was obtained and later redistributed online. The data included 214k unique email addresses accompanied by plain text passwords, allegedly \"dehashed\" from the original stored version. Exposed data: email addresses, passwords. The breach dates from Oct 1, 2021; Have I Been Pwned loaded it on Nov 3, 2023.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Fitmart data breach: 214K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/fitmart-data-breach","vendor":"Fitmart"},{"auto":true,"category":"patch","closedAt":"2023-11-16","cveIds":["CVE-2023-46604"],"exploited":"in-the-wild","identifiers":["CVE-2023-46604"],"json":"https://helix.ml/threat-watch/i/apache-activemq-cve-2023-46604.json","latestUpdate":{"date":"2023-11-02","title":"CISA added CVE-2023-46604 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 23, 2023)"},"patchStatus":"unknown","product":"ActiveMQ","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-activemq-cve-2023-46604","stacks":["rust"],"startedAt":"2023-11-02","status":"closed","summary":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. CISA added CVE-2023-46604 to its Known Exploited Vulnerabilities catalog on Nov 2, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability (CVE-2023-46604)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-activemq-cve-2023-46604","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2023-11-14","cveIds":["CVE-2023-46748"],"exploited":"in-the-wild","identifiers":["CVE-2023-46748"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-configuration-utility-cve-2023-46748.json","latestUpdate":{"date":"2023-10-31","title":"CISA added CVE-2023-46748 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 21, 2023)"},"patchStatus":"unknown","product":"BIG-IP Configuration Utility","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-configuration-utility-cve-2023-46748","stacks":["network"],"startedAt":"2023-10-31","status":"closed","summary":"F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. CISA added CVE-2023-46748 to its Known Exploited Vulnerabilities catalog on Oct 31, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"F5 BIG-IP Configuration Utility SQL Injection Vulnerability (CVE-2023-46748)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-configuration-utility-cve-2023-46748","vendor":"F5"},{"auto":true,"category":"patch","closedAt":"2023-11-14","cveIds":["CVE-2023-46747"],"exploited":"in-the-wild","identifiers":["CVE-2023-46747"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-configuration-utility-cve-2023-46747.json","latestUpdate":{"date":"2023-10-31","title":"CISA added CVE-2023-46747 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 21, 2023)"},"patchStatus":"unknown","product":"BIG-IP Configuration Utility","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-configuration-utility-cve-2023-46747","stacks":["network"],"startedAt":"2023-10-31","status":"closed","summary":"F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748. CISA added CVE-2023-46747 to its Known Exploited Vulnerabilities catalog on Oct 31, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-288"],"title":"F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability (CVE-2023-46747)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-configuration-utility-cve-2023-46747","vendor":"F5"},{"auto":true,"category":"breach","closedAt":"2023-11-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMESPRITE"],"json":"https://helix.ml/threat-watch/i/gamesprite-data-breach.json","latestUpdate":{"date":"2023-10-30","title":"Have I Been Pwned loaded 6.2M breached GameSprite accounts"},"patchStatus":"no-fix-needed","product":"gamesprite.me","severity":"high","severityNote":"6.2M accounts · passwords exposed","slug":"gamesprite-data-breach","stacks":[],"startedAt":"2023-10-30","status":"closed","summary":"In December 2019, the now defunct gaming platform GameSprite suffered a data breach that exposed over 6M unique email addresses. The impacted data also included usernames, IP addresses and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 17, 2019; Have I Been Pwned loaded it on Oct 30, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"GameSprite data breach: 6.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/gamesprite-data-breach","vendor":"GameSprite"},{"auto":true,"category":"breach","closedAt":"2023-11-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MEMECHAT"],"json":"https://helix.ml/threat-watch/i/memechat-data-breach.json","latestUpdate":{"date":"2023-10-29","title":"Have I Been Pwned loaded 4.3M breached MemeChat accounts"},"patchStatus":"no-fix-needed","product":"memechat.app","severity":"medium","severityNote":"4.3M accounts","slug":"memechat-data-breach","stacks":[],"startedAt":"2023-10-29","status":"closed","summary":"In mid-2022, \"the ultimate hub of memes\" MemeChat suffered a data breach that exposed 7.4M records. Alleged to be due to a misconfigured Elasticsearch instance, the data contained 4.3M unique email addresses alongside usernames. Exposed data: email addresses, usernames. The breach dates from Jun 1, 2022; Have I Been Pwned loaded it on Oct 29, 2023.","tags":["data-breach","hibp","email-addresses","usernames"],"title":"MemeChat data breach: 4.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/memechat-data-breach","vendor":"MemeChat"},{"auto":true,"category":"breach","closedAt":"2023-11-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TOUMEI"],"json":"https://helix.ml/threat-watch/i/toumei-data-breach.json","latestUpdate":{"date":"2023-10-27","title":"Have I Been Pwned loaded 76K breached Toumei accounts"},"patchStatus":"no-fix-needed","product":"toumei.co.jp","severity":"medium","severityNote":"76K accounts","slug":"toumei-data-breach","stacks":[],"startedAt":"2023-10-27","status":"closed","summary":"In October 2023, the Japanese consultancy firm Toumei suffered a data breach. The breach exposed over 100M lines and 10GB of data including 77k unique email addresses along with names, phone numbers and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Oct 18, 2023; Have I Been Pwned loaded it on Oct 27, 2023.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Toumei data breach: 76K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/toumei-data-breach","vendor":"Toumei"},{"auto":true,"category":"patch","closedAt":"2023-11-09","cveIds":["CVE-2023-5631"],"exploited":"in-the-wild","identifiers":["CVE-2023-5631"],"json":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2023-5631.json","latestUpdate":{"date":"2023-10-26","title":"CISA added CVE-2023-5631 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 16, 2023)"},"patchStatus":"patched","product":"Webmail","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-webmail-cve-2023-5631","stacks":[],"startedAt":"2023-10-26","status":"closed","summary":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. CISA added CVE-2023-5631 to its Known Exploited Vulnerabilities catalog on Oct 26, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (CVE-2023-5631)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/roundcube-webmail-cve-2023-5631","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2023-11-06","cveIds":["CVE-2023-20273"],"exploited":"in-the-wild","identifiers":["CVE-2023-20273"],"json":"https://helix.ml/threat-watch/i/cisco-cisco-ios-xe-web-ui-cve-2023-20273.json","latestUpdate":{"date":"2023-10-23","title":"CISA added CVE-2023-20273 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 27, 2023)"},"patchStatus":"unknown","product":"Cisco IOS XE Web UI","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-cisco-ios-xe-web-ui-cve-2023-20273","stacks":["ios","network"],"startedAt":"2023-10-23","status":"closed","summary":"Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity. CISA added CVE-2023-20273 to its Known Exploited Vulnerabilities catalog on Oct 23, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Cisco IOS XE Web UI Command Injection Vulnerability (CVE-2023-20273)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-cisco-ios-xe-web-ui-cve-2023-20273","vendor":"Cisco"},{"auto":true,"category":"breach","closedAt":"2023-11-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TUNNGLE"],"json":"https://helix.ml/threat-watch/i/tunngle-data-breach.json","latestUpdate":{"date":"2023-10-21","title":"Have I Been Pwned loaded 8.2M breached Tunngle accounts"},"patchStatus":"no-fix-needed","product":"tunngle.net","severity":"high","severityNote":"8.2M accounts · passwords exposed","slug":"tunngle-data-breach","stacks":[],"startedAt":"2023-10-21","status":"closed","summary":"In 2016, the now defunct global LAN gaming network Tunngle suffered a data breach that exposed 8.2M unique email addresses. The compromised data also included usernames, IP addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Oct 21, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Tunngle data breach: 8.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tunngle-data-breach","vendor":"Tunngle"},{"auto":true,"category":"breach","closedAt":"2023-11-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPHERO"],"json":"https://helix.ml/threat-watch/i/sphero-data-breach.json","latestUpdate":{"date":"2023-10-20","title":"Have I Been Pwned loaded 832K breached Sphero accounts"},"patchStatus":"no-fix-needed","product":"sphero.com","severity":"medium","severityNote":"832K accounts","slug":"sphero-data-breach","stacks":[],"startedAt":"2023-10-20","status":"closed","summary":"In September 2023, over 1M rows of data from the educational robots company Sphero was posted to a popular hacking forum. The data contained 832k unique email addresses alongside names, usernames, dates of birth and geographic locations. Exposed data: dates of birth, email addresses, geographic locations, names, usernames. The breach dates from Sep 9, 2023; Have I Been Pwned loaded it on Oct 20, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","names","usernames"],"title":"Sphero data breach: 832K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/sphero-data-breach","vendor":"Sphero"},{"auto":true,"category":"patch","closedAt":"2023-11-01","cveIds":["CVE-2023-4966"],"exploited":"in-the-wild","identifiers":["CVE-2023-4966"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-4966.json","latestUpdate":{"date":"2023-10-18","title":"CISA added CVE-2023-4966 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 8, 2023)"},"patchStatus":"unknown","product":"NetScaler ADC and NetScaler Gateway","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-adc-and-netscaler-gateway-cve-2023-4966","stacks":["cloud","vpn"],"startedAt":"2023-10-18","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. CISA added CVE-2023-4966 to its Known Exploited Vulnerabilities catalog on Oct 18, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-119"],"title":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability (CVE-2023-4966)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-4966","vendor":"Citrix"},{"auto":true,"category":"breach","closedAt":"2023-10-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PHOENIX"],"json":"https://helix.ml/threat-watch/i/phoenix-data-breach.json","latestUpdate":{"date":"2023-10-17","title":"Have I Been Pwned loaded 74K breached Phoenix accounts"},"patchStatus":"no-fix-needed","product":"phoenixim.ddns.net","severity":"high","severityNote":"74K accounts · passwords exposed","slug":"phoenix-data-breach","stacks":[],"startedAt":"2023-10-17","status":"closed","summary":"In mid-2021, the \"vintage messaging reborn\" service Phoenix suffered a data breach that exposed 75k unique email addresses. The breach also exposed IP addresses, usernames and passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jun 5, 2021; Have I Been Pwned loaded it on Oct 17, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Phoenix data breach: 74K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/phoenix-data-breach","vendor":"Phoenix"},{"auto":true,"category":"breach","closedAt":"2023-10-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANDROIDLISTA"],"json":"https://helix.ml/threat-watch/i/androidlista-data-breach.json","latestUpdate":{"date":"2023-10-17","title":"Have I Been Pwned loaded 6.6M breached AndroidLista accounts"},"patchStatus":"no-fix-needed","product":"androidlista.com","severity":"high","severityNote":"6.6M accounts · passwords exposed","slug":"androidlista-data-breach","stacks":[],"startedAt":"2023-10-17","status":"closed","summary":"In July 2021, the Android applications and games review site AndroidLista suffered a data breach. The incident exposed 6.6M user records containing email addresses, names, usernames and passwords stored as salted SHA-1 hashes, all of which were subsequently posted to a popular hacking forum. AndroidLista did not respond when contacted about the breach. Exposed data: email addresses, names, passwords, usernames. The breach dates from Jul 28, 2021; Have I Been Pwned loaded it on Oct 17, 2023.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"AndroidLista data breach: 6.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/androidlista-data-breach","vendor":"AndroidLista"},{"auto":true,"category":"patch","closedAt":"2023-10-30","cveIds":["CVE-2023-20198"],"exploited":"in-the-wild","identifiers":["CVE-2023-20198"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xe-web-ui-cve-2023-20198.json","latestUpdate":{"date":"2023-10-16","title":"CISA added CVE-2023-20198 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 20, 2023)"},"patchStatus":"unknown","product":"IOS XE Web UI","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xe-web-ui-cve-2023-20198","stacks":["ios","network"],"startedAt":"2023-10-16","status":"closed","summary":"Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device. CISA added CVE-2023-20198 to its Known Exploited Vulnerabilities catalog on Oct 16, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-420"],"title":"Cisco IOS XE Web UI Privilege Escalation Vulnerability (CVE-2023-20198)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xe-web-ui-cve-2023-20198","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2023-10-24","cveIds":["CVE-2023-21608"],"exploited":"in-the-wild","identifiers":["CVE-2023-21608"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2023-21608.json","latestUpdate":{"date":"2023-10-10","title":"CISA added CVE-2023-21608 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 31, 2023)"},"patchStatus":"unknown","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2023-21608","stacks":[],"startedAt":"2023-10-10","status":"closed","summary":"Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user. CISA added CVE-2023-21608 to its Known Exploited Vulnerabilities catalog on Oct 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Acrobat and Reader Use-After-Free Vulnerability (CVE-2023-21608)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2023-21608","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2023-10-24","cveIds":["CVE-2023-20109"],"exploited":"in-the-wild","identifiers":["CVE-2023-20109"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2023-20109.json","latestUpdate":{"date":"2023-10-10","title":"CISA added CVE-2023-20109 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 31, 2023)"},"patchStatus":"unknown","product":"IOS and IOS XE","severity":"medium","severityNote":"CVSS 6.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-cve-2023-20109","stacks":["ios","network","vpn"],"startedAt":"2023-10-10","status":"closed","summary":"Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash. CISA added CVE-2023-20109 to its Known Exploited Vulnerabilities catalog on Oct 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability (CVE-2023-20109)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2023-20109","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2023-10-24","cveIds":["CVE-2023-41763"],"exploited":"in-the-wild","identifiers":["CVE-2023-41763"],"json":"https://helix.ml/threat-watch/i/microsoft-skype-for-business-cve-2023-41763.json","latestUpdate":{"date":"2023-10-10","title":"CISA added CVE-2023-41763 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 31, 2023)"},"patchStatus":"patched","product":"Skype for Business","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-skype-for-business-cve-2023-41763","stacks":[],"startedAt":"2023-10-10","status":"closed","summary":"Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-41763 to its Known Exploited Vulnerabilities catalog on Oct 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-918"],"title":"Microsoft Skype for Business Privilege Escalation Vulnerability (CVE-2023-41763)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-skype-for-business-cve-2023-41763","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-10-24","cveIds":["CVE-2023-36563"],"exploited":"in-the-wild","identifiers":["CVE-2023-36563"],"json":"https://helix.ml/threat-watch/i/microsoft-wordpad-cve-2023-36563.json","latestUpdate":{"date":"2023-10-10","title":"CISA added CVE-2023-36563 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 31, 2023)"},"patchStatus":"patched","product":"WordPad","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-wordpad-cve-2023-36563","stacks":[],"startedAt":"2023-10-10","status":"closed","summary":"Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure. CISA added CVE-2023-36563 to its Known Exploited Vulnerabilities catalog on Oct 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Microsoft WordPad Information Disclosure Vulnerability (CVE-2023-36563)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-wordpad-cve-2023-36563","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-10-24","cveIds":["CVE-2023-44487"],"exploited":"in-the-wild","identifiers":["CVE-2023-44487"],"json":"https://helix.ml/threat-watch/i/ietf-http-2-cve-2023-44487.json","latestUpdate":{"date":"2023-10-10","title":"CISA added CVE-2023-44487 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 31, 2023)"},"patchStatus":"patched","product":"HTTP/2","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ietf-http-2-cve-2023-44487","stacks":[],"startedAt":"2023-10-10","status":"closed","summary":"HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS). CISA added CVE-2023-44487 to its Known Exploited Vulnerabilities catalog on Oct 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-400"],"title":"HTTP/2 Rapid Reset Attack Vulnerability (CVE-2023-44487)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ietf-http-2-cve-2023-44487","vendor":"IETF"},{"auto":true,"category":"breach","closedAt":"2023-10-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BVD"],"json":"https://helix.ml/threat-watch/i/bvd-data-breach.json","latestUpdate":{"date":"2023-10-09","title":"Have I Been Pwned loaded 27.9M breached Public Business Data accounts"},"patchStatus":"no-fix-needed","product":"bvdinfo.com","severity":"medium","severityNote":"27.9M accounts","slug":"bvd-data-breach","stacks":[],"startedAt":"2023-10-09","status":"closed","summary":"In approximately August 2021, hundreds of gigabytes of business data collated from public sources was obtained and later published to a popular hacking forum. Sourced from a customer of Bureau van Dijk's (BvD) \"Orbis\" product, the corpus of data released contained hundreds of millions of lines about corporations and individuals, including personal information such as names and dates of birth. The data also included 28M unique email addresses along with physical addresses (presumedly corporate locations), phone numbers and job titles. There was no unauthorised access to BvD's systems, nor did the incident expose any of their or parent company's Moody's clients. Exposed data: dates of birth, email addresses, job titles, names, phone numbers, physical addresses. The breach dates from Aug 19, 2021; Have I Been Pwned loaded it on Oct 9, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","job-titles","names","phone-numbers","physical-addresses"],"title":"Public Business Data data breach: 27.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bvd-data-breach","vendor":"Public Business Data"},{"auto":true,"category":"patch","closedAt":"2023-10-19","cveIds":["CVE-2023-22515"],"exploited":"in-the-wild","identifiers":["CVE-2023-22515"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-data-center-and-server-cve-2023-22515.json","latestUpdate":{"date":"2023-10-05","title":"CISA added CVE-2023-22515 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 13, 2023)"},"patchStatus":"unknown","product":"Confluence Data Center and Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-data-center-and-server-cve-2023-22515","stacks":["devtools","java"],"startedAt":"2023-10-05","status":"closed","summary":"Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence. CISA added CVE-2023-22515 to its Known Exploited Vulnerabilities catalog on Oct 5, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability (CVE-2023-22515)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-data-center-and-server-cve-2023-22515","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2023-10-19","cveIds":["CVE-2023-40044"],"exploited":"in-the-wild","identifiers":["CVE-2023-40044"],"json":"https://helix.ml/threat-watch/i/progress-ws-ftp-server-cve-2023-40044.json","latestUpdate":{"date":"2023-10-05","title":"CISA added CVE-2023-40044 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 26, 2023)"},"patchStatus":"unknown","product":"WS_FTP Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-ws-ftp-server-cve-2023-40044","stacks":["rust"],"startedAt":"2023-10-05","status":"closed","summary":"Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. CISA added CVE-2023-40044 to its Known Exploited Vulnerabilities catalog on Oct 5, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability (CVE-2023-40044)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/progress-ws-ftp-server-cve-2023-40044","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2023-10-19","cveIds":["CVE-2023-42824"],"exploited":"in-the-wild","identifiers":["CVE-2023-42824"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2023-42824.json","latestUpdate":{"date":"2023-10-05","title":"CISA added CVE-2023-42824 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 26, 2023)"},"patchStatus":"unknown","product":"iOS and iPadOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-ipados-cve-2023-42824","stacks":["ios","linux"],"startedAt":"2023-10-05","status":"closed","summary":"Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation. CISA added CVE-2023-42824 to its Known Exploited Vulnerabilities catalog on Oct 5, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability (CVE-2023-42824)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2023-42824","vendor":"Apple"},{"auto":true,"category":"breach","closedAt":"2023-10-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HJEDD"],"json":"https://helix.ml/threat-watch/i/hjedd-data-breach.json","latestUpdate":{"date":"2023-10-05","title":"Have I Been Pwned loaded 13.2M breached Hjedd accounts"},"patchStatus":"no-fix-needed","product":"hjedd.com","severity":"high","severityNote":"13.2M accounts · passwords exposed","slug":"hjedd-data-breach","stacks":[],"startedAt":"2023-10-05","status":"closed","summary":"In July 2022, the Chinese adult website Hjedd was found to be leaking more than 13M customer records which subsequently appeared on a popular hacking forum. The exposed data included email and IP addresses, usernames and passwords stored as bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 18, 2022; Have I Been Pwned loaded it on Oct 5, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Hjedd data breach: 13.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/hjedd-data-breach","vendor":"Hjedd"},{"auto":true,"category":"patch","closedAt":"2023-10-18","cveIds":["CVE-2023-42793"],"exploited":"in-the-wild","identifiers":["CVE-2023-42793"],"json":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2023-42793.json","latestUpdate":{"date":"2023-10-04","title":"CISA added CVE-2023-42793 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 25, 2023)"},"patchStatus":"unknown","product":"TeamCity","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jetbrains-teamcity-cve-2023-42793","stacks":["devtools"],"startedAt":"2023-10-04","status":"closed","summary":"JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server. CISA added CVE-2023-42793 to its Known Exploited Vulnerabilities catalog on Oct 4, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","auth-bypass","cwe-288"],"title":"JetBrains TeamCity Authentication Bypass Vulnerability (CVE-2023-42793)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/jetbrains-teamcity-cve-2023-42793","vendor":"JetBrains"},{"auto":true,"category":"patch","closedAt":"2023-10-18","cveIds":["CVE-2023-28229"],"exploited":"in-the-wild","identifiers":["CVE-2023-28229"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229.json","latestUpdate":{"date":"2023-10-04","title":"CISA added CVE-2023-28229 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 25, 2023)"},"patchStatus":"patched","product":"Windows CNG Key Isolation Service","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cng-key-isolation-service-cve-2023-28229","stacks":["windows"],"startedAt":"2023-10-04","status":"closed","summary":"Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges. CISA added CVE-2023-28229 to its Known Exploited Vulnerabilities catalog on Oct 4, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-591"],"title":"Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability (CVE-2023-28229)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-10-17","cveIds":["CVE-2023-4211"],"exploited":"in-the-wild","identifiers":["CVE-2023-4211"],"json":"https://helix.ml/threat-watch/i/arm-mali-gpu-kernel-driver-cve-2023-4211.json","latestUpdate":{"date":"2023-10-03","title":"CISA added CVE-2023-4211 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 24, 2023)"},"patchStatus":"unknown","product":"Mali GPU Kernel Driver","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-gpu-kernel-driver-cve-2023-4211","stacks":["linux"],"startedAt":"2023-10-03","status":"closed","summary":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. CISA added CVE-2023-4211 to its Known Exploited Vulnerabilities catalog on Oct 3, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (CVE-2023-4211)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/arm-mali-gpu-kernel-driver-cve-2023-4211","vendor":"Arm"},{"auto":true,"category":"breach","closedAt":"2023-10-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ACTIVISION"],"json":"https://helix.ml/threat-watch/i/activision-data-breach.json","latestUpdate":{"date":"2023-10-03","title":"Have I Been Pwned loaded 16K breached Activision accounts"},"patchStatus":"no-fix-needed","product":"activision.com","severity":"medium","severityNote":"16K accounts","slug":"activision-data-breach","stacks":[],"startedAt":"2023-10-03","status":"closed","summary":"In December 2022, attackers socially engineered an Activision HR employee into disclosing information which led to the breach of almost 20k employee records. The data contained 16k unique email addresses along with names, phone numbers, job titles and the office location of the employee. Activision advised that no sensitive employee information was included in the breach. Exposed data: email addresses, geographic locations, job titles, names, phone numbers. The breach dates from Dec 4, 2022; Have I Been Pwned loaded it on Oct 3, 2023.","tags":["data-breach","hibp","email-addresses","geographic-locations","job-titles","names","phone-numbers"],"title":"Activision data breach: 16K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/activision-data-breach","vendor":"Activision"},{"auto":true,"category":"patch","closedAt":"2023-10-16","cveIds":["CVE-2023-5217"],"exploited":"in-the-wild","identifiers":["CVE-2023-5217"],"json":"https://helix.ml/threat-watch/i/google-chromium-libvpx-cve-2023-5217.json","latestUpdate":{"date":"2023-10-02","title":"CISA added CVE-2023-5217 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2023)"},"patchStatus":"patched","product":"Chromium libvpx","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-libvpx-cve-2023-5217","stacks":["browser"],"startedAt":"2023-10-02","status":"closed","summary":"Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome. CISA added CVE-2023-5217 to its Known Exploited Vulnerabilities catalog on Oct 2, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium libvpx Heap Buffer Overflow Vulnerability (CVE-2023-5217)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-libvpx-cve-2023-5217","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2023-10-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HORSEISLE"],"json":"https://helix.ml/threat-watch/i/horseisle-data-breach.json","latestUpdate":{"date":"2023-10-02","title":"Have I Been Pwned loaded 27K breached Horse Isle accounts"},"patchStatus":"no-fix-needed","product":"horseisle.com","severity":"high","severityNote":"27K accounts · passwords exposed","slug":"horseisle-data-breach","stacks":[],"startedAt":"2023-10-02","status":"closed","summary":"In June 2020 then again in September that same year, Horse Isle \"The Secrent Land of Horses\" suffered a data breach. The incident exposed 28k unique email addresses along with names, usernames, IP addresses, genders, purchases and plain text passwords. The system also stored and exposed failed password attempts for each user with the password retained in plain text. Exposed data: email addresses, genders, ip addresses, names, passwords, purchases, usernames. The breach dates from Sep 19, 2020; Have I Been Pwned loaded it on Oct 2, 2023.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","names","passwords","purchases","usernames"],"title":"Horse Isle data breach: 27K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/horseisle-data-breach","vendor":"Horse Isle"},{"auto":true,"category":"patch","closedAt":"2023-10-12","cveIds":["CVE-2018-14667"],"exploited":"in-the-wild","identifiers":["CVE-2018-14667"],"json":"https://helix.ml/threat-watch/i/red-hat-jboss-richfaces-framework-cve-2018-14667.json","latestUpdate":{"date":"2023-09-28","title":"CISA added CVE-2018-14667 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 19, 2023)"},"patchStatus":"unknown","product":"JBoss RichFaces Framework","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-jboss-richfaces-framework-cve-2018-14667","stacks":["java","linux","node"],"startedAt":"2023-09-28","status":"closed","summary":"Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData. CISA added CVE-2018-14667 to its Known Exploited Vulnerabilities catalog on Sep 28, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-94"],"title":"Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability (CVE-2018-14667)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/red-hat-jboss-richfaces-framework-cve-2018-14667","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2023-10-09","cveIds":["CVE-2023-41991"],"exploited":"in-the-wild","identifiers":["CVE-2023-41991"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41991.json","latestUpdate":{"date":"2023-09-25","title":"CISA added CVE-2023-41991 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2023)"},"patchStatus":"unknown","product":"Multiple Products","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-41991","stacks":[],"startedAt":"2023-09-25","status":"closed","summary":"Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. CISA added CVE-2023-41991 to its Known Exploited Vulnerabilities catalog on Sep 25, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-295"],"title":"Apple Multiple Products Improper Certificate Validation Vulnerability (CVE-2023-41991)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41991","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-10-09","cveIds":["CVE-2023-41992"],"exploited":"in-the-wild","identifiers":["CVE-2023-41992"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41992.json","latestUpdate":{"date":"2023-09-25","title":"CISA added CVE-2023-41992 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2023)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-41992","stacks":["linux"],"startedAt":"2023-09-25","status":"closed","summary":"Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. CISA added CVE-2023-41992 to its Known Exploited Vulnerabilities catalog on Sep 25, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-754"],"title":"Apple Multiple Products Kernel Privilege Escalation Vulnerability (CVE-2023-41992)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41992","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-10-09","cveIds":["CVE-2023-41993"],"exploited":"in-the-wild","identifiers":["CVE-2023-41993"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41993.json","latestUpdate":{"date":"2023-09-25","title":"CISA added CVE-2023-41993 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2023)"},"patchStatus":"unknown","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-41993","stacks":["browser","ios"],"startedAt":"2023-09-25","status":"closed","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-41993 to its Known Exploited Vulnerabilities catalog on Sep 25, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-754"],"title":"Apple Multiple Products WebKit Code Execution Vulnerability (CVE-2023-41993)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-41993","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-10-05","cveIds":["CVE-2023-41179"],"exploited":"in-the-wild","identifiers":["CVE-2023-41179"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-worry-free-business-security-cve-2023-41179.json","latestUpdate":{"date":"2023-09-21","title":"CISA added CVE-2023-41179 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 12, 2023)"},"patchStatus":"unknown","product":"Apex One and Worry-Free Business Security","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-and-worry-free-business-security-cve-2023-41179","stacks":[],"startedAt":"2023-09-21","status":"closed","summary":"Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability. CISA added CVE-2023-41179 to its Known Exploited Vulnerabilities catalog on Sep 21, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability (CVE-2023-41179)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-worry-free-business-security-cve-2023-41179","vendor":"Trend Micro"},{"auto":true,"category":"breach","closedAt":"2023-10-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DBFORUMS"],"json":"https://helix.ml/threat-watch/i/dbforums-data-breach.json","latestUpdate":{"date":"2023-09-20","title":"Have I Been Pwned loaded 363K breached dBforums accounts"},"patchStatus":"no-fix-needed","product":"dbforums.com","severity":"high","severityNote":"363K accounts · passwords exposed","slug":"dbforums-data-breach","stacks":[],"startedAt":"2023-09-20","status":"closed","summary":"In July 2016, a data breach of the now defunct database forum \"dBforums\" appeared for sale alongside several others hacked from the parent company, Penton. The breach of the vBulletin based forum contained 363k unique email addresses alongside usernames, IP addresses, dates of birth and salted MD5 password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jul 4, 2016; Have I Been Pwned loaded it on Sep 20, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"dBforums data breach: 363K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/dbforums-data-breach","vendor":"dBforums"},{"auto":true,"category":"patch","closedAt":"2023-10-03","cveIds":["CVE-2023-28434"],"exploited":"in-the-wild","identifiers":["CVE-2023-28434"],"json":"https://helix.ml/threat-watch/i/minio-minio-cve-2023-28434.json","latestUpdate":{"date":"2023-09-19","title":"CISA added CVE-2023-28434 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 10, 2023)"},"patchStatus":"patched","product":"MinIO","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"minio-minio-cve-2023-28434","stacks":[],"startedAt":"2023-09-19","status":"closed","summary":"MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. CISA added CVE-2023-28434 to its Known Exploited Vulnerabilities catalog on Sep 19, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-269"],"title":"MinIO Security Feature Bypass Vulnerability (CVE-2023-28434)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/minio-minio-cve-2023-28434","vendor":"MinIO"},{"auto":true,"category":"patch","closedAt":"2023-10-02","cveIds":["CVE-2022-22265"],"exploited":"in-the-wild","identifiers":["CVE-2022-22265"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2022-22265.json","latestUpdate":{"date":"2023-09-18","title":"CISA added CVE-2022-22265 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2023)"},"patchStatus":"unknown","product":"Mobile Devices","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2022-22265","stacks":[],"startedAt":"2023-09-18","status":"closed","summary":"Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution. CISA added CVE-2022-22265 to its Known Exploited Vulnerabilities catalog on Sep 18, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-703"],"title":"Samsung Mobile Devices Use-After-Free Vulnerability (CVE-2022-22265)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2022-22265","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2023-10-02","cveIds":["CVE-2014-8361"],"exploited":"in-the-wild","identifiers":["CVE-2014-8361"],"json":"https://helix.ml/threat-watch/i/realtek-sdk-cve-2014-8361.json","latestUpdate":{"date":"2023-09-18","title":"CISA added CVE-2014-8361 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2023)"},"patchStatus":"unknown","product":"SDK","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"realtek-sdk-cve-2014-8361","stacks":[],"startedAt":"2023-09-18","status":"closed","summary":"Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request. CISA added CVE-2014-8361 to its Known Exploited Vulnerabilities catalog on Sep 18, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Realtek SDK Improper Input Validation Vulnerability (CVE-2014-8361)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/realtek-sdk-cve-2014-8361","vendor":"Realtek"},{"auto":true,"category":"patch","closedAt":"2023-10-02","cveIds":["CVE-2017-6884"],"exploited":"in-the-wild","identifiers":["CVE-2017-6884"],"json":"https://helix.ml/threat-watch/i/zyxel-emg2926-routers-cve-2017-6884.json","latestUpdate":{"date":"2023-09-18","title":"CISA added CVE-2017-6884 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2023)"},"patchStatus":"unknown","product":"EMG2926 Routers","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-emg2926-routers-cve-2017-6884","stacks":["network"],"startedAt":"2023-09-18","status":"closed","summary":"Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI. CISA added CVE-2017-6884 to its Known Exploited Vulnerabilities catalog on Sep 18, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"Zyxel EMG2926 Routers Command Injection Vulnerability (CVE-2017-6884)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/zyxel-emg2926-routers-cve-2017-6884","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2023-10-02","cveIds":["CVE-2021-3129"],"exploited":"in-the-wild","identifiers":["CVE-2021-3129"],"json":"https://helix.ml/threat-watch/i/laravel-ignition-cve-2021-3129.json","latestUpdate":{"date":"2023-09-18","title":"CISA added CVE-2021-3129 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 9, 2023)"},"patchStatus":"patched","product":"Ignition","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"laravel-ignition-cve-2021-3129","stacks":["php"],"startedAt":"2023-09-18","status":"closed","summary":"Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents(). CISA added CVE-2021-3129 to its Known Exploited Vulnerabilities catalog on Sep 18, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Laravel Ignition File Upload Vulnerability (CVE-2021-3129)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/laravel-ignition-cve-2021-3129","vendor":"Laravel"},{"auto":true,"category":"patch","closedAt":"2023-09-28","cveIds":["CVE-2023-26369"],"exploited":"in-the-wild","identifiers":["CVE-2023-26369"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2023-26369.json","latestUpdate":{"date":"2023-09-14","title":"CISA added CVE-2023-26369 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2023)"},"patchStatus":"unknown","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2023-26369","stacks":[],"startedAt":"2023-09-14","status":"closed","summary":"Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution. CISA added CVE-2023-26369 to its Known Exploited Vulnerabilities catalog on Sep 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability (CVE-2023-26369)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2023-26369","vendor":"Adobe"},{"auto":true,"category":"breach","closedAt":"2023-09-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MALINDOAIR"],"json":"https://helix.ml/threat-watch/i/malindoair-data-breach.json","latestUpdate":{"date":"2023-09-14","title":"Have I Been Pwned loaded 4.3M breached MalindoAir accounts"},"patchStatus":"no-fix-needed","product":"malindoair.com","severity":"medium","severityNote":"4.3M accounts","slug":"malindoair-data-breach","stacks":[],"startedAt":"2023-09-14","status":"closed","summary":"In early 2019, the Malaysian airline Malindo Air suffered a data breach that exposed tens of millions of customer records. Containing 4.3M unique email addresses, the breach also exposed extensive personal information including names, dates of birth, genders, physical addresses, phone numbers and passport details. The data was later extensively shared on popular hacking forums. Exposed data: dates of birth, email addresses, genders, loyalty program details, names, nationalities, passport numbers, phone numbers, physical addresses, salutations. The breach dates from Mar 1, 2019; Have I Been Pwned loaded it on Sep 14, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","loyalty-program-details","names","nationalities","passport-numbers","phone-numbers","physical-addresses","salutations"],"title":"MalindoAir data breach: 4.3M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/malindoair-data-breach","vendor":"MalindoAir"},{"auto":true,"category":"patch","closedAt":"2023-09-27","cveIds":["CVE-2023-35674"],"exploited":"in-the-wild","identifiers":["CVE-2023-35674"],"json":"https://helix.ml/threat-watch/i/android-framework-cve-2023-35674.json","latestUpdate":{"date":"2023-09-13","title":"CISA added CVE-2023-35674 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 4, 2023)"},"patchStatus":"patched","product":"Framework","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-framework-cve-2023-35674","stacks":["android"],"startedAt":"2023-09-13","status":"closed","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-35674 to its Known Exploited Vulnerabilities catalog on Sep 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Android Framework Privilege Escalation Vulnerability (CVE-2023-35674)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/android-framework-cve-2023-35674","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2023-09-27","cveIds":["CVE-2023-20269"],"exploited":"in-the-wild","identifiers":["CVE-2023-20269"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-and-firepower-threat-defense-cve-2023-20269.json","latestUpdate":{"date":"2023-09-13","title":"CISA added CVE-2023-20269 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 4, 2023)"},"patchStatus":"unknown","product":"Adaptive Security Appliance and Firepower Threat Defense","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-and-firepower-threat-defense-cve-2023-20269","stacks":["network"],"startedAt":"2023-09-13","status":"closed","summary":"Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. CISA added CVE-2023-20269 to its Known Exploited Vulnerabilities catalog on Sep 13, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-288"],"title":"Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability (CVE-2023-20269)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-and-firepower-threat-defense-cve-2023-20269","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2023-09-27","cveIds":["CVE-2023-4863"],"exploited":"in-the-wild","identifiers":["CVE-2023-4863"],"json":"https://helix.ml/threat-watch/i/google-chromium-webp-cve-2023-4863.json","latestUpdate":{"date":"2023-09-13","title":"CISA added CVE-2023-4863 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 4, 2023)"},"patchStatus":"patched","product":"Chromium WebP","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-webp-cve-2023-4863","stacks":["browser"],"startedAt":"2023-09-13","status":"closed","summary":"Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec. CISA added CVE-2023-4863 to its Known Exploited Vulnerabilities catalog on Sep 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium WebP Heap-Based Buffer Overflow Vulnerability (CVE-2023-4863)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/google-chromium-webp-cve-2023-4863","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2023-09-26","cveIds":["CVE-2023-36761"],"exploited":"in-the-wild","identifiers":["CVE-2023-36761"],"json":"https://helix.ml/threat-watch/i/microsoft-word-cve-2023-36761.json","latestUpdate":{"date":"2023-09-12","title":"CISA added CVE-2023-36761 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 3, 2023)"},"patchStatus":"patched","product":"Word","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-word-cve-2023-36761","stacks":[],"startedAt":"2023-09-12","status":"closed","summary":"Microsoft Word contains an unspecified vulnerability that allows for information disclosure. CISA added CVE-2023-36761 to its Known Exploited Vulnerabilities catalog on Sep 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-668"],"title":"Microsoft Word Information Disclosure Vulnerability (CVE-2023-36761)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-word-cve-2023-36761","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-09-26","cveIds":["CVE-2023-36802"],"exploited":"in-the-wild","identifiers":["CVE-2023-36802"],"json":"https://helix.ml/threat-watch/i/microsoft-streaming-service-proxy-cve-2023-36802.json","latestUpdate":{"date":"2023-09-12","title":"CISA added CVE-2023-36802 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 3, 2023)"},"patchStatus":"patched","product":"Streaming Service Proxy","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-streaming-service-proxy-cve-2023-36802","stacks":[],"startedAt":"2023-09-12","status":"closed","summary":"Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-36802 to its Known Exploited Vulnerabilities catalog on Sep 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Microsoft Streaming Service Proxy Privilege Escalation Vulnerability (CVE-2023-36802)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-streaming-service-proxy-cve-2023-36802","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-09-25","cveIds":["CVE-2023-41064"],"exploited":"in-the-wild","identifiers":["CVE-2023-41064"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2023-41064.json","latestUpdate":{"date":"2023-09-11","title":"CISA added CVE-2023-41064 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 2, 2023)"},"patchStatus":"unknown","product":"iOS, iPadOS, and macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2023-41064","stacks":["ios","macos"],"startedAt":"2023-09-11","status":"closed","summary":"Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061. CISA added CVE-2023-41064 to its Known Exploited Vulnerabilities catalog on Sep 11, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-120"],"title":"Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability (CVE-2023-41064)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2023-41064","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-09-25","cveIds":["CVE-2023-41061"],"exploited":"in-the-wild","identifiers":["CVE-2023-41061"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2023-41061.json","latestUpdate":{"date":"2023-09-11","title":"CISA added CVE-2023-41061 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 2, 2023)"},"patchStatus":"unknown","product":"iOS, iPadOS, and watchOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-watchos-cve-2023-41061","stacks":["ios"],"startedAt":"2023-09-11","status":"closed","summary":"Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064. CISA added CVE-2023-41061 to its Known Exploited Vulnerabilities catalog on Sep 11, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability (CVE-2023-41061)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2023-41061","vendor":"Apple"},{"auto":true,"category":"breach","closedAt":"2023-09-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VIVAAIR"],"json":"https://helix.ml/threat-watch/i/vivaair-data-breach.json","latestUpdate":{"date":"2023-09-11","title":"Have I Been Pwned loaded 932K breached Viva Air accounts"},"patchStatus":"no-fix-needed","product":"vivaair.com","severity":"high","severityNote":"932K accounts · financial data exposed","slug":"vivaair-data-breach","stacks":[],"startedAt":"2023-09-11","status":"closed","summary":"In March 2022, the now defunct Colombian airline Viva Air suffered a data breach and subsequent ransomware attack. Among a trove of other ransomed data, the incident exposed a log of 2.6M transactions with 932k unique email addresses, physical and IP addresses, names, phone numbers and partial credit card data (last 4 digits). Exposed data: email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Mar 14, 2022; Have I Been Pwned loaded it on Sep 11, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"Viva Air data breach: 932K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/vivaair-data-breach","vendor":"Viva Air"},{"auto":true,"category":"breach","closedAt":"2023-09-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DYMOCKS"],"json":"https://helix.ml/threat-watch/i/dymocks-data-breach.json","latestUpdate":{"date":"2023-09-08","title":"Have I Been Pwned loaded 836K breached Dymocks accounts"},"patchStatus":"no-fix-needed","product":"dymocks.com.au","severity":"medium","severityNote":"836K accounts","slug":"dymocks-data-breach","stacks":[],"startedAt":"2023-09-08","status":"closed","summary":"In September 2023, the Australian book retailer Dymocks announced a data breach. The data dated back to June 2023 and contained 1.2M records with 836k unique email addresses. The breach also exposed names, dates of birth, genders, phone numbers and physical addresses. Exposed data: dates of birth, email addresses, genders, names, phone numbers, physical addresses. The breach dates from Jun 20, 2023; Have I Been Pwned loaded it on Sep 8, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"Dymocks data breach: 836K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/dymocks-data-breach","vendor":"Dymocks"},{"auto":true,"category":"patch","closedAt":"2023-09-20","cveIds":["CVE-2023-33246"],"exploited":"in-the-wild","identifiers":["CVE-2023-33246"],"json":"https://helix.ml/threat-watch/i/apache-rocketmq-cve-2023-33246.json","latestUpdate":{"date":"2023-09-06","title":"CISA added CVE-2023-33246 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 27, 2023)"},"patchStatus":"unknown","product":"RocketMQ","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-rocketmq-cve-2023-33246","stacks":[],"startedAt":"2023-09-06","status":"closed","summary":"Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content. CISA added CVE-2023-33246 to its Known Exploited Vulnerabilities catalog on Sep 6, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-94"],"title":"Apache RocketMQ Command Execution Vulnerability (CVE-2023-33246)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/apache-rocketmq-cve-2023-33246","vendor":"Apache"},{"auto":true,"category":"breach","closedAt":"2023-09-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PLAYCYBERGAMES"],"json":"https://helix.ml/threat-watch/i/playcybergames-data-breach.json","latestUpdate":{"date":"2023-08-31","title":"Have I Been Pwned loaded 3.7M breached PlayCyberGames accounts"},"patchStatus":"no-fix-needed","product":"playcybergames.com","severity":"high","severityNote":"3.7M accounts · passwords exposed","slug":"playcybergames-data-breach","stacks":[],"startedAt":"2023-08-31","status":"closed","summary":"In August 2023, PlayCyberGames which \"allows users to play any games with LAN function or games using IP address\" suffered a data breach which exposed 3.7M customer records. The data included email addresses, usernames and MD5 password hashes with a constant value in the \"salt\" field. PlayCyberGames did not respond to multiple attempts to disclose the breach. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 9, 2023; Have I Been Pwned loaded it on Aug 31, 2023.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"PlayCyberGames data breach: 3.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/playcybergames-data-breach","vendor":"PlayCyberGames"},{"auto":true,"category":"breach","closedAt":"2023-09-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PAMPLING"],"json":"https://helix.ml/threat-watch/i/pampling-data-breach.json","latestUpdate":{"date":"2023-08-31","title":"Have I Been Pwned loaded 383K breached Pampling accounts"},"patchStatus":"no-fix-needed","product":"pampling.com","severity":"high","severityNote":"383K accounts · passwords exposed","slug":"pampling-data-breach","stacks":[],"startedAt":"2023-08-31","status":"closed","summary":"In January 2020, the online clothing retailer Pampling suffered a data breach that exposed 383k unique customer email addresses. The data was later shared on a popular hacking forum and also included names, usernames and unsalted MD5 password hashes. Exposed data: email addresses, names, passwords, usernames. The breach dates from Jan 4, 2020; Have I Been Pwned loaded it on Aug 31, 2023.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"Pampling data breach: 383K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/pampling-data-breach","vendor":"Pampling"},{"auto":true,"category":"breach","closedAt":"2023-09-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CERTPOLANDPHISH"],"json":"https://helix.ml/threat-watch/i/certpolandphish-data-breach.json","latestUpdate":{"date":"2023-08-31","title":"Have I Been Pwned loaded 67K breached Phished Data via CERT Poland accounts"},"patchStatus":"no-fix-needed","product":"Phished Data via CERT Poland","severity":"high","severityNote":"67K accounts · passwords exposed","slug":"certpolandphish-data-breach","stacks":[],"startedAt":"2023-08-31","status":"closed","summary":"In August 2023, CERT Poland observed a phishing campaign that collected credentials from 68k victims. The campaign collected email addresses and passwords via a phishing email masquerading as a purchase order confirmation. CERT Poland identified a further 202 other phishing campaigns operating on the same C2 server, which has now been dismantled. Exposed data: email addresses, passwords. The breach dates from Feb 25, 2023; Have I Been Pwned loaded it on Aug 31, 2023.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Phished Data via CERT Poland data breach: 67K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/certpolandphish-data-breach","vendor":"Phished Data via CERT Poland"},{"auto":true,"category":"breach","closedAt":"2023-09-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QAKBOT"],"json":"https://helix.ml/threat-watch/i/qakbot-data-breach.json","latestUpdate":{"date":"2023-08-29","title":"Have I Been Pwned loaded 6.4M breached Qakbot accounts"},"patchStatus":"no-fix-needed","product":"Qakbot","severity":"high","severityNote":"6.4M accounts · passwords exposed","slug":"qakbot-data-breach","stacks":[],"startedAt":"2023-08-29","status":"closed","summary":"In August 2023, the US Justice Department announced a multinational operation involving actions in the United States, France, Germany, the Netherlands, and the United Kingdom to disrupt the botnet and malware known as Qakbot and take down its infrastructure. After the takedown, 6.43M email addresses were provided to HIBP to help notify victims of the malware. Exposed data: email addresses, passwords. The breach dates from Aug 29, 2023; Have I Been Pwned loaded it on Aug 29, 2023.","tags":["data-breach","hibp","malware","email-addresses","passwords"],"title":"Qakbot data breach: 6.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/qakbot-data-breach","vendor":"Qakbot"},{"auto":true,"category":"patch","closedAt":"2023-09-07","cveIds":["CVE-2023-38831"],"exploited":"in-the-wild","identifiers":["CVE-2023-38831"],"json":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2023-38831.json","latestUpdate":{"date":"2023-08-24","title":"CISA added CVE-2023-38831 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 14, 2023)"},"patchStatus":"unknown","product":"WinRAR","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"rarlab-winrar-cve-2023-38831","stacks":[],"startedAt":"2023-08-24","status":"closed","summary":"RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive. CISA added CVE-2023-38831 to its Known Exploited Vulnerabilities catalog on Aug 24, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-351"],"title":"RARLAB WinRAR Code Execution Vulnerability (CVE-2023-38831)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2023-38831","vendor":"RARLAB"},{"auto":true,"category":"patch","closedAt":"2023-09-07","cveIds":["CVE-2023-32315"],"exploited":"in-the-wild","identifiers":["CVE-2023-32315"],"json":"https://helix.ml/threat-watch/i/ignite-realtime-openfire-cve-2023-32315.json","latestUpdate":{"date":"2023-08-24","title":"CISA added CVE-2023-32315 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 14, 2023)"},"patchStatus":"patched","product":"Openfire","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ignite-realtime-openfire-cve-2023-32315","stacks":[],"startedAt":"2023-08-24","status":"closed","summary":"Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users. CISA added CVE-2023-32315 to its Known Exploited Vulnerabilities catalog on Aug 24, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Ignite Realtime Openfire Path Traversal Vulnerability (CVE-2023-32315)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ignite-realtime-openfire-cve-2023-32315","vendor":"Ignite Realtime"},{"auto":true,"category":"breach","closedAt":"2023-09-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SEVENROOMS"],"json":"https://helix.ml/threat-watch/i/sevenrooms-data-breach.json","latestUpdate":{"date":"2023-08-24","title":"Have I Been Pwned loaded 1.2M breached SevenRooms accounts"},"patchStatus":"no-fix-needed","product":"sevenrooms.com","severity":"medium","severityNote":"1.2M accounts","slug":"sevenrooms-data-breach","stacks":[],"startedAt":"2023-08-24","status":"closed","summary":"In December 2022, over 400GB of data belonging to restaurant customer management platform SevenRooms was posted for sale to a popular hacking forum. The data included 1.2M unique email addresses alongside names and purchases. SevenRooms advised that the breach was due to unauthorised access of \"a file transfer interface of a third-party vendor\". Exposed data: email addresses, names, purchases. The breach dates from Dec 11, 2022; Have I Been Pwned loaded it on Aug 24, 2023.","tags":["data-breach","hibp","email-addresses","names","purchases"],"title":"SevenRooms data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/sevenrooms-data-breach","vendor":"SevenRooms"},{"auto":true,"category":"breach","closedAt":"2023-09-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DUOLINGO"],"json":"https://helix.ml/threat-watch/i/duolingo-data-breach.json","latestUpdate":{"date":"2023-08-23","title":"Have I Been Pwned loaded 2.7M breached Duolingo accounts"},"patchStatus":"no-fix-needed","product":"duolingo.com","severity":"medium","severityNote":"2.7M accounts","slug":"duolingo-data-breach","stacks":[],"startedAt":"2023-08-23","status":"closed","summary":"In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum. Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, names, the languages being learned, XP (experience points), and other data related to learning progress on Duolingo. Whilst some of the data attributes are intentionally public, the ability to map private email addresses to them presents an ongoing risk to user privacy. Exposed data: email addresses, names, spoken languages, usernames. The breach dates from Jan 24, 2023; Have I Been Pwned loaded it on Aug 23, 2023.","tags":["data-breach","hibp","email-addresses","names","spoken-languages","usernames"],"title":"Duolingo data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/duolingo-data-breach","vendor":"Duolingo"},{"auto":true,"category":"patch","closedAt":"2023-09-05","cveIds":["CVE-2023-38035"],"exploited":"in-the-wild","identifiers":["CVE-2023-38035"],"json":"https://helix.ml/threat-watch/i/ivanti-sentry-cve-2023-38035.json","latestUpdate":{"date":"2023-08-22","title":"CISA added CVE-2023-38035 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 12, 2023)"},"patchStatus":"unknown","product":"Sentry","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-sentry-cve-2023-38035","stacks":[],"startedAt":"2023-08-22","status":"closed","summary":"Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. CISA added CVE-2023-38035 to its Known Exploited Vulnerabilities catalog on Aug 22, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-863"],"title":"Ivanti Sentry Authentication Bypass Vulnerability (CVE-2023-38035)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-sentry-cve-2023-38035","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2023-09-05","cveIds":["CVE-2023-27532"],"exploited":"in-the-wild","identifiers":["CVE-2023-27532"],"json":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2023-27532.json","latestUpdate":{"date":"2023-08-22","title":"CISA added CVE-2023-27532 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 12, 2023)"},"patchStatus":"unknown","product":"Backup \u0026 Replication","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"veeam-backup-replication-cve-2023-27532","stacks":[],"startedAt":"2023-08-22","status":"closed","summary":"Veeam Backup \u0026 Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts. CISA added CVE-2023-27532 to its Known Exploited Vulnerabilities catalog on Aug 22, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-306"],"title":"Veeam Backup \u0026 Replication Cloud Connect Missing Authentication for Critical Function Vulnerability (CVE-2023-27532)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2023-27532","vendor":"Veeam"},{"auto":true,"category":"breach","closedAt":"2023-09-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ATMELTOMO"],"json":"https://helix.ml/threat-watch/i/atmeltomo-data-breach.json","latestUpdate":{"date":"2023-08-22","title":"Have I Been Pwned loaded 580K breached Atmeltomo accounts"},"patchStatus":"no-fix-needed","product":"atmeltomo.com","severity":"high","severityNote":"580K accounts · passwords exposed","slug":"atmeltomo-data-breach","stacks":[],"startedAt":"2023-08-22","status":"closed","summary":"In April 2021, \"Japan's largest e-mail friend search site\" Atmeltomo suffered a data breach that was later sold on a popular hacking forum. The breach exposed 1.3M records with 580k unique email addresses along with usernames, IP addresses and unsalted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 16, 2021; Have I Been Pwned loaded it on Aug 22, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Atmeltomo data breach: 580K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/atmeltomo-data-breach","vendor":"Atmeltomo"},{"auto":true,"category":"patch","closedAt":"2023-09-04","cveIds":["CVE-2023-26359"],"exploited":"in-the-wild","identifiers":["CVE-2023-26359"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-26359.json","latestUpdate":{"date":"2023-08-21","title":"CISA added CVE-2023-26359 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 11, 2023)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2023-26359","stacks":["rust"],"startedAt":"2023-08-21","status":"closed","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. CISA added CVE-2023-26359 to its Known Exploited Vulnerabilities catalog on Aug 21, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-26359)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-26359","vendor":"Adobe"},{"auto":true,"category":"breach","closedAt":"2023-09-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ECCIE"],"json":"https://helix.ml/threat-watch/i/eccie-data-breach.json","latestUpdate":{"date":"2023-08-21","title":"Have I Been Pwned loaded 536K breached ECCIE accounts"},"patchStatus":"no-fix-needed","product":"eccie.net","severity":"high","severityNote":"536K accounts · passwords exposed","slug":"eccie-data-breach","stacks":[],"startedAt":"2023-08-21","status":"closed","summary":"In January 2021, the adult escort forum ECCIE suffered a data breach which was later posted to a popular hacking forum. The data included 536k user records with email and IP addresses, usernames, dates of birth and salted MD5 password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2021; Have I Been Pwned loaded it on Aug 21, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"ECCIE data breach: 536K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/eccie-data-breach","vendor":"ECCIE"},{"auto":true,"category":"breach","closedAt":"2023-08-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IMENU360"],"json":"https://helix.ml/threat-watch/i/imenu360-data-breach.json","latestUpdate":{"date":"2023-08-17","title":"Have I Been Pwned loaded 3.4M breached iMenu360 accounts"},"patchStatus":"no-fix-needed","product":"imenu360.com","severity":"medium","severityNote":"3.4M accounts","slug":"imenu360-data-breach","stacks":[],"startedAt":"2023-08-17","status":"closed","summary":"In approximately late 2022, 3.4M customer records from iMenu360 (\"The world's #1 most trusted online ordering platform\") were exposed. The data appeared to be from ordering systems using the platform and contained email and physical addresses, latitudes and longitudes, names and phone numbers. Numerous attempts were made to contact iMenu360 about the incident between April and August 2023, but no response was received. Exposed data: email addresses, latitude and longitude pairs, names, phone numbers, physical addresses. The breach dates from Aug 11, 2022; Have I Been Pwned loaded it on Aug 17, 2023.","tags":["data-breach","hibp","email-addresses","latitude-and-longitude-pairs","names","phone-numbers","physical-addresses"],"title":"iMenu360 data breach: 3.4M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/imenu360-data-breach","vendor":"iMenu360"},{"auto":true,"category":"patch","closedAt":"2023-08-30","cveIds":["CVE-2023-24489"],"exploited":"in-the-wild","identifiers":["CVE-2023-24489"],"json":"https://helix.ml/threat-watch/i/citrix-content-collaboration-cve-2023-24489.json","latestUpdate":{"date":"2023-08-16","title":"CISA added CVE-2023-24489 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 6, 2023)"},"patchStatus":"unknown","product":"Content Collaboration","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-content-collaboration-cve-2023-24489","stacks":["cloud"],"startedAt":"2023-08-16","status":"closed","summary":"Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers. CISA added CVE-2023-24489 to its Known Exploited Vulnerabilities catalog on Aug 16, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Citrix Content Collaboration ShareFile Improper Access Control Vulnerability (CVE-2023-24489)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/citrix-content-collaboration-cve-2023-24489","vendor":"Citrix"},{"auto":true,"category":"breach","closedAt":"2023-08-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JOBZONE"],"json":"https://helix.ml/threat-watch/i/jobzone-data-breach.json","latestUpdate":{"date":"2023-08-15","title":"Have I Been Pwned loaded 29K breached Jobzone accounts"},"patchStatus":"no-fix-needed","product":"jobzone.co.il","severity":"medium","severityNote":"29K accounts","slug":"jobzone-data-breach","stacks":[],"startedAt":"2023-08-15","status":"closed","summary":"In April 2023, data from the Israeli jobs website Jobzone was posted online. The data included 30k records of email addresses, names, social security numbers, genders, dates of birth, fathers' names and physical addresses. Exposed data: dates of birth, email addresses, family members' names, genders, government issued ids, names, phone numbers, physical addresses. The breach dates from Apr 15, 2023; Have I Been Pwned loaded it on Aug 15, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","family-members-names","genders","government-issued-ids","names","phone-numbers","physical-addresses"],"title":"Jobzone data breach: 29K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/jobzone-data-breach","vendor":"Jobzone"},{"auto":true,"category":"breach","closedAt":"2023-08-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RIGHTBIZ"],"json":"https://helix.ml/threat-watch/i/rightbiz-data-breach.json","latestUpdate":{"date":"2023-08-10","title":"Have I Been Pwned loaded 65K breached Rightbiz accounts"},"patchStatus":"no-fix-needed","product":"rightdev.co.uk","severity":"medium","severityNote":"65K accounts","slug":"rightbiz-data-breach","stacks":[],"startedAt":"2023-08-10","status":"closed","summary":"In June 2023, data belonging to the \"UK's No.1 Business Marketplace\" Rightbiz appeared on a popular hacking forum. Comprising of more than 18M rows of data, the breach included 65k unique email addresses along with names, phone numbers and physical address. Rightbiz didn't respond to mulitple attempts to disclose the incident./a\u003e. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jul 9, 2023; Have I Been Pwned loaded it on Aug 10, 2023.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Rightbiz data breach: 65K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/rightbiz-data-breach","vendor":"Rightbiz"},{"auto":true,"category":"patch","closedAt":"2023-08-23","cveIds":["CVE-2023-38180"],"exploited":"in-the-wild","identifiers":["CVE-2023-38180"],"json":"https://helix.ml/threat-watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180.json","latestUpdate":{"date":"2023-08-09","title":"CISA added CVE-2023-38180 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 30, 2023)"},"patchStatus":"patched","product":".NET Core and Visual Studio","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-net-core-and-visual-studio-cve-2023-38180","stacks":["devtools","dotnet"],"startedAt":"2023-08-09","status":"closed","summary":"Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS). CISA added CVE-2023-38180 to its Known Exploited Vulnerabilities catalog on Aug 9, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability (CVE-2023-38180)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2023-08-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CRAFTRISE"],"json":"https://helix.ml/threat-watch/i/craftrise-data-breach.json","latestUpdate":{"date":"2023-08-08","title":"Have I Been Pwned loaded 2.5M breached CraftRise accounts"},"patchStatus":"no-fix-needed","product":"craftrise.com.tr","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"craftrise-data-breach","stacks":[],"startedAt":"2023-08-08","status":"closed","summary":"In May 2023, news broke of a data breach of the Turkish Minecraft server known as CraftRise. The data of over 2.5M users was subsequently shared on a popular hacking forum and included email addresses, usernames, geographic locations and plain text passwords. The newest records indicate the data was obtained in March 2022. Exposed data: email addresses, geographic locations, passwords, usernames. The breach dates from Mar 5, 2022; Have I Been Pwned loaded it on Aug 8, 2023.","tags":["data-breach","hibp","email-addresses","geographic-locations","passwords","usernames"],"title":"CraftRise data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/craftrise-data-breach","vendor":"CraftRise"},{"auto":true,"category":"patch","closedAt":"2023-08-21","cveIds":["CVE-2017-18368"],"exploited":"in-the-wild","identifiers":["CVE-2017-18368"],"json":"https://helix.ml/threat-watch/i/zyxel-p660hn-t1a-routers-cve-2017-18368.json","latestUpdate":{"date":"2023-08-07","title":"CISA added CVE-2017-18368 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 28, 2023)"},"patchStatus":"unknown","product":"P660HN-T1A Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-p660hn-t1a-routers-cve-2017-18368","stacks":["network"],"startedAt":"2023-08-07","status":"closed","summary":"Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page. CISA added CVE-2017-18368 to its Known Exploited Vulnerabilities catalog on Aug 7, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zyxel P660HN-T1A Routers Command Injection Vulnerability (CVE-2017-18368)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/zyxel-p660hn-t1a-routers-cve-2017-18368","vendor":"Zyxel"},{"auto":true,"category":"breach","closedAt":"2023-08-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MAGICDUEL"],"json":"https://helix.ml/threat-watch/i/magicduel-data-breach.json","latestUpdate":{"date":"2023-08-02","title":"Have I Been Pwned loaded 138K breached MagicDuel accounts"},"patchStatus":"no-fix-needed","product":"magicduel.com","severity":"high","severityNote":"138K accounts · passwords exposed","slug":"magicduel-data-breach","stacks":[],"startedAt":"2023-08-02","status":"closed","summary":"In August 2023, the MagicDuel Adventure website suffered a data breach that exposed 138k user records. The data included player names, email and IP addresses and bcrypt password hashes. Exposed data: email addresses, ip addresses, nicknames, passwords. The breach dates from Aug 2, 2023; Have I Been Pwned loaded it on Aug 2, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","nicknames","passwords"],"title":"MagicDuel data breach: 138K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/magicduel-data-breach","vendor":"MagicDuel"},{"auto":true,"category":"patch","closedAt":"2023-08-14","cveIds":["CVE-2023-35081"],"exploited":"in-the-wild","identifiers":["CVE-2023-35081"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2023-35081.json","latestUpdate":{"date":"2023-07-31","title":"CISA added CVE-2023-35081 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 21, 2023)"},"patchStatus":"unknown","product":"Endpoint Manager Mobile (EPMM)","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-cve-2023-35081","stacks":[],"startedAt":"2023-07-31","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable). CISA added CVE-2023-35081 to its Known Exploited Vulnerabilities catalog on Jul 31, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","path-traversal","cwe-22"],"title":"Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability (CVE-2023-35081)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2023-35081","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2023-08-10","cveIds":["CVE-2023-37580"],"exploited":"in-the-wild","identifiers":["CVE-2023-37580"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2023-37580.json","latestUpdate":{"date":"2023-07-27","title":"CISA added CVE-2023-37580 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 17, 2023)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2023-37580","stacks":[],"startedAt":"2023-07-27","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data. CISA added CVE-2023-37580 to its Known Exploited Vulnerabilities catalog on Jul 27, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2023-37580)","updatedAt":"2026-10-25T09:11:40Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2023-37580","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2023-08-09","cveIds":["CVE-2023-38606"],"exploited":"in-the-wild","identifiers":["CVE-2023-38606"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-38606.json","latestUpdate":{"date":"2023-07-26","title":"CISA added CVE-2023-38606 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 16, 2023)"},"patchStatus":"unknown","product":"Multiple Products","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-38606","stacks":["linux"],"startedAt":"2023-07-26","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state. CISA added CVE-2023-38606 to its Known Exploited Vulnerabilities catalog on Jul 26, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple Multiple Products Kernel Unspecified Vulnerability (CVE-2023-38606)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-38606","vendor":"Apple"},{"auto":true,"category":"breach","closedAt":"2023-08-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BREACHFORUMS"],"json":"https://helix.ml/threat-watch/i/breachforums-data-breach.json","latestUpdate":{"date":"2023-07-26","title":"Have I Been Pwned loaded 212K breached BreachForums accounts"},"patchStatus":"no-fix-needed","product":"breached.vc","severity":"high","severityNote":"212K accounts · passwords exposed","slug":"breachforums-data-breach","stacks":[],"startedAt":"2023-07-26","status":"closed","summary":"In November 2022, the well-known hacking forum \"BreachForums\" was itself, breached. Later the following year, the operator of the website was arrested and the site seized by law enforcement agencies. The breach exposed 212k records including usernames, IP and email addresses, private messages between site members and passwords stored as argon2 hashes./a\u003e. Exposed data: email addresses, ip addresses, passwords, private messages, usernames. The breach dates from Nov 29, 2022; Have I Been Pwned loaded it on Jul 26, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"BreachForums data breach: 212K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/breachforums-data-breach","vendor":"BreachForums"},{"auto":true,"category":"patch","closedAt":"2023-08-08","cveIds":["CVE-2023-35078"],"exploited":"in-the-wild","identifiers":["CVE-2023-35078"],"json":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2023-35078.json","latestUpdate":{"date":"2023-07-25","title":"CISA added CVE-2023-35078 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2023)"},"patchStatus":"unknown","product":"Endpoint Manager Mobile (EPMM)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-endpoint-manager-mobile-epmm-cve-2023-35078","stacks":[],"startedAt":"2023-07-25","status":"closed","summary":"Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices. CISA added CVE-2023-35078 to its Known Exploited Vulnerabilities catalog on Jul 25, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-287"],"title":"Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability (CVE-2023-35078)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2023-35078","vendor":"Ivanti"},{"auto":true,"category":"breach","closedAt":"2023-08-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOOKCROSSING"],"json":"https://helix.ml/threat-watch/i/bookcrossing-data-breach.json","latestUpdate":{"date":"2023-07-25","title":"Have I Been Pwned loaded 1.6M breached BookCrossing accounts"},"patchStatus":"no-fix-needed","product":"bookcrossing.com","severity":"high","severityNote":"1.6M accounts · passwords exposed","slug":"bookcrossing-data-breach","stacks":[],"startedAt":"2023-07-25","status":"closed","summary":"In August 2022, the book social networking site BookCrossing disclosed a data breach that dated back to a database backup from November 2012. The incident exposed almost 1.6M records including names, usernames, email and IP addresses, dates of birth and plain text passwords. Exposed data: dates of birth, email addresses, geographic locations, ip addresses, names, passwords, usernames. The breach dates from Nov 5, 2012; Have I Been Pwned loaded it on Jul 25, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","ip-addresses","names","passwords","usernames"],"title":"BookCrossing data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/bookcrossing-data-breach","vendor":"BookCrossing"},{"auto":true,"category":"breach","closedAt":"2023-08-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TIGO"],"json":"https://helix.ml/threat-watch/i/tigo-data-breach.json","latestUpdate":{"date":"2023-07-24","title":"Have I Been Pwned loaded 700K breached Tigo accounts"},"patchStatus":"no-fix-needed","product":"tigo.chat","severity":"medium","severityNote":"700K accounts","slug":"tigo-data-breach","stacks":[],"startedAt":"2023-07-24","status":"closed","summary":"In Mid-2023, 300GB of data containing over 100M records from the Chinese video chat platform \"Tigo\" dating back to March that year was discovered. The data contained over 700k unique names, usernames, email and IP addresses, genders, profile photos and private messages. Tigo did not respond to multiple attempts to disclose the incident. Exposed data: device information, email addresses, genders, geographic locations, ip addresses, names, private messages, profile photos, usernames. The breach dates from Mar 31, 2023; Have I Been Pwned loaded it on Jul 24, 2023.","tags":["data-breach","hibp","device-information","email-addresses","genders","geographic-locations","ip-addresses","names","private-messages","profile-photos","usernames"],"title":"Tigo data breach: 700K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/tigo-data-breach","vendor":"Tigo"},{"auto":true,"category":"breach","closedAt":"2023-08-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROBLOX"],"json":"https://helix.ml/threat-watch/i/roblox-data-breach.json","latestUpdate":{"date":"2023-07-23","title":"Have I Been Pwned loaded 52K breached Roblox accounts"},"patchStatus":"no-fix-needed","product":"roblox.com","severity":"medium","severityNote":"52K accounts","slug":"roblox-data-breach","stacks":[],"startedAt":"2023-07-23","status":"closed","summary":"In August 2016, Roblox disclosed a data breach that affected over 50k users. The security incident impacted email and IP addresses, usernames, purchases and Robux balances which were left exposed on a test server. Exposed data: account balances, email addresses, ip addresses, purchases, usernames. The breach dates from Jul 31, 2016; Have I Been Pwned loaded it on Jul 23, 2023.","tags":["data-breach","hibp","account-balances","email-addresses","ip-addresses","purchases","usernames"],"title":"Roblox data breach: 52K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/roblox-data-breach","vendor":"Roblox"},{"auto":true,"category":"patch","closedAt":"2023-08-03","cveIds":["CVE-2023-29298"],"exploited":"in-the-wild","identifiers":["CVE-2023-29298"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-29298.json","latestUpdate":{"date":"2023-07-20","title":"CISA added CVE-2023-29298 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2023)"},"patchStatus":"unknown","product":"ColdFusion","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2023-29298","stacks":[],"startedAt":"2023-07-20","status":"closed","summary":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. CISA added CVE-2023-29298 to its Known Exploited Vulnerabilities catalog on Jul 20, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Adobe ColdFusion Improper Access Control Vulnerability (CVE-2023-29298)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-29298","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2023-08-03","cveIds":["CVE-2023-38205"],"exploited":"in-the-wild","identifiers":["CVE-2023-38205"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-38205.json","latestUpdate":{"date":"2023-07-20","title":"CISA added CVE-2023-38205 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2023)"},"patchStatus":"unknown","product":"ColdFusion","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2023-38205","stacks":[],"startedAt":"2023-07-20","status":"closed","summary":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. CISA added CVE-2023-38205 to its Known Exploited Vulnerabilities catalog on Jul 20, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Adobe ColdFusion Improper Access Control Vulnerability (CVE-2023-38205)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-38205","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2023-08-02","cveIds":["CVE-2023-3519"],"exploited":"in-the-wild","identifiers":["CVE-2023-3519"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-3519.json","latestUpdate":{"date":"2023-07-19","title":"CISA added CVE-2023-3519 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 9, 2023)"},"patchStatus":"unknown","product":"NetScaler ADC and NetScaler Gateway","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-adc-and-netscaler-gateway-cve-2023-3519","stacks":["cloud","vpn"],"startedAt":"2023-07-19","status":"closed","summary":"Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution. CISA added CVE-2023-3519 to its Known Exploited Vulnerabilities catalog on Jul 19, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability (CVE-2023-3519)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-adc-and-netscaler-gateway-cve-2023-3519","vendor":"Citrix"},{"auto":true,"category":"breach","closedAt":"2023-08-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROBLOXDEVELOPERCONFERENCE"],"json":"https://helix.ml/threat-watch/i/robloxdeveloperconference-data-breach.json","latestUpdate":{"date":"2023-07-18","title":"Have I Been Pwned loaded 3943 breached Roblox Developer Conference (2023) accounts"},"patchStatus":"no-fix-needed","product":"rdcglobal.com","severity":"low","severityNote":"3943 accounts","slug":"robloxdeveloperconference-data-breach","stacks":[],"startedAt":"2023-07-18","status":"closed","summary":"In July 2023, a list of alleged attendees from the 2017-2020 Roblox Developers Conferences was circulated on a forum. The data contained 4k unique email addresses along with names, usernames, dates of birth, phone numbers, physical and IP addresses and T-shirt sizes Exposed data: clothing sizes, dates of birth, email addresses, ip addresses, names, phone numbers, physical addresses, usernames. The breach dates from Dec 18, 2020; Have I Been Pwned loaded it on Jul 18, 2023.","tags":["data-breach","hibp","clothing-sizes","dates-of-birth","email-addresses","ip-addresses","names","phone-numbers","physical-addresses","usernames"],"title":"Roblox Developer Conference (2023) data breach: 3943 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/robloxdeveloperconference-data-breach","vendor":"Roblox Developer Conference (2023)"},{"auto":true,"category":"patch","closedAt":"2023-07-31","cveIds":["CVE-2023-36884"],"exploited":"in-the-wild","identifiers":["CVE-2023-36884"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36884.json","latestUpdate":{"date":"2023-07-17","title":"CISA added CVE-2023-36884 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 29, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-36884","stacks":["windows"],"startedAt":"2023-07-17","status":"closed","summary":"Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. CISA added CVE-2023-36884 to its Known Exploited Vulnerabilities catalog on Jul 17, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-362"],"title":"Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2023-36884)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36884","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-07-27","cveIds":["CVE-2022-29303"],"exploited":"in-the-wild","identifiers":["CVE-2022-29303"],"json":"https://helix.ml/threat-watch/i/solarview-compact-cve-2022-29303.json","latestUpdate":{"date":"2023-07-13","title":"CISA added CVE-2022-29303 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 3, 2023)"},"patchStatus":"patched","product":"Compact","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarview-compact-cve-2022-29303","stacks":[],"startedAt":"2023-07-13","status":"closed","summary":"SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server. CISA added CVE-2022-29303 to its Known Exploited Vulnerabilities catalog on Jul 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"SolarView Compact Command Injection Vulnerability (CVE-2022-29303)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/solarview-compact-cve-2022-29303","vendor":"SolarView"},{"auto":true,"category":"patch","closedAt":"2023-07-27","cveIds":["CVE-2023-37450"],"exploited":"in-the-wild","identifiers":["CVE-2023-37450"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-37450.json","latestUpdate":{"date":"2023-07-13","title":"CISA added CVE-2023-37450 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 3, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-37450","stacks":["browser","ios"],"startedAt":"2023-07-13","status":"closed","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-37450 to its Known Exploited Vulnerabilities catalog on Jul 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple Multiple Products WebKit Code Execution Vulnerability (CVE-2023-37450)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-37450","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-07-25","cveIds":["CVE-2023-32046"],"exploited":"in-the-wild","identifiers":["CVE-2023-32046"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-32046.json","latestUpdate":{"date":"2023-07-11","title":"CISA added CVE-2023-32046 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 1, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-32046","stacks":["windows"],"startedAt":"2023-07-11","status":"closed","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-32046 to its Known Exploited Vulnerabilities catalog on Jul 11, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability (CVE-2023-32046)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-32046","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-07-25","cveIds":["CVE-2023-32049"],"exploited":"in-the-wild","identifiers":["CVE-2023-32049"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-32049.json","latestUpdate":{"date":"2023-07-11","title":"CISA added CVE-2023-32049 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 1, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-32049","stacks":["windows"],"startedAt":"2023-07-11","status":"closed","summary":"Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. CISA added CVE-2023-32049 to its Known Exploited Vulnerabilities catalog on Jul 11, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability (CVE-2023-32049)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-32049","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-07-25","cveIds":["CVE-2023-35311"],"exploited":"in-the-wild","identifiers":["CVE-2023-35311"],"json":"https://helix.ml/threat-watch/i/microsoft-outlook-cve-2023-35311.json","latestUpdate":{"date":"2023-07-11","title":"CISA added CVE-2023-35311 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 1, 2023)"},"patchStatus":"patched","product":"Outlook","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-outlook-cve-2023-35311","stacks":[],"startedAt":"2023-07-11","status":"closed","summary":"Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt. CISA added CVE-2023-35311 to its Known Exploited Vulnerabilities catalog on Jul 11, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-367"],"title":"Microsoft Outlook Security Feature Bypass Vulnerability (CVE-2023-35311)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-outlook-cve-2023-35311","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-07-25","cveIds":["CVE-2023-36874"],"exploited":"in-the-wild","identifiers":["CVE-2023-36874"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36874.json","latestUpdate":{"date":"2023-07-11","title":"CISA added CVE-2023-36874 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 1, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-36874","stacks":["windows"],"startedAt":"2023-07-11","status":"closed","summary":"Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-36874 to its Known Exploited Vulnerabilities catalog on Jul 11, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-59"],"title":"Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability (CVE-2023-36874)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-36874","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-07-25","cveIds":["CVE-2022-31199"],"exploited":"in-the-wild","identifiers":["CVE-2022-31199"],"json":"https://helix.ml/threat-watch/i/netwrix-auditor-cve-2022-31199.json","latestUpdate":{"date":"2023-07-11","title":"CISA added CVE-2022-31199 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 1, 2023)"},"patchStatus":"patched","product":"Auditor","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netwrix-auditor-cve-2022-31199","stacks":[],"startedAt":"2023-07-11","status":"closed","summary":"Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. CISA added CVE-2022-31199 to its Known Exploited Vulnerabilities catalog on Jul 11, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502","cwe-122"],"title":"Netwrix Auditor Insecure Object Deserialization Vulnerability (CVE-2022-31199)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/netwrix-auditor-cve-2022-31199","vendor":"Netwrix"},{"auto":true,"category":"breach","closedAt":"2023-07-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VERMILLION"],"json":"https://helix.ml/threat-watch/i/vermillion-data-breach.json","latestUpdate":{"date":"2023-07-11","title":"Have I Been Pwned loaded 8106 breached Vermillion accounts"},"patchStatus":"no-fix-needed","product":"v3rmillion.net","severity":"high","severityNote":"8106 accounts · passwords exposed","slug":"vermillion-data-breach","stacks":[],"startedAt":"2023-07-11","status":"closed","summary":"In August 2014, the Roblox hacking forum Vermillion suffered a data breach that exposed over 8k subscriber records. The breach of the MyBB forum exposed email and IP addresses, usernames, dates of birth and salted password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Aug 30, 2014; Have I Been Pwned loaded it on Jul 11, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Vermillion data breach: 8106 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/vermillion-data-breach","vendor":"Vermillion"},{"auto":true,"category":"breach","closedAt":"2023-07-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LOCALLY"],"json":"https://helix.ml/threat-watch/i/locally-data-breach.json","latestUpdate":{"date":"2023-07-10","title":"Have I Been Pwned loaded 362K breached Locally accounts"},"patchStatus":"no-fix-needed","product":"locally.com","severity":"high","severityNote":"362K accounts · passwords exposed · financial data exposed","slug":"locally-data-breach","stacks":[],"startedAt":"2023-07-10","status":"closed","summary":"In October 2022, \"The Industry's Leading Online-to-Offline Shopping Solution\" Locally suffered a data breach. Whilst Locally acknowledged the breach privately, it's unknown whether impacted customers were subsequently notified of the incident which exposed over 362k names, phone numbers, email and physical addresses, purchases, credit card type and last four digits and bcrypt password hashes. Exposed data: email addresses, partial credit card data, passwords, phone numbers, physical addresses, purchases. The breach dates from Oct 1, 2022; Have I Been Pwned loaded it on Jul 10, 2023.","tags":["data-breach","hibp","email-addresses","partial-credit-card-data","passwords","phone-numbers","physical-addresses","purchases"],"title":"Locally data breach: 362K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/locally-data-breach","vendor":"Locally"},{"auto":true,"category":"patch","closedAt":"2023-07-21","cveIds":["CVE-2021-29256"],"exploited":"in-the-wild","identifiers":["CVE-2021-29256"],"json":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2021-29256.json","latestUpdate":{"date":"2023-07-07","title":"CISA added CVE-2021-29256 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2023)"},"patchStatus":"patched","product":"Mali Graphics Processing Unit (GPU)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-graphics-processing-unit-gpu-cve-2021-29256","stacks":["linux"],"startedAt":"2023-07-07","status":"closed","summary":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. CISA added CVE-2021-29256 to its Known Exploited Vulnerabilities catalog on Jul 7, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (CVE-2021-29256)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2021-29256","vendor":"Arm"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2019-17621"],"exploited":"in-the-wild","identifiers":["CVE-2019-17621"],"json":"https://helix.ml/threat-watch/i/d-link-dir-859-router-cve-2019-17621.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2019-17621 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"DIR-859 Router","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-859-router-cve-2019-17621","stacks":["network"],"startedAt":"2023-06-29","status":"closed","summary":"D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. CISA added CVE-2019-17621 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-78"],"title":"D-Link DIR-859 Router Command Execution Vulnerability (CVE-2019-17621)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-dir-859-router-cve-2019-17621","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2019-20500"],"exploited":"in-the-wild","identifiers":["CVE-2019-20500"],"json":"https://helix.ml/threat-watch/i/d-link-dwl-2600ap-access-point-cve-2019-20500.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2019-20500 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"DWL-2600AP Access Point","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dwl-2600ap-access-point-cve-2019-20500","stacks":["network"],"startedAt":"2023-06-29","status":"closed","summary":"D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter. CISA added CVE-2019-20500 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"D-Link DWL-2600AP Access Point Command Injection Vulnerability (CVE-2019-20500)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-dwl-2600ap-access-point-cve-2019-20500","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2021-25487"],"exploited":"in-the-wild","identifiers":["CVE-2021-25487"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25487.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2021-25487 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"Mobile Devices","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25487","stacks":[],"startedAt":"2023-06-29","status":"closed","summary":"Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer. CISA added CVE-2021-25487 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-125"],"title":"Samsung Mobile Devices Out-of-Bounds Read Vulnerability (CVE-2021-25487)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25487","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2021-25489"],"exploited":"in-the-wild","identifiers":["CVE-2021-25489"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25489.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2021-25489 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25489","stacks":[],"startedAt":"2023-06-29","status":"closed","summary":"Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic. CISA added CVE-2021-25489 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Samsung Mobile Devices Improper Input Validation Vulnerability (CVE-2021-25489)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25489","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2021-25394"],"exploited":"in-the-wild","identifiers":["CVE-2021-25394"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25394.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2021-25394 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 6.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25394","stacks":[],"startedAt":"2023-06-29","status":"closed","summary":"Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. CISA added CVE-2021-25394 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Samsung Mobile Devices Race Condition Vulnerability (CVE-2021-25394)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25394","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2021-25395"],"exploited":"in-the-wild","identifiers":["CVE-2021-25395"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25395.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2021-25395 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 6.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25395","stacks":[],"startedAt":"2023-06-29","status":"closed","summary":"Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. CISA added CVE-2021-25395 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-362"],"title":"Samsung Mobile Devices Race Condition Vulnerability (CVE-2021-25395)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25395","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2021-25371"],"exploited":"in-the-wild","identifiers":["CVE-2021-25371"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25371.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2021-25371 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 6.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25371","stacks":[],"startedAt":"2023-06-29","status":"closed","summary":"Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP. CISA added CVE-2021-25371 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-912"],"title":"Samsung Mobile Devices Unspecified Vulnerability (CVE-2021-25371)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25371","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2023-07-13","cveIds":["CVE-2021-25372"],"exploited":"in-the-wild","identifiers":["CVE-2021-25372"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25372.json","latestUpdate":{"date":"2023-06-29","title":"CISA added CVE-2021-25372 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 20, 2023)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 6.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25372","stacks":[],"startedAt":"2023-06-29","status":"closed","summary":"Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access. CISA added CVE-2021-25372 to its Known Exploited Vulnerabilities catalog on Jun 29, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Samsung Mobile Devices Improper Boundary Check Vulnerability (CVE-2021-25372)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25372","vendor":"Samsung"},{"auto":true,"category":"breach","closedAt":"2023-07-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BREACHFORUMSCLONE"],"json":"https://helix.ml/threat-watch/i/breachforumsclone-data-breach.json","latestUpdate":{"date":"2023-06-25","title":"Have I Been Pwned loaded 4204 breached BreachForums Clone accounts"},"patchStatus":"no-fix-needed","product":"breachforums.vc","severity":"high","severityNote":"4204 accounts · passwords exposed","slug":"breachforumsclone-data-breach","stacks":[],"startedAt":"2023-06-25","status":"closed","summary":"In June 2023, a clone of the previously shuttered popular hacking forum \"BreachForums\" suffered a data breach that exposed over 4k records. The breach was due to an exposed backup of the MyBB database which included email and IP addresses, usernames and Argon2 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jun 17, 2023; Have I Been Pwned loaded it on Jun 25, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"BreachForums Clone data breach: 4204 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/breachforumsclone-data-breach","vendor":"BreachForums Clone"},{"auto":true,"category":"patch","closedAt":"2023-07-07","cveIds":["CVE-2023-32434"],"exploited":"in-the-wild","identifiers":["CVE-2023-32434"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32434.json","latestUpdate":{"date":"2023-06-23","title":"CISA added CVE-2023-32434 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 14, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-32434","stacks":[],"startedAt":"2023-06-23","status":"closed","summary":"Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges. CISA added CVE-2023-32434 to its Known Exploited Vulnerabilities catalog on Jun 23, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-190"],"title":"Apple Multiple Products Integer Overflow Vulnerability (CVE-2023-32434)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32434","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-07-07","cveIds":["CVE-2023-32435"],"exploited":"in-the-wild","identifiers":["CVE-2023-32435"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32435.json","latestUpdate":{"date":"2023-06-23","title":"CISA added CVE-2023-32435 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 14, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-32435","stacks":["browser","ios"],"startedAt":"2023-06-23","status":"closed","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-32435 to its Known Exploited Vulnerabilities catalog on Jun 23, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products WebKit Memory Corruption Vulnerability (CVE-2023-32435)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32435","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-07-07","cveIds":["CVE-2023-32439"],"exploited":"in-the-wild","identifiers":["CVE-2023-32439"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32439.json","latestUpdate":{"date":"2023-06-23","title":"CISA added CVE-2023-32439 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 14, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-32439","stacks":["browser","ios"],"startedAt":"2023-06-23","status":"closed","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-32439 to its Known Exploited Vulnerabilities catalog on Jun 23, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Apple Multiple Products WebKit Type Confusion Vulnerability (CVE-2023-32439)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32439","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-07-07","cveIds":["CVE-2023-20867"],"exploited":"in-the-wild","identifiers":["CVE-2023-20867"],"json":"https://helix.ml/threat-watch/i/vmware-tools-cve-2023-20867.json","latestUpdate":{"date":"2023-06-23","title":"CISA added CVE-2023-20867 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 14, 2023)"},"patchStatus":"patched","product":"Tools","severity":"low","severityNote":"CVSS 3.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-tools-cve-2023-20867","stacks":["cloud"],"startedAt":"2023-06-23","status":"closed","summary":"VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability. CISA added CVE-2023-20867 to its Known Exploited Vulnerabilities catalog on Jun 23, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"VMware Tools Authentication Bypass Vulnerability (CVE-2023-20867)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/vmware-tools-cve-2023-20867","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2023-07-07","cveIds":["CVE-2023-27992"],"exploited":"in-the-wild","identifiers":["CVE-2023-27992"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-network-attached-storage-nas-devices-cve-2023-27992.json","latestUpdate":{"date":"2023-06-23","title":"CISA added CVE-2023-27992 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 14, 2023)"},"patchStatus":"patched","product":"Multiple Network-Attached Storage (NAS) Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-network-attached-storage-nas-devices-cve-2023-27992","stacks":["network"],"startedAt":"2023-06-23","status":"closed","summary":"Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request. CISA added CVE-2023-27992 to its Known Exploited Vulnerabilities catalog on Jun 23, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zyxel Multiple NAS Devices Command Injection Vulnerability (CVE-2023-27992)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-network-attached-storage-nas-devices-cve-2023-27992","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2023-07-06","cveIds":["CVE-2023-20887"],"exploited":"in-the-wild","identifiers":["CVE-2023-20887"],"json":"https://helix.ml/threat-watch/i/vmware-aria-operations-for-networks-cve-2023-20887.json","latestUpdate":{"date":"2023-06-22","title":"CISA added CVE-2023-20887 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2023)"},"patchStatus":"patched","product":"Aria Operations for Networks","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-aria-operations-for-networks-cve-2023-20887","stacks":["cloud"],"startedAt":"2023-06-22","status":"closed","summary":"VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution. CISA added CVE-2023-20887 to its Known Exploited Vulnerabilities catalog on Jun 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Vmware Aria Operations for Networks Command Injection Vulnerability (CVE-2023-20887)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/vmware-aria-operations-for-networks-cve-2023-20887","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2023-07-06","cveIds":["CVE-2020-35730"],"exploited":"in-the-wild","identifiers":["CVE-2020-35730"],"json":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2020-35730.json","latestUpdate":{"date":"2023-06-22","title":"CISA added CVE-2020-35730 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2023)"},"patchStatus":"patched","product":"Roundcube Webmail","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-roundcube-webmail-cve-2020-35730","stacks":[],"startedAt":"2023-06-22","status":"closed","summary":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php. CISA added CVE-2020-35730 to its Known Exploited Vulnerabilities catalog on Jun 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability (CVE-2020-35730)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2020-35730","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2023-07-06","cveIds":["CVE-2020-12641"],"exploited":"in-the-wild","identifiers":["CVE-2020-12641"],"json":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2020-12641.json","latestUpdate":{"date":"2023-06-22","title":"CISA added CVE-2020-12641 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2023)"},"patchStatus":"patched","product":"Roundcube Webmail","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-roundcube-webmail-cve-2020-12641","stacks":[],"startedAt":"2023-06-22","status":"closed","summary":"Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. CISA added CVE-2020-12641 to its Known Exploited Vulnerabilities catalog on Jun 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Roundcube Webmail Remote Code Execution Vulnerability (CVE-2020-12641)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2020-12641","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2023-07-06","cveIds":["CVE-2021-44026"],"exploited":"in-the-wild","identifiers":["CVE-2021-44026"],"json":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2021-44026.json","latestUpdate":{"date":"2023-06-22","title":"CISA added CVE-2021-44026 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2023)"},"patchStatus":"patched","product":"Roundcube Webmail","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-roundcube-webmail-cve-2021-44026","stacks":[],"startedAt":"2023-06-22","status":"closed","summary":"Roundcube Webmail is vulnerable to SQL injection via search or search_params. CISA added CVE-2021-44026 to its Known Exploited Vulnerabilities catalog on Jun 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Roundcube Webmail SQL Injection Vulnerability (CVE-2021-44026)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2021-44026","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2023-07-06","cveIds":["CVE-2016-9079"],"exploited":"in-the-wild","identifiers":["CVE-2016-9079"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-firefox-esr-and-thunderbird-cve-2016-9079.json","latestUpdate":{"date":"2023-06-22","title":"CISA added CVE-2016-9079 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2023)"},"patchStatus":"patched","product":"Firefox, Firefox ESR, and Thunderbird","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-firefox-esr-and-thunderbird-cve-2016-9079","stacks":["browser"],"startedAt":"2023-06-22","status":"closed","summary":"Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows. CISA added CVE-2016-9079 to its Known Exploited Vulnerabilities catalog on Jun 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability (CVE-2016-9079)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-firefox-esr-and-thunderbird-cve-2016-9079","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2023-07-06","cveIds":["CVE-2016-0165"],"exploited":"in-the-wild","identifiers":["CVE-2016-0165"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2016-0165.json","latestUpdate":{"date":"2023-06-22","title":"CISA added CVE-2016-0165 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 13, 2023)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2016-0165","stacks":["windows"],"startedAt":"2023-06-22","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2016-0165 to its Known Exploited Vulnerabilities catalog on Jun 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2016-0165)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2016-0165","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-06-27","cveIds":["CVE-2023-27997"],"exploited":"in-the-wild","identifiers":["CVE-2023-27997"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-ssl-vpn-cve-2023-27997.json","latestUpdate":{"date":"2023-06-13","title":"CISA added CVE-2023-27997 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 4, 2023)"},"patchStatus":"patched","product":"FortiOS and FortiProxy SSL-VPN","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-and-fortiproxy-ssl-vpn-cve-2023-27997","stacks":["network","vpn"],"startedAt":"2023-06-13","status":"closed","summary":"Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests. CISA added CVE-2023-27997 to its Known Exploited Vulnerabilities catalog on Jun 13, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-122"],"title":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability (CVE-2023-27997)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-ssl-vpn-cve-2023-27997","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2023-06-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZACKS"],"json":"https://helix.ml/threat-watch/i/zacks-data-breach.json","latestUpdate":{"date":"2023-06-10","title":"Have I Been Pwned loaded 8.9M breached Zacks accounts"},"patchStatus":"no-fix-needed","product":"zacks.com","severity":"high","severityNote":"8.9M accounts · passwords exposed","slug":"zacks-data-breach","stacks":[],"startedAt":"2023-06-10","status":"closed","summary":"In December 2022, the investment research company Zacks announced a data breach. The following month, reports emerged of the incident impacting 820k customers. However, in June 2023, a corpus of data with almost 9M Zacks customers appeared before being broadly circulated on a popular hacking forum. The most recent data was dated May 2020 and included names, usernames, email and physical addresses, phone numbers and passwords stored as unsalted SHA-256 hashes. On disclosure of the larger breach, Zacks advised that in addition to their original report \"the unauthorised third parties also gained access to encrypted [sic] passwords of zacks.com customers, but only in the encrypted [sic] format\". Exposed data: email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from May 10, 2020; Have I Been Pwned loaded it on Jun 10, 2023.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Zacks data breach: 8.9M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/zacks-data-breach","vendor":"Zacks"},{"auto":true,"category":"patch","closedAt":"2023-06-21","cveIds":["CVE-2023-3079"],"exploited":"in-the-wild","identifiers":["CVE-2023-3079"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2023-3079.json","latestUpdate":{"date":"2023-06-07","title":"CISA added CVE-2023-3079 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 28, 2023)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2023-3079","stacks":["browser"],"startedAt":"2023-06-07","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2023-3079 to its Known Exploited Vulnerabilities catalog on Jun 7, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2023-3079)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2023-3079","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2023-06-19","cveIds":["CVE-2023-33009"],"exploited":"in-the-wild","identifiers":["CVE-2023-33009"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2023-33009.json","latestUpdate":{"date":"2023-06-05","title":"CISA added CVE-2023-33009 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 26, 2023)"},"patchStatus":"patched","product":"Multiple Firewalls","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-firewalls-cve-2023-33009","stacks":["network"],"startedAt":"2023-06-05","status":"closed","summary":"Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. CISA added CVE-2023-33009 to its Known Exploited Vulnerabilities catalog on Jun 5, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-120"],"title":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability (CVE-2023-33009)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2023-33009","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2023-06-19","cveIds":["CVE-2023-33010"],"exploited":"in-the-wild","identifiers":["CVE-2023-33010"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2023-33010.json","latestUpdate":{"date":"2023-06-05","title":"CISA added CVE-2023-33010 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 26, 2023)"},"patchStatus":"patched","product":"Multiple Firewalls","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-firewalls-cve-2023-33010","stacks":["network"],"startedAt":"2023-06-05","status":"closed","summary":"Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. CISA added CVE-2023-33010 to its Known Exploited Vulnerabilities catalog on Jun 5, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-120"],"title":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability (CVE-2023-33010)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2023-33010","vendor":"Zyxel"},{"auto":true,"category":"breach","closedAt":"2023-06-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JDGROUP"],"json":"https://helix.ml/threat-watch/i/jdgroup-data-breach.json","latestUpdate":{"date":"2023-06-05","title":"Have I Been Pwned loaded 521K breached JD Group accounts"},"patchStatus":"no-fix-needed","product":"jdgroup.co.za","severity":"medium","severityNote":"521K accounts","slug":"jdgroup-data-breach","stacks":[],"startedAt":"2023-06-05","status":"closed","summary":"In May 2023, the South African retailer JD Group announced a data breach affecting a number of their online assets including Bradlows, Everyshop, HiFi Corp, Incredible (Connection), Rochester, Russells, and Sleepmasters. The breach exposed over 520k unique customer records including names, email and physical addresses, phone numbers and South African ID numbers. Exposed data: email addresses, government issued ids, names, phone numbers, physical addresses. The breach dates from May 31, 2023; Have I Been Pwned loaded it on Jun 5, 2023.","tags":["data-breach","hibp","email-addresses","government-issued-ids","names","phone-numbers","physical-addresses"],"title":"JD Group data breach: 521K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/jdgroup-data-breach","vendor":"JD Group"},{"auto":true,"category":"patch","closedAt":"2023-06-16","cveIds":["CVE-2023-34362"],"exploited":"in-the-wild","identifiers":["CVE-2023-34362"],"json":"https://helix.ml/threat-watch/i/progress-moveit-transfer-cve-2023-34362.json","latestUpdate":{"date":"2023-06-02","title":"CISA added CVE-2023-34362 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 23, 2023)"},"patchStatus":"patched","product":"MOVEit Transfer","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-moveit-transfer-cve-2023-34362","stacks":[],"startedAt":"2023-06-02","status":"closed","summary":"Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements. CISA added CVE-2023-34362 to its Known Exploited Vulnerabilities catalog on Jun 2, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"Progress MOVEit Transfer SQL Injection Vulnerability (CVE-2023-34362)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/progress-moveit-transfer-cve-2023-34362","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2023-06-14","cveIds":["CVE-2023-28771"],"exploited":"in-the-wild","identifiers":["CVE-2023-28771"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2023-28771.json","latestUpdate":{"date":"2023-05-31","title":"CISA added CVE-2023-28771 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 21, 2023)"},"patchStatus":"patched","product":"Multiple Firewalls","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-firewalls-cve-2023-28771","stacks":["network"],"startedAt":"2023-05-31","status":"closed","summary":"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. CISA added CVE-2023-28771 to its Known Exploited Vulnerabilities catalog on May 31, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zyxel Multiple Firewalls OS Command Injection Vulnerability (CVE-2023-28771)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2023-28771","vendor":"Zyxel"},{"auto":true,"category":"breach","closedAt":"2023-06-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RAIDFORUMS"],"json":"https://helix.ml/threat-watch/i/raidforums-data-breach.json","latestUpdate":{"date":"2023-05-31","title":"Have I Been Pwned loaded 478K breached RaidForums accounts"},"patchStatus":"no-fix-needed","product":"raidforums.com","severity":"high","severityNote":"478K accounts · passwords exposed","slug":"raidforums-data-breach","stacks":[],"startedAt":"2023-05-31","status":"closed","summary":"In May 2023, 478k user records from the now defunct hacking forum known as \"RaidForums\" was posted to another hacking forum. The data dated back to September 2020 and included email addresses, usernames, dates of birth, IP addresses and passwords stored as Argon2 hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Sep 24, 2020; Have I Been Pwned loaded it on May 31, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"RaidForums data breach: 478K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/raidforums-data-breach","vendor":"RaidForums"},{"auto":true,"category":"breach","closedAt":"2023-06-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POLISHCREDENTIALS"],"json":"https://helix.ml/threat-watch/i/polishcredentials-data-breach.json","latestUpdate":{"date":"2023-05-30","title":"Have I Been Pwned loaded 1.2M breached Polish Credentials accounts"},"patchStatus":"no-fix-needed","product":"Polish Credentials","severity":"high","severityNote":"1.2M accounts · passwords exposed","slug":"polishcredentials-data-breach","stacks":[],"startedAt":"2023-05-30","status":"closed","summary":"In May 2023, a credential stuffing list of 6.3M Polish email address and password pairs appeared on a local forum. Likely obtained by malware running on victims' machines, each record included an email address and plain text password alongside the website the credentials were used on. The data included 1.2M unique email addresses. Exposed data: email addresses, passwords. The breach dates from May 29, 2023; Have I Been Pwned loaded it on May 30, 2023.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Polish Credentials data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/polishcredentials-data-breach","vendor":"Polish Credentials"},{"auto":true,"category":"patch","closedAt":"2023-06-09","cveIds":["CVE-2023-2868"],"exploited":"in-the-wild","identifiers":["CVE-2023-2868"],"json":"https://helix.ml/threat-watch/i/barracuda-networks-email-security-gateway-esg-appliance-cve-2023-2868.json","latestUpdate":{"date":"2023-05-26","title":"CISA added CVE-2023-2868 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 16, 2023)"},"patchStatus":"patched","product":"Email Security Gateway (ESG) Appliance","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"barracuda-networks-email-security-gateway-esg-appliance-cve-2023-2868","stacks":[],"startedAt":"2023-05-26","status":"closed","summary":"Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection. CISA added CVE-2023-2868 to its Known Exploited Vulnerabilities catalog on May 26, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability (CVE-2023-2868)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/barracuda-networks-email-security-gateway-esg-appliance-cve-2023-2868","vendor":"Barracuda Networks"},{"auto":true,"category":"patch","closedAt":"2023-06-05","cveIds":["CVE-2023-32409"],"exploited":"in-the-wild","identifiers":["CVE-2023-32409"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32409.json","latestUpdate":{"date":"2023-05-22","title":"CISA added CVE-2023-32409 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 12, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-32409","stacks":["browser","ios"],"startedAt":"2023-05-22","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-32409 to its Known Exploited Vulnerabilities catalog on May 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple Multiple Products WebKit Sandbox Escape Vulnerability (CVE-2023-32409)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32409","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-06-05","cveIds":["CVE-2023-28204"],"exploited":"in-the-wild","identifiers":["CVE-2023-28204"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-28204.json","latestUpdate":{"date":"2023-05-22","title":"CISA added CVE-2023-28204 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 12, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-28204","stacks":["browser","ios"],"startedAt":"2023-05-22","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-28204 to its Known Exploited Vulnerabilities catalog on May 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability (CVE-2023-28204)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-28204","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-06-05","cveIds":["CVE-2023-32373"],"exploited":"in-the-wild","identifiers":["CVE-2023-32373"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32373.json","latestUpdate":{"date":"2023-05-22","title":"CISA added CVE-2023-32373 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 12, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-32373","stacks":["browser","ios"],"startedAt":"2023-05-22","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-32373 to its Known Exploited Vulnerabilities catalog on May 22, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple Multiple Products WebKit Use-After-Free Vulnerability (CVE-2023-32373)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-32373","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-06-02","cveIds":["CVE-2004-1464"],"exploited":"in-the-wild","identifiers":["CVE-2004-1464"],"json":"https://helix.ml/threat-watch/i/cisco-ios-cve-2004-1464.json","latestUpdate":{"date":"2023-05-19","title":"CISA added CVE-2004-1464 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2023)"},"patchStatus":"patched","product":"IOS","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-cve-2004-1464","stacks":["ios","network"],"startedAt":"2023-05-19","status":"closed","summary":"Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device. CISA added CVE-2004-1464 to its Known Exploited Vulnerabilities catalog on May 19, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Cisco IOS Denial-of-Service Vulnerability (CVE-2004-1464)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-ios-cve-2004-1464","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2023-06-02","cveIds":["CVE-2016-6415"],"exploited":"in-the-wild","identifiers":["CVE-2016-6415"],"json":"https://helix.ml/threat-watch/i/cisco-ios-ios-xr-and-ios-xe-cve-2016-6415.json","latestUpdate":{"date":"2023-05-19","title":"CISA added CVE-2016-6415 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2023)"},"patchStatus":"patched","product":"IOS, IOS XR, and IOS XE","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-ios-xr-and-ios-xe-cve-2016-6415","stacks":["ios","network"],"startedAt":"2023-05-19","status":"closed","summary":"Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure. CISA added CVE-2016-6415 to its Known Exploited Vulnerabilities catalog on May 19, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability (CVE-2016-6415)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-ios-ios-xr-and-ios-xe-cve-2016-6415","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2023-06-02","cveIds":["CVE-2023-21492"],"exploited":"in-the-wild","identifiers":["CVE-2023-21492"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2023-21492.json","latestUpdate":{"date":"2023-05-19","title":"CISA added CVE-2023-21492 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 9, 2023)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 4.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2023-21492","stacks":[],"startedAt":"2023-05-19","status":"closed","summary":"Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass. CISA added CVE-2023-21492 to its Known Exploited Vulnerabilities catalog on May 19, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-532"],"title":"Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability (CVE-2023-21492)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2023-21492","vendor":"Samsung"},{"auto":true,"category":"breach","closedAt":"2023-06-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LUXOTTICA"],"json":"https://helix.ml/threat-watch/i/luxottica-data-breach.json","latestUpdate":{"date":"2023-05-19","title":"Have I Been Pwned loaded 77.1M breached Luxottica accounts"},"patchStatus":"no-fix-needed","product":"luxottica.com","severity":"high","severityNote":"77.1M accounts","slug":"luxottica-data-breach","stacks":[],"startedAt":"2023-05-19","status":"closed","summary":"In March 2021, the world's largest eyewear company Luxoticca suffered a data breach via one of their partners that exposed the personal information of more than 70M people. The data was subsequently sold via a popular hacking forum in late 2022 and included email and physical addresses, names, genders, dates of birth and phone numbers. In a statement from Luxottica, they advised they were aware of the incident and are currently \"considering other notification obligations\". Exposed data: dates of birth, email addresses, genders, names, phone numbers, physical addresses. The breach dates from Mar 16, 2021; Have I Been Pwned loaded it on May 19, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"Luxottica data breach: 77.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/luxottica-data-breach","vendor":"Luxottica"},{"auto":true,"category":"patch","closedAt":"2023-05-26","cveIds":["CVE-2023-25717"],"exploited":"in-the-wild","identifiers":["CVE-2023-25717"],"json":"https://helix.ml/threat-watch/i/ruckus-wireless-multiple-products-cve-2023-25717.json","latestUpdate":{"date":"2023-05-12","title":"CISA added CVE-2023-25717 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2023)"},"patchStatus":"unpatched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ruckus-wireless-multiple-products-cve-2023-25717","stacks":[],"startedAt":"2023-05-12","status":"closed","summary":"Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs. CISA added CVE-2023-25717 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Multiple Ruckus Wireless Products CSRF and RCE Vulnerability (CVE-2023-25717)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/ruckus-wireless-multiple-products-cve-2023-25717","vendor":"Ruckus Wireless"},{"auto":true,"category":"patch","closedAt":"2023-05-26","cveIds":["CVE-2021-3560"],"exploited":"in-the-wild","identifiers":["CVE-2021-3560"],"json":"https://helix.ml/threat-watch/i/red-hat-polkit-cve-2021-3560.json","latestUpdate":{"date":"2023-05-12","title":"CISA added CVE-2021-3560 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2023)"},"patchStatus":"patched","product":"Polkit","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-polkit-cve-2021-3560","stacks":["linux"],"startedAt":"2023-05-12","status":"closed","summary":"Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation. CISA added CVE-2021-3560 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-863"],"title":"Red Hat Polkit Incorrect Authorization Vulnerability (CVE-2021-3560)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/red-hat-polkit-cve-2021-3560","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2023-05-26","cveIds":["CVE-2014-0196"],"exploited":"in-the-wild","identifiers":["CVE-2014-0196"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2014-0196.json","latestUpdate":{"date":"2023-05-12","title":"CISA added CVE-2014-0196 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2023)"},"patchStatus":"unpatched","product":"Kernel","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2014-0196","stacks":["linux"],"startedAt":"2023-05-12","status":"closed","summary":"Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings. CISA added CVE-2014-0196 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-362"],"title":"Linux Kernel Race Condition Vulnerability (CVE-2014-0196)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2014-0196","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2023-05-26","cveIds":["CVE-2010-3904"],"exploited":"in-the-wild","identifiers":["CVE-2010-3904"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2010-3904.json","latestUpdate":{"date":"2023-05-12","title":"CISA added CVE-2010-3904 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2023)"},"patchStatus":"unpatched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2010-3904","stacks":["linux"],"startedAt":"2023-05-12","status":"closed","summary":"Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. CISA added CVE-2010-3904 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Linux Kernel Improper Input Validation Vulnerability (CVE-2010-3904)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2010-3904","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2023-05-26","cveIds":["CVE-2015-5317"],"exploited":"in-the-wild","identifiers":["CVE-2015-5317"],"json":"https://helix.ml/threat-watch/i/jenkins-jenkins-user-interface-ui-cve-2015-5317.json","latestUpdate":{"date":"2023-05-12","title":"CISA added CVE-2015-5317 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2023)"},"patchStatus":"patched","product":"Jenkins User Interface (UI)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"jenkins-jenkins-user-interface-ui-cve-2015-5317","stacks":["devtools"],"startedAt":"2023-05-12","status":"closed","summary":"Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the \"Fingerprints\" pages. CISA added CVE-2015-5317 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Jenkins User Interface (UI) Information Disclosure Vulnerability (CVE-2015-5317)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/jenkins-jenkins-user-interface-ui-cve-2015-5317","vendor":"Jenkins"},{"auto":true,"category":"patch","closedAt":"2023-05-26","cveIds":["CVE-2016-3427"],"exploited":"in-the-wild","identifiers":["CVE-2016-3427"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-and-jrockit-cve-2016-3427.json","latestUpdate":{"date":"2023-05-12","title":"CISA added CVE-2016-3427 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2023)"},"patchStatus":"patched","product":"Java SE and JRockit","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-and-jrockit-cve-2016-3427","stacks":["java"],"startedAt":"2023-05-12","status":"closed","summary":"Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CISA added CVE-2016-3427 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle Java SE and JRockit Unspecified Vulnerability (CVE-2016-3427)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-and-jrockit-cve-2016-3427","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2023-05-26","cveIds":["CVE-2016-8735"],"exploited":"in-the-wild","identifiers":["CVE-2016-8735"],"json":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2016-8735.json","latestUpdate":{"date":"2023-05-12","title":"CISA added CVE-2016-8735 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 2, 2023)"},"patchStatus":"patched","product":"Tomcat","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-tomcat-cve-2016-8735","stacks":["java"],"startedAt":"2023-05-12","status":"closed","summary":"Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types. CISA added CVE-2016-8735 to its Known Exploited Vulnerabilities catalog on May 12, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-284"],"title":"Apache Tomcat Remote Code Execution Vulnerability (CVE-2016-8735)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2016-8735","vendor":"Apache"},{"auto":true,"category":"breach","closedAt":"2023-05-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RENTOMOJO"],"json":"https://helix.ml/threat-watch/i/rentomojo-data-breach.json","latestUpdate":{"date":"2023-05-10","title":"Have I Been Pwned loaded 2.2M breached RentoMojo accounts"},"patchStatus":"no-fix-needed","product":"rentomojo.com","severity":"high","severityNote":"2.2M accounts · passwords exposed","slug":"rentomojo-data-breach","stacks":[],"startedAt":"2023-05-10","status":"closed","summary":"In April 2023, the Indian rental service RentoMojo suffered a data breach. The breach exposed over 2M unique email addresses along with names, phone, passport and Aadhaar numbers, genders, dates of birth, purchases and bcrypt password hashes. Exposed data: dates of birth, email addresses, genders, government issued ids, names, passport numbers, passwords, phone numbers, purchases, social media profiles. The breach dates from Apr 15, 2023; Have I Been Pwned loaded it on May 10, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","government-issued-ids","names","passport-numbers","passwords","phone-numbers","purchases","social-media-profiles"],"title":"RentoMojo data breach: 2.2M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/rentomojo-data-breach","vendor":"RentoMojo"},{"auto":true,"category":"patch","closedAt":"2023-05-23","cveIds":["CVE-2023-29336"],"exploited":"in-the-wild","identifiers":["CVE-2023-29336"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2023-29336.json","latestUpdate":{"date":"2023-05-09","title":"CISA added CVE-2023-29336 to the Known Exploited Vulnerabilities catalog (federal remediation due May 30, 2023)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2023-29336","stacks":["windows"],"startedAt":"2023-05-09","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges. CISA added CVE-2023-29336 to its Known Exploited Vulnerabilities catalog on May 9, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Microsoft Win32K Privilege Escalation Vulnerability (CVE-2023-29336)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2023-29336","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-05-15","cveIds":["CVE-2023-1389"],"exploited":"in-the-wild","identifiers":["CVE-2023-1389"],"json":"https://helix.ml/threat-watch/i/tp-link-archer-ax21-cve-2023-1389.json","latestUpdate":{"date":"2023-05-01","title":"CISA added CVE-2023-1389 to the Known Exploited Vulnerabilities catalog (federal remediation due May 22, 2023)"},"patchStatus":"patched","product":"Archer AX21","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"tp-link-archer-ax21-cve-2023-1389","stacks":["network"],"startedAt":"2023-05-01","status":"closed","summary":"TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. CISA added CVE-2023-1389 to its Known Exploited Vulnerabilities catalog on May 1, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"TP-Link Archer AX-21 Command Injection Vulnerability (CVE-2023-1389)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/tp-link-archer-ax21-cve-2023-1389","vendor":"TP-Link"},{"auto":true,"category":"patch","closedAt":"2023-05-15","cveIds":["CVE-2021-45046"],"exploited":"in-the-wild","identifiers":["CVE-2021-45046"],"json":"https://helix.ml/threat-watch/i/apache-log4j2-cve-2021-45046.json","latestUpdate":{"date":"2023-05-01","title":"CISA added CVE-2021-45046 to the Known Exploited Vulnerabilities catalog (federal remediation due May 22, 2023)"},"patchStatus":"patched","product":"Log4j2","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-log4j2-cve-2021-45046","stacks":["java","rust"],"startedAt":"2023-05-01","status":"closed","summary":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. CISA added CVE-2021-45046 to its Known Exploited Vulnerabilities catalog on May 1, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-917"],"title":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability (CVE-2021-45046)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apache-log4j2-cve-2021-45046","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2023-05-15","cveIds":["CVE-2023-21839"],"exploited":"in-the-wild","identifiers":["CVE-2023-21839"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2023-21839.json","latestUpdate":{"date":"2023-05-01","title":"CISA added CVE-2023-21839 to the Known Exploited Vulnerabilities catalog (federal remediation due May 22, 2023)"},"patchStatus":"patched","product":"WebLogic Server","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2023-21839","stacks":["java"],"startedAt":"2023-05-01","status":"closed","summary":"Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. CISA added CVE-2023-21839 to its Known Exploited Vulnerabilities catalog on May 1, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle WebLogic Server Unspecified Vulnerability (CVE-2023-21839)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2023-21839","vendor":"Oracle"},{"auto":true,"category":"breach","closedAt":"2023-05-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CITYJERKS"],"json":"https://helix.ml/threat-watch/i/cityjerks-data-breach.json","latestUpdate":{"date":"2023-04-27","title":"Have I Been Pwned loaded 177K breached CityJerks accounts"},"patchStatus":"no-fix-needed","product":"cityjerks.com","severity":"high","severityNote":"177K accounts · passwords exposed","slug":"cityjerks-data-breach","stacks":[],"startedAt":"2023-04-27","status":"closed","summary":"In early 2023, the \"mutual masturbation\" website CityJerks suffered a data breach that exposed 177k unique email addresses. The breach also included data from the TruckerSucker \"dating app for REAL TRUCKERS and REAL MEN\" with the combined corpus of data also exposing usernames, IP addresses, dates of birth, sexual orientations, geo locations, private messages between members and passwords stored as salted MD5 hashes. The data was subsequently listed on a public hacking site. Exposed data: bios, dates of birth, email addresses, geographic locations, ip addresses, passwords, private messages, profile photos, sexual orientations, usernames. The breach dates from Feb 27, 2023; Have I Been Pwned loaded it on Apr 27, 2023.","tags":["data-breach","hibp","bios","dates-of-birth","email-addresses","geographic-locations","ip-addresses","passwords","private-messages","profile-photos","sexual-orientations","usernames"],"title":"CityJerks data breach: 177K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/cityjerks-data-breach","vendor":"CityJerks"},{"auto":true,"category":"breach","closedAt":"2023-05-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MEO"],"json":"https://helix.ml/threat-watch/i/meo-data-breach.json","latestUpdate":{"date":"2023-04-24","title":"Have I Been Pwned loaded 8227 breached MEO accounts"},"patchStatus":"no-fix-needed","product":"meoair.com","severity":"high","severityNote":"8227 accounts · passwords exposed","slug":"meo-data-breach","stacks":[],"startedAt":"2023-04-24","status":"closed","summary":"In early 2023, a corpus of data sourced from the New Zealand based face mask company MEO was discovered. Dating back to December 2020, the data contained over 8k customer records including names, addresses, phone numbers and passwords stored as MD5 Wordpress hashes. MEO did not respond to multiple attempts to report the breach. Exposed data: email addresses, names, passwords, phone numbers, physical addresses, purchases, usernames. The breach dates from Dec 24, 2020; Have I Been Pwned loaded it on Apr 24, 2023.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses","purchases","usernames"],"title":"MEO data breach: 8227 accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/meo-data-breach","vendor":"MEO"},{"auto":true,"category":"breach","closedAt":"2023-05-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TERRAVISION"],"json":"https://helix.ml/threat-watch/i/terravision-data-breach.json","latestUpdate":{"date":"2023-04-23","title":"Have I Been Pwned loaded 2.1M breached Terravision accounts"},"patchStatus":"no-fix-needed","product":"terravision.eu","severity":"high","severityNote":"2.1M accounts · passwords exposed","slug":"terravision-data-breach","stacks":[],"startedAt":"2023-04-23","status":"closed","summary":"In February 2023, the European airport transfers service Terravision suffered a data breach. The breach exposed over 2M records of customer data including names, phone numbers, email addresses, salted password hashes and in some cases, date of birth and country of origin. Terravision did not respond to multiple attempts by individuals period over a period of months to report the incident. Exposed data: dates of birth, email addresses, geographic locations, names, passwords, phone numbers. The breach dates from Feb 1, 2023; Have I Been Pwned loaded it on Apr 23, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","names","passwords","phone-numbers"],"title":"Terravision data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/terravision-data-breach","vendor":"Terravision"},{"auto":true,"category":"patch","closedAt":"2023-05-05","cveIds":["CVE-2023-28432"],"exploited":"in-the-wild","identifiers":["CVE-2023-28432"],"json":"https://helix.ml/threat-watch/i/minio-minio-cve-2023-28432.json","latestUpdate":{"date":"2023-04-21","title":"CISA added CVE-2023-28432 to the Known Exploited Vulnerabilities catalog (federal remediation due May 12, 2023)"},"patchStatus":"patched","product":"MinIO","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"minio-minio-cve-2023-28432","stacks":[],"startedAt":"2023-04-21","status":"closed","summary":"MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure. CISA added CVE-2023-28432 to its Known Exploited Vulnerabilities catalog on Apr 21, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"MinIO Information Disclosure Vulnerability (CVE-2023-28432)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/minio-minio-cve-2023-28432","vendor":"MinIO"},{"auto":true,"category":"patch","closedAt":"2023-05-05","cveIds":["CVE-2023-27350"],"exploited":"in-the-wild","identifiers":["CVE-2023-27350"],"json":"https://helix.ml/threat-watch/i/papercut-mf-ng-cve-2023-27350.json","latestUpdate":{"date":"2023-04-21","title":"CISA added CVE-2023-27350 to the Known Exploited Vulnerabilities catalog (federal remediation due May 12, 2023)"},"patchStatus":"patched","product":"MF/NG","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"papercut-mf-ng-cve-2023-27350","stacks":[],"startedAt":"2023-04-21","status":"closed","summary":"PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. CISA added CVE-2023-27350 to its Known Exploited Vulnerabilities catalog on Apr 21, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-284"],"title":"PaperCut MF/NG Improper Access Control Vulnerability (CVE-2023-27350)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/papercut-mf-ng-cve-2023-27350","vendor":"PaperCut"},{"auto":true,"category":"patch","closedAt":"2023-05-05","cveIds":["CVE-2023-2136"],"exploited":"in-the-wild","identifiers":["CVE-2023-2136"],"json":"https://helix.ml/threat-watch/i/google-chromium-skia-cve-2023-2136.json","latestUpdate":{"date":"2023-04-21","title":"CISA added CVE-2023-2136 to the Known Exploited Vulnerabilities catalog (federal remediation due May 12, 2023)"},"patchStatus":"patched","product":"Chromium Skia","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-skia-cve-2023-2136","stacks":["browser"],"startedAt":"2023-04-21","status":"closed","summary":"Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. CISA added CVE-2023-2136 to its Known Exploited Vulnerabilities catalog on Apr 21, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-190"],"title":"Google Chrome Skia Integer Overflow Vulnerability (CVE-2023-2136)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-skia-cve-2023-2136","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2023-05-03","cveIds":["CVE-2017-6742"],"exploited":"in-the-wild","identifiers":["CVE-2017-6742"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6742.json","latestUpdate":{"date":"2023-04-19","title":"CISA added CVE-2017-6742 to the Known Exploited Vulnerabilities catalog (federal remediation due May 10, 2023)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6742","stacks":["ios","network"],"startedAt":"2023-04-19","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. CISA added CVE-2017-6742 to its Known Exploited Vulnerabilities catalog on Apr 19, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (CVE-2017-6742)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6742","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2023-05-01","cveIds":["CVE-2019-8526"],"exploited":"in-the-wild","identifiers":["CVE-2019-8526"],"json":"https://helix.ml/threat-watch/i/apple-macos-cve-2019-8526.json","latestUpdate":{"date":"2023-04-17","title":"CISA added CVE-2019-8526 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2023)"},"patchStatus":"patched","product":"macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-macos-cve-2019-8526","stacks":["macos"],"startedAt":"2023-04-17","status":"closed","summary":"Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation. CISA added CVE-2019-8526 to its Known Exploited Vulnerabilities catalog on Apr 17, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-416"],"title":"Apple macOS Use-After-Free Vulnerability (CVE-2019-8526)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-macos-cve-2019-8526","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-05-01","cveIds":["CVE-2023-2033"],"exploited":"in-the-wild","identifiers":["CVE-2023-2033"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2023-2033.json","latestUpdate":{"date":"2023-04-17","title":"CISA added CVE-2023-2033 to the Known Exploited Vulnerabilities catalog (federal remediation due May 8, 2023)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2023-2033","stacks":["browser"],"startedAt":"2023-04-17","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2023-2033 to its Known Exploited Vulnerabilities catalog on Apr 17, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2023-2033)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2023-2033","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2023-04-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OGUSERS2022"],"json":"https://helix.ml/threat-watch/i/ogusers2022-data-breach.json","latestUpdate":{"date":"2023-04-14","title":"Have I Been Pwned loaded 529K breached OGUsers (2022 breach) accounts"},"patchStatus":"no-fix-needed","product":"ogusers.com","severity":"high","severityNote":"529K accounts · passwords exposed","slug":"ogusers2022-data-breach","stacks":[],"startedAt":"2023-04-14","status":"closed","summary":"In July 2022, the account hijacking and SIM swapping forum OGusers suffered a data breach, the fifth since December 2018. The breach contained usernames, email and IP addresses and passwords stored as argon2 hashes. A total of 529k unique email addresses appeared in the breach. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 13, 2022; Have I Been Pwned loaded it on Apr 14, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"OGUsers (2022 breach) data breach: 529K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/ogusers2022-data-breach","vendor":"OGUsers (2022 breach)"},{"auto":true,"category":"patch","closedAt":"2023-04-27","cveIds":["CVE-2023-20963"],"exploited":"in-the-wild","identifiers":["CVE-2023-20963"],"json":"https://helix.ml/threat-watch/i/android-framework-cve-2023-20963.json","latestUpdate":{"date":"2023-04-13","title":"CISA added CVE-2023-20963 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2023)"},"patchStatus":"patched","product":"Framework","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-framework-cve-2023-20963","stacks":["android"],"startedAt":"2023-04-13","status":"closed","summary":"Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. CISA added CVE-2023-20963 to its Known Exploited Vulnerabilities catalog on Apr 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-295"],"title":"Android Framework Privilege Escalation Vulnerability (CVE-2023-20963)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/android-framework-cve-2023-20963","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2023-04-27","cveIds":["CVE-2023-29492"],"exploited":"in-the-wild","identifiers":["CVE-2023-29492"],"json":"https://helix.ml/threat-watch/i/novi-survey-novi-survey-cve-2023-29492.json","latestUpdate":{"date":"2023-04-13","title":"CISA added CVE-2023-29492 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2023)"},"patchStatus":"patched","product":"Novi Survey","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"novi-survey-novi-survey-cve-2023-29492","stacks":[],"startedAt":"2023-04-13","status":"closed","summary":"Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account. CISA added CVE-2023-29492 to its Known Exploited Vulnerabilities catalog on Apr 13, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-94"],"title":"Novi Survey Insecure Deserialization Vulnerability (CVE-2023-29492)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/novi-survey-novi-survey-cve-2023-29492","vendor":"Novi Survey"},{"auto":true,"category":"breach","closedAt":"2023-04-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KODIFOUNDATION"],"json":"https://helix.ml/threat-watch/i/kodifoundation-data-breach.json","latestUpdate":{"date":"2023-04-13","title":"Have I Been Pwned loaded 400K breached The Kodi Foundation accounts"},"patchStatus":"no-fix-needed","product":"kodi.tv","severity":"high","severityNote":"400K accounts · passwords exposed","slug":"kodifoundation-data-breach","stacks":[],"startedAt":"2023-04-13","status":"closed","summary":"In February 2023, The Kodi Foundation suffered a data breach that exposed more than 400k user records. Attributed to an account belonging to \"a trusted but currently inactive member of the forum admin team\", the breach involved the administrator account creating a database backup that was subsequently downloaded before being sold on a hacking forum. The breach exposed email and IP addresses, usernames, genders and passwords stored as MyBB salted hashes. The Kodi Foundation elected to self-submit impacted email addresses to HIBP. Exposed data: browser user agent details, dates of birth, email addresses, ip addresses, passwords, private messages, usernames. The breach dates from Feb 16, 2023; Have I Been Pwned loaded it on Apr 13, 2023.","tags":["data-breach","hibp","browser-user-agent-details","dates-of-birth","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"The Kodi Foundation data breach: 400K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/kodifoundation-data-breach","vendor":"The Kodi Foundation"},{"auto":true,"category":"patch","closedAt":"2023-04-25","cveIds":["CVE-2023-28252"],"exploited":"in-the-wild","identifiers":["CVE-2023-28252"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-28252.json","latestUpdate":{"date":"2023-04-11","title":"CISA added CVE-2023-28252 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-28252","stacks":["windows"],"startedAt":"2023-04-11","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-28252 to its Known Exploited Vulnerabilities catalog on Apr 11, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-122"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (CVE-2023-28252)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-28252","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-04-24","cveIds":["CVE-2023-28205"],"exploited":"in-the-wild","identifiers":["CVE-2023-28205"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-28205.json","latestUpdate":{"date":"2023-04-10","title":"CISA added CVE-2023-28205 to the Known Exploited Vulnerabilities catalog (federal remediation due May 1, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-28205","stacks":["browser","ios"],"startedAt":"2023-04-10","status":"closed","summary":"Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-28205 to its Known Exploited Vulnerabilities catalog on Apr 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple Multiple Products WebKit Use-After-Free Vulnerability (CVE-2023-28205)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-28205","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-04-24","cveIds":["CVE-2023-28206"],"exploited":"in-the-wild","identifiers":["CVE-2023-28206"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2023-28206.json","latestUpdate":{"date":"2023-04-10","title":"CISA added CVE-2023-28206 to the Known Exploited Vulnerabilities catalog (federal remediation due May 1, 2023)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2023-28206","stacks":["ios","macos"],"startedAt":"2023-04-10","status":"closed","summary":"Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges. CISA added CVE-2023-28206 to its Known Exploited Vulnerabilities catalog on Apr 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability (CVE-2023-28206)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2023-28206","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-04-21","cveIds":["CVE-2021-27876"],"exploited":"in-the-wild","identifiers":["CVE-2021-27876"],"json":"https://helix.ml/threat-watch/i/veritas-backup-exec-agent-cve-2021-27876.json","latestUpdate":{"date":"2023-04-07","title":"CISA added CVE-2021-27876 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2023)"},"patchStatus":"patched","product":"Backup Exec Agent","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"veritas-backup-exec-agent-cve-2021-27876","stacks":[],"startedAt":"2023-04-07","status":"closed","summary":"Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine. CISA added CVE-2021-27876 to its Known Exploited Vulnerabilities catalog on Apr 7, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-287"],"title":"Veritas Backup Exec Agent File Access Vulnerability (CVE-2021-27876)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/veritas-backup-exec-agent-cve-2021-27876","vendor":"Veritas"},{"auto":true,"category":"patch","closedAt":"2023-04-21","cveIds":["CVE-2021-27877"],"exploited":"in-the-wild","identifiers":["CVE-2021-27877"],"json":"https://helix.ml/threat-watch/i/veritas-backup-exec-agent-cve-2021-27877.json","latestUpdate":{"date":"2023-04-07","title":"CISA added CVE-2021-27877 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2023)"},"patchStatus":"patched","product":"Backup Exec Agent","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"veritas-backup-exec-agent-cve-2021-27877","stacks":[],"startedAt":"2023-04-07","status":"closed","summary":"Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme. CISA added CVE-2021-27877 to its Known Exploited Vulnerabilities catalog on Apr 7, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-287"],"title":"Veritas Backup Exec Agent Improper Authentication Vulnerability (CVE-2021-27877)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/veritas-backup-exec-agent-cve-2021-27877","vendor":"Veritas"},{"auto":true,"category":"patch","closedAt":"2023-04-21","cveIds":["CVE-2021-27878"],"exploited":"in-the-wild","identifiers":["CVE-2021-27878"],"json":"https://helix.ml/threat-watch/i/veritas-backup-exec-agent-cve-2021-27878.json","latestUpdate":{"date":"2023-04-07","title":"CISA added CVE-2021-27878 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2023)"},"patchStatus":"patched","product":"Backup Exec Agent","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"veritas-backup-exec-agent-cve-2021-27878","stacks":[],"startedAt":"2023-04-07","status":"closed","summary":"Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine. CISA added CVE-2021-27878 to its Known Exploited Vulnerabilities catalog on Apr 7, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-287"],"title":"Veritas Backup Exec Agent Command Execution Vulnerability (CVE-2021-27878)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/veritas-backup-exec-agent-cve-2021-27878","vendor":"Veritas"},{"auto":true,"category":"patch","closedAt":"2023-04-21","cveIds":["CVE-2019-1388"],"exploited":"in-the-wild","identifiers":["CVE-2019-1388"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1388.json","latestUpdate":{"date":"2023-04-07","title":"CISA added CVE-2019-1388 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1388","stacks":["windows"],"startedAt":"2023-04-07","status":"closed","summary":"Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context. CISA added CVE-2019-1388 to its Known Exploited Vulnerabilities catalog on Apr 7, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-269"],"title":"Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability (CVE-2019-1388)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1388","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-04-21","cveIds":["CVE-2023-26083"],"exploited":"in-the-wild","identifiers":["CVE-2023-26083"],"json":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2023-26083.json","latestUpdate":{"date":"2023-04-07","title":"CISA added CVE-2023-26083 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 28, 2023)"},"patchStatus":"patched","product":"Mali Graphics Processing Unit (GPU)","severity":"low","severityNote":"CVSS 3.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-graphics-processing-unit-gpu-cve-2023-26083","stacks":["linux"],"startedAt":"2023-04-07","status":"closed","summary":"Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata. CISA added CVE-2023-26083 to its Known Exploited Vulnerabilities catalog on Apr 7, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-401"],"title":"Arm Mali GPU Kernel Driver Information Disclosure Vulnerability (CVE-2023-26083)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2023-26083","vendor":"Arm"},{"auto":true,"category":"breach","closedAt":"2023-04-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GENESISMARKET"],"json":"https://helix.ml/threat-watch/i/genesismarket-data-breach.json","latestUpdate":{"date":"2023-04-05","title":"Have I Been Pwned loaded 8.0M breached Genesis Market accounts"},"patchStatus":"no-fix-needed","product":"genesis.market","severity":"high","severityNote":"8.0M accounts · passwords exposed · financial data exposed","slug":"genesismarket-data-breach","stacks":[],"startedAt":"2023-04-05","status":"closed","summary":"In April 2023, the stolen identity marketplace Genesis Market was shut down by the FBI and a coalition of law enforcement agencies across the globe in \"Operation Cookie Monster\". The service traded in \"browser fingerprints\" which enabled criminals to impersonate victims and access their online services. As many of the impacted accounts did not include email addresses, \"8M\" is merely an approximation intended to indicate scale. Other personal data compromised by the service included names, addresses and credit card information, although not all individuals had each of these fields exposed. Exposed data: browser user agent details, credit card cvv, credit cards, dates of birth, email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Apr 5, 2023; Have I Been Pwned loaded it on Apr 5, 2023.","tags":["data-breach","hibp","browser-user-agent-details","credit-card-cvv","credit-cards","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Genesis Market data breach: 8.0M accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/genesismarket-data-breach","vendor":"Genesis Market"},{"auto":true,"category":"patch","closedAt":"2023-04-17","cveIds":["CVE-2022-27926"],"exploited":"in-the-wild","identifiers":["CVE-2022-27926"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27926.json","latestUpdate":{"date":"2023-04-03","title":"CISA added CVE-2022-27926 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 24, 2023)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2022-27926","stacks":[],"startedAt":"2023-04-03","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. CISA added CVE-2022-27926 to its Known Exploited Vulnerabilities catalog on Apr 3, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79","cwe-138"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2022-27926)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27926","vendor":"Synacor"},{"auto":true,"category":"breach","closedAt":"2023-04-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEAKEDREALITY"],"json":"https://helix.ml/threat-watch/i/leakedreality-data-breach.json","latestUpdate":{"date":"2023-03-31","title":"Have I Been Pwned loaded 114K breached Leaked Reality accounts"},"patchStatus":"no-fix-needed","product":"leakedreality.com","severity":"high","severityNote":"114K accounts · passwords exposed","slug":"leakedreality-data-breach","stacks":[],"startedAt":"2023-03-31","status":"closed","summary":"In January 2022, the now defunct uncensored video website Leaked Reality suffered a data breach that exposed 115k unique email addresses. The data also included usernames, IP addresses and passwords stored as either MD5 or phpass hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 31, 2022; Have I Been Pwned loaded it on Mar 31, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Leaked Reality data breach: 114K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/leakedreality-data-breach","vendor":"Leaked Reality"},{"auto":true,"category":"breach","closedAt":"2023-04-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUNDRYFILES"],"json":"https://helix.ml/threat-watch/i/sundryfiles-data-breach.json","latestUpdate":{"date":"2023-03-31","title":"Have I Been Pwned loaded 274K breached Sundry Files accounts"},"patchStatus":"no-fix-needed","product":"sundryfiles.com","severity":"high","severityNote":"274K accounts · passwords exposed","slug":"sundryfiles-data-breach","stacks":[],"startedAt":"2023-03-31","status":"closed","summary":"In January 2022, the now defunct file upload service Sundry Files suffered a data breach that exposed 274k unique email addresses. The data also included usernames, IP addresses and passwords stored as salted SHA-256 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 21, 2022; Have I Been Pwned loaded it on Mar 31, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Sundry Files data breach: 274K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/sundryfiles-data-breach","vendor":"Sundry Files"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2013-3163"],"exploited":"in-the-wild","identifiers":["CVE-2013-3163"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-3163.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2013-3163 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"unpatched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2013-3163","stacks":["browser","windows"],"startedAt":"2023-03-30","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website. CISA added CVE-2013-3163 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-94"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3163)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-3163","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2017-7494"],"exploited":"in-the-wild","identifiers":["CVE-2017-7494"],"json":"https://helix.ml/threat-watch/i/samba-samba-cve-2017-7494.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2017-7494 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"Samba","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"samba-samba-cve-2017-7494","stacks":[],"startedAt":"2023-03-30","status":"closed","summary":"Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it. CISA added CVE-2017-7494 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Samba Remote Code Execution Vulnerability (CVE-2017-7494)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samba-samba-cve-2017-7494","vendor":"Samba"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2022-42948"],"exploited":"in-the-wild","identifiers":["CVE-2022-42948"],"json":"https://helix.ml/threat-watch/i/fortra-cobalt-strike-cve-2022-42948.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2022-42948 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"Cobalt Strike","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortra-cobalt-strike-cve-2022-42948","stacks":[],"startedAt":"2023-03-30","status":"closed","summary":"Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. CISA added CVE-2022-42948 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-79","cwe-116"],"title":"Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability (CVE-2022-42948)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortra-cobalt-strike-cve-2022-42948","vendor":"Fortra"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2022-39197"],"exploited":"in-the-wild","identifiers":["CVE-2022-39197"],"json":"https://helix.ml/threat-watch/i/fortra-cobalt-strike-cve-2022-39197.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2022-39197 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"Cobalt Strike","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortra-cobalt-strike-cve-2022-39197","stacks":[],"startedAt":"2023-03-30","status":"closed","summary":"Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. CISA added CVE-2022-39197 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-20","cwe-79"],"title":"Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability (CVE-2022-39197)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortra-cobalt-strike-cve-2022-39197","vendor":"Fortra"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2021-30900"],"exploited":"in-the-wild","identifiers":["CVE-2021-30900"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-30900.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2021-30900 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2021-30900","stacks":["ios","macos"],"startedAt":"2023-03-30","status":"closed","summary":"Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges. CISA added CVE-2021-30900 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-20","cwe-787"],"title":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability (CVE-2021-30900)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-30900","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2022-38181"],"exploited":"in-the-wild","identifiers":["CVE-2022-38181"],"json":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2022-38181.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2022-38181 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"Mali Graphics Processing Unit (GPU)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-graphics-processing-unit-gpu-cve-2022-38181","stacks":["linux"],"startedAt":"2023-03-30","status":"closed","summary":"Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. CISA added CVE-2022-38181 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (CVE-2022-38181)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2022-38181","vendor":"Arm"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2023-0266"],"exploited":"in-the-wild","identifiers":["CVE-2023-0266"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2023-0266.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2023-0266 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2023-0266","stacks":["linux"],"startedAt":"2023-03-30","status":"closed","summary":"Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. CISA added CVE-2023-0266 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-416"],"title":"Linux Kernel Use-After-Free Vulnerability (CVE-2023-0266)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2023-0266","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2022-3038"],"exploited":"in-the-wild","identifiers":["CVE-2022-3038"],"json":"https://helix.ml/threat-watch/i/google-chromium-network-service-cve-2022-3038.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2022-3038 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"Chromium Network Service","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-network-service-cve-2022-3038","stacks":["browser"],"startedAt":"2023-03-30","status":"closed","summary":"Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-3038 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium Network Service Use-After-Free Vulnerability (CVE-2022-3038)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-network-service-cve-2022-3038","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2023-04-13","cveIds":["CVE-2022-22706"],"exploited":"in-the-wild","identifiers":["CVE-2022-22706"],"json":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2022-22706.json","latestUpdate":{"date":"2023-03-30","title":"CISA added CVE-2022-22706 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 20, 2023)"},"patchStatus":"patched","product":"Mali Graphics Processing Unit (GPU)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-graphics-processing-unit-gpu-cve-2022-22706","stacks":["linux"],"startedAt":"2023-03-30","status":"closed","summary":"Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages. CISA added CVE-2022-22706 to its Known Exploited Vulnerabilities catalog on Mar 30, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Arm Mali GPU Kernel Driver Unspecified Vulnerability (CVE-2022-22706)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2022-22706","vendor":"Arm"},{"auto":true,"category":"breach","closedAt":"2023-04-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEGRADCAFE"],"json":"https://helix.ml/threat-watch/i/thegradcafe-data-breach.json","latestUpdate":{"date":"2023-03-24","title":"Have I Been Pwned loaded 310K breached TheGradCafe accounts"},"patchStatus":"no-fix-needed","product":"thegradcafe.com","severity":"high","severityNote":"310K accounts · passwords exposed","slug":"thegradcafe-data-breach","stacks":[],"startedAt":"2023-03-24","status":"closed","summary":"In February 2023, the grad school admissions search website TheGradCafe suffered a data breach that disclosed the personal records of 310k users. The data included email addresses, names and usernames, genders, geographic locations and passwords stored as bcrypt hashes. Some records also included physical address, phone number and date of birth. TheGradCafe did not respond to multiple attempts to disclose the breach. Exposed data: email addresses, genders, geographic locations, ip addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Feb 26, 2023; Have I Been Pwned loaded it on Mar 24, 2023.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","ip-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"TheGradCafe data breach: 310K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/thegradcafe-data-breach","vendor":"TheGradCafe"},{"auto":true,"category":"patch","closedAt":"2023-03-29","cveIds":["CVE-2023-26360"],"exploited":"in-the-wild","identifiers":["CVE-2023-26360"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-26360.json","latestUpdate":{"date":"2023-03-15","title":"CISA added CVE-2023-26360 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2023)"},"patchStatus":"patched","product":"ColdFusion","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2023-26360","stacks":["rust"],"startedAt":"2023-03-15","status":"closed","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. CISA added CVE-2023-26360 to its Known Exploited Vulnerabilities catalog on Mar 15, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-284"],"title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-26360)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2023-26360","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2023-03-28","cveIds":["CVE-2023-23397"],"exploited":"in-the-wild","identifiers":["CVE-2023-23397"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2023-23397.json","latestUpdate":{"date":"2023-03-14","title":"CISA added CVE-2023-23397 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 4, 2023)"},"patchStatus":"patched","product":"Office","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2023-23397","stacks":["windows"],"startedAt":"2023-03-14","status":"closed","summary":"Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. CISA added CVE-2023-23397 to its Known Exploited Vulnerabilities catalog on Mar 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-294"],"title":"Microsoft Office Outlook Privilege Escalation Vulnerability (CVE-2023-23397)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2023-23397","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-03-28","cveIds":["CVE-2023-24880"],"exploited":"in-the-wild","identifiers":["CVE-2023-24880"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-24880.json","latestUpdate":{"date":"2023-03-14","title":"CISA added CVE-2023-24880 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 4, 2023)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 4.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-24880","stacks":["windows"],"startedAt":"2023-03-14","status":"closed","summary":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. CISA added CVE-2023-24880 to its Known Exploited Vulnerabilities catalog on Mar 14, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-863"],"title":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2023-24880)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-24880","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-03-28","cveIds":["CVE-2022-41328"],"exploited":"in-the-wild","identifiers":["CVE-2022-41328"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2022-41328.json","latestUpdate":{"date":"2023-03-14","title":"CISA added CVE-2022-41328 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 4, 2023)"},"patchStatus":"patched","product":"FortiOS","severity":"high","severityNote":"CVSS 7.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2022-41328","stacks":["network","vpn"],"startedAt":"2023-03-14","status":"closed","summary":"Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. CISA added CVE-2022-41328 to its Known Exploited Vulnerabilities catalog on Mar 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Fortinet FortiOS Path Traversal Vulnerability (CVE-2022-41328)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2022-41328","vendor":"Fortinet"},{"auto":true,"category":"breach","closedAt":"2023-03-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHOPPERPLUS"],"json":"https://helix.ml/threat-watch/i/shopperplus-data-breach.json","latestUpdate":{"date":"2023-03-11","title":"Have I Been Pwned loaded 878K breached Shopper+ accounts"},"patchStatus":"no-fix-needed","product":"shopperplus.ca","severity":"medium","severityNote":"878K accounts","slug":"shopperplus-data-breach","stacks":[],"startedAt":"2023-03-11","status":"closed","summary":"In March 2023, \"Canada's online shopping mall\" Shopper+ disclosed a data breach discovered on a public hacking forum. The breach dated back to September 2020 and included 878k customer records with email and physical addresses, names, phone numbers and in some cases, genders and dates of birth. Exposed data: dates of birth, email addresses, genders, names, phone numbers, physical addresses, spoken languages. The breach dates from Sep 14, 2020; Have I Been Pwned loaded it on Mar 11, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","phone-numbers","physical-addresses","spoken-languages"],"title":"Shopper+ data breach: 878K accounts exposed","updatedAt":"2026-10-25T08:35:02Z","url":"https://helix.ml/threat-watch/i/shopperplus-data-breach","vendor":"Shopper+"},{"auto":true,"category":"breach","closedAt":"2023-03-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HDBFINANCIALSERVICES"],"json":"https://helix.ml/threat-watch/i/hdbfinancialservices-data-breach.json","latestUpdate":{"date":"2023-03-11","title":"Have I Been Pwned loaded 1.7M breached HDB Financial Services accounts"},"patchStatus":"no-fix-needed","product":"hdbfs.com","severity":"medium","severityNote":"1.7M accounts","slug":"hdbfinancialservices-data-breach","stacks":[],"startedAt":"2023-03-11","status":"closed","summary":"In March 2023, the Indian non-bank lending unit HDB Financial Services suffered a data breach that disclosed over 70M customer records. Containing 1.6M unique email addresses, the breach also disclosed names, dates of birth, phone numbers, genders, post codes and loan information belonging to the customers. Exposed data: dates of birth, email addresses, genders, geographic locations, loan information, names, phone numbers. The breach dates from Feb 22, 2023; Have I Been Pwned loaded it on Mar 11, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","loan-information","names","phone-numbers"],"title":"HDB Financial Services data breach: 1.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hdbfinancialservices-data-breach","vendor":"HDB Financial Services"},{"auto":true,"category":"patch","closedAt":"2023-03-24","cveIds":["CVE-2021-39144"],"exploited":"in-the-wild","identifiers":["CVE-2021-39144"],"json":"https://helix.ml/threat-watch/i/xstream-xstream-cve-2021-39144.json","latestUpdate":{"date":"2023-03-10","title":"CISA added CVE-2021-39144 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 31, 2023)"},"patchStatus":"patched","product":"XStream","severity":"high","severityNote":"CVSS 8.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"xstream-xstream-cve-2021-39144","stacks":[],"startedAt":"2023-03-10","status":"closed","summary":"XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation. CISA added CVE-2021-39144 to its Known Exploited Vulnerabilities catalog on Mar 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94","cwe-502"],"title":"XStream Remote Code Execution Vulnerability (CVE-2021-39144)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/xstream-xstream-cve-2021-39144","vendor":"XStream"},{"auto":true,"category":"patch","closedAt":"2023-03-24","cveIds":["CVE-2020-5741"],"exploited":"in-the-wild","identifiers":["CVE-2020-5741"],"json":"https://helix.ml/threat-watch/i/plex-media-server-cve-2020-5741.json","latestUpdate":{"date":"2023-03-10","title":"CISA added CVE-2020-5741 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 31, 2023)"},"patchStatus":"patched","product":"Media Server","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"plex-media-server-cve-2020-5741","stacks":[],"startedAt":"2023-03-10","status":"closed","summary":"Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it. CISA added CVE-2020-5741 to its Known Exploited Vulnerabilities catalog on Mar 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-502"],"title":"Plex Media Server Remote Code Execution Vulnerability (CVE-2020-5741)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2020-5741","vendor":"Plex"},{"auto":true,"category":"patch","closedAt":"2023-03-21","cveIds":["CVE-2022-28810"],"exploited":"in-the-wild","identifiers":["CVE-2022-28810"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2022-28810.json","latestUpdate":{"date":"2023-03-07","title":"CISA added CVE-2022-28810 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 28, 2023)"},"patchStatus":"patched","product":"ManageEngine","severity":"medium","severityNote":"CVSS 6.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-cve-2022-28810","stacks":[],"startedAt":"2023-03-07","status":"closed","summary":"Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset. CISA added CVE-2022-28810 to its Known Exploited Vulnerabilities catalog on Mar 7, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-259"],"title":"Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2022-28810)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2022-28810","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2023-03-21","cveIds":["CVE-2022-33891"],"exploited":"in-the-wild","identifiers":["CVE-2022-33891"],"json":"https://helix.ml/threat-watch/i/apache-spark-cve-2022-33891.json","latestUpdate":{"date":"2023-03-07","title":"CISA added CVE-2022-33891 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 28, 2023)"},"patchStatus":"patched","product":"Spark","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-spark-cve-2022-33891","stacks":[],"startedAt":"2023-03-07","status":"closed","summary":"Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. CISA added CVE-2022-33891 to its Known Exploited Vulnerabilities catalog on Mar 7, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Apache Spark Command Injection Vulnerability (CVE-2022-33891)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apache-spark-cve-2022-33891","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2023-03-21","cveIds":["CVE-2022-35914"],"exploited":"in-the-wild","identifiers":["CVE-2022-35914"],"json":"https://helix.ml/threat-watch/i/teclib-glpi-cve-2022-35914.json","latestUpdate":{"date":"2023-03-07","title":"CISA added CVE-2022-35914 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 28, 2023)"},"patchStatus":"patched","product":"GLPI","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"teclib-glpi-cve-2022-35914","stacks":[],"startedAt":"2023-03-07","status":"closed","summary":"Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. CISA added CVE-2022-35914 to its Known Exploited Vulnerabilities catalog on Mar 7, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-74"],"title":"Teclib GLPI Remote Code Execution Vulnerability (CVE-2022-35914)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/teclib-glpi-cve-2022-35914","vendor":"Teclib"},{"auto":true,"category":"breach","closedAt":"2023-03-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IDTECH"],"json":"https://helix.ml/threat-watch/i/idtech-data-breach.json","latestUpdate":{"date":"2023-03-06","title":"Have I Been Pwned loaded 415K breached iD Tech accounts"},"patchStatus":"no-fix-needed","product":"idtech.com","severity":"high","severityNote":"415K accounts · passwords exposed","slug":"idtech-data-breach","stacks":[],"startedAt":"2023-03-06","status":"closed","summary":"In February 2023, the tech camps for kids service iD Tech had almost 1M records posted to a popular hacking forum. The data included 415k unique email addresses, names, dates of birth and plain text passwords which appear to have been breached in the previous month. iD Tech did not respond to multiple attempts to report the incident. Exposed data: dates of birth, email addresses, names, passwords. The breach dates from Jan 3, 2023; Have I Been Pwned loaded it on Mar 6, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords"],"title":"iD Tech data breach: 415K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/idtech-data-breach","vendor":"iD Tech"},{"auto":true,"category":"breach","closedAt":"2023-03-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EYE4FRAUD"],"json":"https://helix.ml/threat-watch/i/eye4fraud-data-breach.json","latestUpdate":{"date":"2023-03-06","title":"Have I Been Pwned loaded 16.0M breached Eye4Fraud accounts"},"patchStatus":"no-fix-needed","product":"eye4fraud.com","severity":"high","severityNote":"16.0M accounts · passwords exposed · financial data exposed","slug":"eye4fraud-data-breach","stacks":[],"startedAt":"2023-03-06","status":"closed","summary":"In February 2023, data alleged to have been taken from the fraud protection service Eye4Fraud was listed for sale on a popular hacking forum. Spanning tens of millions of rows with 16M unique email addresses, the data was spread across 147 tables totalling 65GB and included both direct users of the service and what appears to be individuals who'd placed orders on other services that implemented Eye4Fraud to protect their sales. The data included names and bcrypt password hashes for users, and names, phone numbers, physical addresses and partial credit card data (card type and last 4 digits) for orders placed using the service. Eye4Fraud did not respond to multiple attempts to report the incident. Exposed data: email addresses, ip addresses, names, partial credit card data, passwords, phone numbers, physical addresses. The breach dates from Jan 25, 2023; Have I Been Pwned loaded it on Mar 6, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","partial-credit-card-data","passwords","phone-numbers","physical-addresses"],"title":"Eye4Fraud data breach: 16.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/eye4fraud-data-breach","vendor":"Eye4Fraud"},{"auto":true,"category":"breach","closedAt":"2023-03-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LBB"],"json":"https://helix.ml/threat-watch/i/lbb-data-breach.json","latestUpdate":{"date":"2023-03-05","title":"Have I Been Pwned loaded 39K breached LBB accounts"},"patchStatus":"no-fix-needed","product":"lbb.in","severity":"medium","severityNote":"39K accounts","slug":"lbb-data-breach","stacks":[],"startedAt":"2023-03-05","status":"closed","summary":"In August 2022, customer data of the Indian shopping site \"LBB\" (Little Black Book) was posted to a popular hacking forum. The data contained over 3M records with 39k unique email addresses alongside IP and physical addresses, names and device information with the most recent data dating back to early 2019. LBB advised they believe the data was exposed by a third party service and whilst it contained information they retain on their customers, it had also been enriched with additional data attributes. Exposed data: browser user agent details, email addresses, ip addresses, names, physical addresses. The breach dates from Feb 14, 2019; Have I Been Pwned loaded it on Mar 5, 2023.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","names","physical-addresses"],"title":"LBB data breach: 39K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lbb-data-breach","vendor":"LBB"},{"auto":true,"category":"breach","closedAt":"2023-03-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GUNAUCTION"],"json":"https://helix.ml/threat-watch/i/gunauction-data-breach.json","latestUpdate":{"date":"2023-03-02","title":"Have I Been Pwned loaded 565K breached GunAuction.com accounts"},"patchStatus":"no-fix-needed","product":"gunauction.com","severity":"high","severityNote":"565K accounts · passwords exposed · financial data exposed","slug":"gunauction-data-breach","stacks":[],"startedAt":"2023-03-02","status":"closed","summary":"In December 2022, the online firearms auction website GunAuction.com suffered a data breach which was later discovered left unprotected on the hacker's server. The data included over 565k user records with extensive personal data including email, IP and physical addresses, names, phone numbers, genders, years of birth, credit card type and passwords stored in plain text. The leaked identities could subsequently be matched to firearms listed for sale on the website. Exposed data: browser user agent details, email addresses, genders, ip addresses, partial credit card data, partial dates of birth, passwords, phone numbers, physical addresses, usernames. The breach dates from Dec 3, 2022; Have I Been Pwned loaded it on Mar 2, 2023.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","genders","ip-addresses","partial-credit-card-data","partial-dates-of-birth","passwords","phone-numbers","physical-addresses","usernames"],"title":"GunAuction.com data breach: 565K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gunauction-data-breach","vendor":"GunAuction.com"},{"auto":true,"category":"patch","closedAt":"2023-03-13","cveIds":["CVE-2022-36537"],"exploited":"in-the-wild","identifiers":["CVE-2022-36537"],"json":"https://helix.ml/threat-watch/i/zk-framework-auuploader-cve-2022-36537.json","latestUpdate":{"date":"2023-02-27","title":"CISA added CVE-2022-36537 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 20, 2023)"},"patchStatus":"patched","product":"AuUploader","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"zk-framework-auuploader-cve-2022-36537","stacks":[],"startedAt":"2023-02-27","status":"closed","summary":"ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. CISA added CVE-2022-36537 to its Known Exploited Vulnerabilities catalog on Feb 27, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-441"],"title":"ZK Framework AuUploader Unspecified Vulnerability (CVE-2022-36537)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zk-framework-auuploader-cve-2022-36537","vendor":"ZK Framework"},{"auto":true,"category":"breach","closedAt":"2023-03-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CONVEX"],"json":"https://helix.ml/threat-watch/i/convex-data-breach.json","latestUpdate":{"date":"2023-02-26","title":"Have I Been Pwned loaded 150K breached Convex accounts"},"patchStatus":"no-fix-needed","product":"convex.ru","severity":"medium","severityNote":"150K accounts","slug":"convex-data-breach","stacks":[],"startedAt":"2023-02-26","status":"closed","summary":"In February 2023, the Russian telecommunications provider Convex was hacked by \"Anonymous\" who subsequently released 128GB of data publicly, alleging it revealed illegal government surveillance. The leaked data contained 150k unique email, IP and physical addresses, names and phone numbers. Exposed data: email addresses, ip addresses, names, phone numbers. The breach dates from Feb 1, 2023; Have I Been Pwned loaded it on Feb 26, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","phone-numbers"],"title":"Convex data breach: 150K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/convex-data-breach","vendor":"Convex"},{"auto":true,"category":"patch","closedAt":"2023-03-07","cveIds":["CVE-2022-47986"],"exploited":"in-the-wild","identifiers":["CVE-2022-47986"],"json":"https://helix.ml/threat-watch/i/ibm-aspera-faspex-cve-2022-47986.json","latestUpdate":{"date":"2023-02-21","title":"CISA added CVE-2022-47986 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 14, 2023)"},"patchStatus":"patched","product":"Aspera Faspex","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-aspera-faspex-cve-2022-47986","stacks":[],"startedAt":"2023-02-21","status":"closed","summary":"IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. CISA added CVE-2022-47986 to its Known Exploited Vulnerabilities catalog on Feb 21, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"IBM Aspera Faspex Code Execution Vulnerability (CVE-2022-47986)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/ibm-aspera-faspex-cve-2022-47986","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2023-03-07","cveIds":["CVE-2022-41223"],"exploited":"in-the-wild","identifiers":["CVE-2022-41223"],"json":"https://helix.ml/threat-watch/i/mitel-mivoice-connect-cve-2022-41223.json","latestUpdate":{"date":"2023-02-21","title":"CISA added CVE-2022-41223 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 14, 2023)"},"patchStatus":"patched","product":"MiVoice Connect","severity":"medium","severityNote":"CVSS 6.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mitel-mivoice-connect-cve-2022-41223","stacks":[],"startedAt":"2023-02-21","status":"closed","summary":"The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. CISA added CVE-2022-41223 to its Known Exploited Vulnerabilities catalog on Feb 21, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Mitel MiVoice Connect Code Injection Vulnerability (CVE-2022-41223)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mitel-mivoice-connect-cve-2022-41223","vendor":"Mitel"},{"auto":true,"category":"patch","closedAt":"2023-03-07","cveIds":["CVE-2022-40765"],"exploited":"in-the-wild","identifiers":["CVE-2022-40765"],"json":"https://helix.ml/threat-watch/i/mitel-mivoice-connect-cve-2022-40765.json","latestUpdate":{"date":"2023-02-21","title":"CISA added CVE-2022-40765 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 14, 2023)"},"patchStatus":"patched","product":"MiVoice Connect","severity":"medium","severityNote":"CVSS 6.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mitel-mivoice-connect-cve-2022-40765","stacks":[],"startedAt":"2023-02-21","status":"closed","summary":"The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. CISA added CVE-2022-40765 to its Known Exploited Vulnerabilities catalog on Feb 21, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-77"],"title":"Mitel MiVoice Connect Command Injection Vulnerability (CVE-2022-40765)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mitel-mivoice-connect-cve-2022-40765","vendor":"Mitel"},{"auto":true,"category":"breach","closedAt":"2023-03-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REALDUDESINC"],"json":"https://helix.ml/threat-watch/i/realdudesinc-data-breach.json","latestUpdate":{"date":"2023-02-19","title":"Have I Been Pwned loaded 101K breached RealDudesInc accounts"},"patchStatus":"no-fix-needed","product":"realdudesinc.com","severity":"high","severityNote":"101K accounts · passwords exposed","slug":"realdudesinc-data-breach","stacks":[],"startedAt":"2023-02-19","status":"closed","summary":"In October 2022, the GTA mod menu provider RealDudesInc suffered a data breach that exposed over 100k email addresses (many of which are temporary guest account addresses). The breach also included usernames and bcrypt password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Oct 22, 2022; Have I Been Pwned loaded it on Feb 19, 2023.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"RealDudesInc data breach: 101K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/realdudesinc-data-breach","vendor":"RealDudesInc"},{"auto":true,"category":"patch","closedAt":"2023-03-02","cveIds":["CVE-2022-46169"],"exploited":"in-the-wild","identifiers":["CVE-2022-46169"],"json":"https://helix.ml/threat-watch/i/cacti-cacti-cve-2022-46169.json","latestUpdate":{"date":"2023-02-16","title":"CISA added CVE-2022-46169 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 9, 2023)"},"patchStatus":"patched","product":"Cacti","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cacti-cacti-cve-2022-46169","stacks":[],"startedAt":"2023-02-16","status":"closed","summary":"Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code. CISA added CVE-2022-46169 to its Known Exploited Vulnerabilities catalog on Feb 16, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-74"],"title":"Cacti Command Injection Vulnerability (CVE-2022-46169)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cacti-cacti-cve-2022-46169","vendor":"Cacti"},{"auto":true,"category":"patch","closedAt":"2023-02-28","cveIds":["CVE-2023-21715"],"exploited":"in-the-wild","identifiers":["CVE-2023-21715"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2023-21715.json","latestUpdate":{"date":"2023-02-14","title":"CISA added CVE-2023-21715 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 7, 2023)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2023-21715","stacks":["windows"],"startedAt":"2023-02-14","status":"closed","summary":"Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system. CISA added CVE-2023-21715 to its Known Exploited Vulnerabilities catalog on Feb 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-863"],"title":"Microsoft Office Publisher Security Feature Bypass Vulnerability (CVE-2023-21715)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2023-21715","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-02-28","cveIds":["CVE-2023-23376"],"exploited":"in-the-wild","identifiers":["CVE-2023-23376"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-23376.json","latestUpdate":{"date":"2023-02-14","title":"CISA added CVE-2023-23376 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 7, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-23376","stacks":["windows"],"startedAt":"2023-02-14","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-23376 to its Known Exploited Vulnerabilities catalog on Feb 14, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-122"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (CVE-2023-23376)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-23376","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-02-28","cveIds":["CVE-2023-23529"],"exploited":"in-the-wild","identifiers":["CVE-2023-23529"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-23529.json","latestUpdate":{"date":"2023-02-14","title":"CISA added CVE-2023-23529 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 7, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2023-23529","stacks":["browser","ios"],"startedAt":"2023-02-14","status":"closed","summary":"Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2023-23529 to its Known Exploited Vulnerabilities catalog on Feb 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Apple Multiple Products WebKit Type Confusion Vulnerability (CVE-2023-23529)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2023-23529","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2023-02-28","cveIds":["CVE-2023-21823"],"exploited":"in-the-wild","identifiers":["CVE-2023-21823"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-21823.json","latestUpdate":{"date":"2023-02-14","title":"CISA added CVE-2023-21823 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 7, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-21823","stacks":["windows"],"startedAt":"2023-02-14","status":"closed","summary":"Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-21823 to its Known Exploited Vulnerabilities catalog on Feb 14, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-190"],"title":"Microsoft Windows Graphic Component Privilege Escalation Vulnerability (CVE-2023-21823)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-21823","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-02-24","cveIds":["CVE-2015-2291"],"exploited":"in-the-wild","identifiers":["CVE-2015-2291"],"json":"https://helix.ml/threat-watch/i/intel-ethernet-diagnostics-driver-for-windows-cve-2015-2291.json","latestUpdate":{"date":"2023-02-10","title":"CISA added CVE-2015-2291 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2023)"},"patchStatus":"patched","product":"Ethernet Diagnostics Driver for Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"intel-ethernet-diagnostics-driver-for-windows-cve-2015-2291","stacks":["windows"],"startedAt":"2023-02-10","status":"closed","summary":"Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS). CISA added CVE-2015-2291 to its Known Exploited Vulnerabilities catalog on Feb 10, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-20"],"title":"Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability (CVE-2015-2291)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/intel-ethernet-diagnostics-driver-for-windows-cve-2015-2291","vendor":"Intel"},{"auto":true,"category":"patch","closedAt":"2023-02-24","cveIds":["CVE-2022-24990"],"exploited":"in-the-wild","identifiers":["CVE-2022-24990"],"json":"https://helix.ml/threat-watch/i/terramaster-terramaster-os-cve-2022-24990.json","latestUpdate":{"date":"2023-02-10","title":"CISA added CVE-2022-24990 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2023)"},"patchStatus":"patched","product":"TerraMaster OS","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"terramaster-terramaster-os-cve-2022-24990","stacks":[],"startedAt":"2023-02-10","status":"closed","summary":"TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint. CISA added CVE-2022-24990 to its Known Exploited Vulnerabilities catalog on Feb 10, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-306"],"title":"TerraMaster OS Remote Command Execution Vulnerability (CVE-2022-24990)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/terramaster-terramaster-os-cve-2022-24990","vendor":"TerraMaster"},{"auto":true,"category":"patch","closedAt":"2023-02-24","cveIds":["CVE-2023-0669"],"exploited":"in-the-wild","identifiers":["CVE-2023-0669"],"json":"https://helix.ml/threat-watch/i/fortra-goanywhere-mft-cve-2023-0669.json","latestUpdate":{"date":"2023-02-10","title":"CISA added CVE-2023-0669 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 3, 2023)"},"patchStatus":"patched","product":"GoAnywhere MFT","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortra-goanywhere-mft-cve-2023-0669","stacks":[],"startedAt":"2023-02-10","status":"closed","summary":"Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object. CISA added CVE-2023-0669 to its Known Exploited Vulnerabilities catalog on Feb 10, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-502"],"title":"Fortra GoAnywhere MFT Remote Code Execution Vulnerability (CVE-2023-0669)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortra-goanywhere-mft-cve-2023-0669","vendor":"Fortra"},{"auto":true,"category":"breach","closedAt":"2023-02-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WEEE"],"json":"https://helix.ml/threat-watch/i/weee-data-breach.json","latestUpdate":{"date":"2023-02-08","title":"Have I Been Pwned loaded 1.1M breached Weee accounts"},"patchStatus":"no-fix-needed","product":"sayweee.com","severity":"medium","severityNote":"1.1M accounts","slug":"weee-data-breach","stacks":[],"startedAt":"2023-02-08","status":"closed","summary":"In February 2023, data belonging to the Asian and Hispanic food delivery service Weee appeared on a popular hacking forum. Dating back to mid-2022, the data included 1.1M unique email addresses from 11M rows of orders containing names, phone numbers and delivery instructions. Exposed data: delivery instructions, email addresses, names, phone numbers, purchases. The breach dates from Jul 11, 2022; Have I Been Pwned loaded it on Feb 8, 2023.","tags":["data-breach","hibp","delivery-instructions","email-addresses","names","phone-numbers","purchases"],"title":"Weee data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/weee-data-breach","vendor":"Weee"},{"auto":true,"category":"breach","closedAt":"2023-02-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIMEVPN"],"json":"https://helix.ml/threat-watch/i/limevpn-data-breach.json","latestUpdate":{"date":"2023-02-06","title":"Have I Been Pwned loaded 23K breached LimeVPN accounts"},"patchStatus":"no-fix-needed","product":"limevpn.com","severity":"high","severityNote":"23K accounts · passwords exposed","slug":"limevpn-data-breach","stacks":[],"startedAt":"2023-02-06","status":"closed","summary":"In October 2020, the VPN provider LimeVPN suffered a data breach that exposed the personal information of tens of thousands of customers. The data included email, IP and physical addresses, names, phone numbers, purchase histories and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Oct 8, 2020; Have I Been Pwned loaded it on Feb 6, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","purchases"],"title":"LimeVPN data breach: 23K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/limevpn-data-breach","vendor":"LimeVPN"},{"auto":true,"category":"breach","closedAt":"2023-02-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INSTANTCHECKMATE"],"json":"https://helix.ml/threat-watch/i/instantcheckmate-data-breach.json","latestUpdate":{"date":"2023-02-04","title":"Have I Been Pwned loaded 11.9M breached Instant Checkmate accounts"},"patchStatus":"no-fix-needed","product":"instantcheckmate.com","severity":"high","severityNote":"11.9M accounts · passwords exposed","slug":"instantcheckmate-data-breach","stacks":[],"startedAt":"2023-02-04","status":"closed","summary":"In 2019, the public records search service Instant Checkmate suffered a data breach that later came to light in early 2023. The data included almost 12M unique customer email addresses, names, phone numbers and passwords stored as scrypt hashes. Exposed data: email addresses, names, passwords, phone numbers. The breach dates from Apr 12, 2019; Have I Been Pwned loaded it on Feb 4, 2023.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers"],"title":"Instant Checkmate data breach: 11.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/instantcheckmate-data-breach","vendor":"Instant Checkmate"},{"auto":true,"category":"breach","closedAt":"2023-02-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRUTHFINDER"],"json":"https://helix.ml/threat-watch/i/truthfinder-data-breach.json","latestUpdate":{"date":"2023-02-04","title":"Have I Been Pwned loaded 8.2M breached Truth Finder accounts"},"patchStatus":"no-fix-needed","product":"truthfinder.com","severity":"high","severityNote":"8.2M accounts · passwords exposed","slug":"truthfinder-data-breach","stacks":[],"startedAt":"2023-02-04","status":"closed","summary":"In 2019, the public records search service TruthFinder suffered a data breach that later came to light in early 2023. The data included over 8M unique customer email addresses, names, phone numbers and passwords stored as scrypt hashes. Exposed data: email addresses, names, passwords, phone numbers. The breach dates from Apr 12, 2019; Have I Been Pwned loaded it on Feb 4, 2023.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers"],"title":"Truth Finder data breach: 8.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/truthfinder-data-breach","vendor":"Truth Finder"},{"auto":true,"category":"patch","closedAt":"2023-02-16","cveIds":["CVE-2022-21587"],"exploited":"in-the-wild","identifiers":["CVE-2022-21587"],"json":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2022-21587.json","latestUpdate":{"date":"2023-02-02","title":"CISA added CVE-2022-21587 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 23, 2023)"},"patchStatus":"patched","product":"E-Business Suite","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-e-business-suite-cve-2022-21587","stacks":[],"startedAt":"2023-02-02","status":"closed","summary":"Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. CISA added CVE-2022-21587 to its Known Exploited Vulnerabilities catalog on Feb 2, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-306"],"title":"Oracle E-Business Suite Unspecified Vulnerability (CVE-2022-21587)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-e-business-suite-cve-2022-21587","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2023-02-16","cveIds":["CVE-2023-22952"],"exploited":"in-the-wild","identifiers":["CVE-2023-22952"],"json":"https://helix.ml/threat-watch/i/sugarcrm-multiple-products-cve-2023-22952.json","latestUpdate":{"date":"2023-02-02","title":"CISA added CVE-2023-22952 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 23, 2023)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sugarcrm-multiple-products-cve-2023-22952","stacks":[],"startedAt":"2023-02-02","status":"closed","summary":"Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates. CISA added CVE-2023-22952 to its Known Exploited Vulnerabilities catalog on Feb 2, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Multiple SugarCRM Products Remote Code Execution Vulnerability (CVE-2023-22952)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sugarcrm-multiple-products-cve-2023-22952","vendor":"SugarCRM"},{"auto":true,"category":"breach","closedAt":"2023-02-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SCHOOLDISTRICT42"],"json":"https://helix.ml/threat-watch/i/schooldistrict42-data-breach.json","latestUpdate":{"date":"2023-02-02","title":"Have I Been Pwned loaded 18K breached School District 42 accounts"},"patchStatus":"no-fix-needed","product":"sd42.ca","severity":"medium","severityNote":"18K accounts","slug":"schooldistrict42-data-breach","stacks":[],"startedAt":"2023-02-02","status":"closed","summary":"In January 2023, Pitt Meadows School District 42 in British Columbia suffered a data breach. The incident exposed the names and email addresses of approximately 19k students and staff which were consequently redistributed on a popular hacking forum. Exposed data: email addresses, names. The breach dates from Jan 15, 2023; Have I Been Pwned loaded it on Feb 2, 2023.","tags":["data-breach","hibp","email-addresses","names"],"title":"School District 42 data breach: 18K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/schooldistrict42-data-breach","vendor":"School District 42"},{"auto":true,"category":"breach","closedAt":"2023-02-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PLANETICE"],"json":"https://helix.ml/threat-watch/i/planetice-data-breach.json","latestUpdate":{"date":"2023-01-31","title":"Have I Been Pwned loaded 240K breached Planet Ice accounts"},"patchStatus":"no-fix-needed","product":"planet-ice.co.uk","severity":"high","severityNote":"240K accounts · passwords exposed","slug":"planetice-data-breach","stacks":[],"startedAt":"2023-01-31","status":"closed","summary":"In January 2023, the UK-based ice skating rink booking service Planet Ice suffered a data breach. The incident exposed the personal data of 240k people including email and physical addresses, phone numbers, genders, dates of birth and passwords stored as MD5 hashes. The data also included the names, genders and dates of birth of children having parties. Exposed data: dates of birth, email addresses, genders, ip addresses, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Jan 14, 2023; Have I Been Pwned loaded it on Jan 31, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","names","passwords","phone-numbers","physical-addresses","purchases"],"title":"Planet Ice data breach: 240K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/planetice-data-breach","vendor":"Planet Ice"},{"auto":true,"category":"patch","closedAt":"2023-02-09","cveIds":["CVE-2017-11357"],"exploited":"in-the-wild","identifiers":["CVE-2017-11357"],"json":"https://helix.ml/threat-watch/i/telerik-user-interface-ui-for-asp-net-ajax-cve-2017-11357.json","latestUpdate":{"date":"2023-01-26","title":"CISA added CVE-2017-11357 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 16, 2023)"},"patchStatus":"patched","product":"User Interface (UI) for ASP.NET AJAX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"telerik-user-interface-ui-for-asp-net-ajax-cve-2017-11357","stacks":["dotnet"],"startedAt":"2023-01-26","status":"closed","summary":"Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution. CISA added CVE-2017-11357 to its Known Exploited Vulnerabilities catalog on Jan 26, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability (CVE-2017-11357)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/telerik-user-interface-ui-for-asp-net-ajax-cve-2017-11357","vendor":"Telerik"},{"auto":true,"category":"patch","closedAt":"2023-02-06","cveIds":["CVE-2022-47966"],"exploited":"in-the-wild","identifiers":["CVE-2022-47966"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2022-47966.json","latestUpdate":{"date":"2023-01-23","title":"CISA added CVE-2022-47966 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 13, 2023)"},"patchStatus":"patched","product":"ManageEngine","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-cve-2022-47966","stacks":[],"startedAt":"2023-01-23","status":"closed","summary":"Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario. CISA added CVE-2022-47966 to its Known Exploited Vulnerabilities catalog on Jan 23, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability (CVE-2022-47966)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2022-47966","vendor":"Zoho"},{"auto":true,"category":"breach","closedAt":"2023-02-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AUTOTRADER"],"json":"https://helix.ml/threat-watch/i/autotrader-data-breach.json","latestUpdate":{"date":"2023-01-23","title":"Have I Been Pwned loaded 20K breached Autotrader accounts"},"patchStatus":"no-fix-needed","product":"autotrader.com","severity":"medium","severityNote":"20K accounts","slug":"autotrader-data-breach","stacks":[],"startedAt":"2023-01-23","status":"closed","summary":"In January 2023, 1.4M records from the Autotrader online vehicle marketplace appeared on a popular hacking forum. Autotrader stated that the \"data in question relates to aged listing data that was generally publicly available on our site at the time and open to automated collection methods\". The data contained 20k unique email addresses alongside physical addresses and phone numbers of dealers and vehicle details including VIN numbers. Exposed data: email addresses, phone numbers, physical addresses, vehicle details, vehicle identification numbers (vins). The breach dates from Jan 6, 2023; Have I Been Pwned loaded it on Jan 23, 2023.","tags":["data-breach","hibp","email-addresses","phone-numbers","physical-addresses","vehicle-details","vehicle-identification-numbers-vins"],"title":"Autotrader data breach: 20K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/autotrader-data-breach","vendor":"Autotrader"},{"auto":true,"category":"breach","closedAt":"2023-02-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KOMPLETTFRITID"],"json":"https://helix.ml/threat-watch/i/komplettfritid-data-breach.json","latestUpdate":{"date":"2023-01-23","title":"Have I Been Pwned loaded 139K breached KomplettFritid accounts"},"patchStatus":"no-fix-needed","product":"komplettfritid.no","severity":"high","severityNote":"139K accounts · passwords exposed","slug":"komplettfritid-data-breach","stacks":[],"startedAt":"2023-01-23","status":"closed","summary":"In January 2023, the online Norwegian store KomplettFritid was reported as having had a data breach dating back to February 2021. The incident exposed 140k customer records including physical, email and IP addresses, names, phone numbers and passwords. Most passwords were stored as bcrypt hashes with a small number appearing in plain text. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Feb 1, 2021; Have I Been Pwned loaded it on Jan 23, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"KomplettFritid data breach: 139K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/komplettfritid-data-breach","vendor":"KomplettFritid"},{"auto":true,"category":"breach","closedAt":"2023-02-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZURICH"],"json":"https://helix.ml/threat-watch/i/zurich-data-breach.json","latestUpdate":{"date":"2023-01-22","title":"Have I Been Pwned loaded 756K breached Zurich accounts"},"patchStatus":"no-fix-needed","product":"zurich.co.jp","severity":"medium","severityNote":"756K accounts","slug":"zurich-data-breach","stacks":[],"startedAt":"2023-01-22","status":"closed","summary":"In January 2023, the Japanese arm of Zurich insurance suffered a data breach that exposed 2.6M customer records with over 756k unique email addresses. The data was subsequently posted to a popular hacking forum and also included names, genders, dates of birth and details of insured vehicles. Exposed data: dates of birth, email addresses, genders, names, vehicle details. The breach dates from Jan 8, 2023; Have I Been Pwned loaded it on Jan 22, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","vehicle-details"],"title":"Zurich data breach: 756K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/zurich-data-breach","vendor":"Zurich"},{"auto":true,"category":"patch","closedAt":"2023-01-31","cveIds":["CVE-2022-44877"],"exploited":"in-the-wild","identifiers":["CVE-2022-44877"],"json":"https://helix.ml/threat-watch/i/cwp-control-web-panel-cve-2022-44877.json","latestUpdate":{"date":"2023-01-17","title":"CISA added CVE-2022-44877 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 7, 2023)"},"patchStatus":"patched","product":"Control Web Panel","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cwp-control-web-panel-cve-2022-44877","stacks":["wordpress"],"startedAt":"2023-01-17","status":"closed","summary":"CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter. CISA added CVE-2022-44877 to its Known Exploited Vulnerabilities catalog on Jan 17, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"CWP Control Web Panel OS Command Injection Vulnerability (CVE-2022-44877)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cwp-control-web-panel-cve-2022-44877","vendor":"CWP"},{"auto":true,"category":"patch","closedAt":"2023-01-24","cveIds":["CVE-2022-41080"],"exploited":"in-the-wild","identifiers":["CVE-2022-41080"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2022-41080.json","latestUpdate":{"date":"2023-01-10","title":"CISA added CVE-2022-41080 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 31, 2023)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2022-41080","stacks":["windows"],"startedAt":"2023-01-10","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. CISA added CVE-2022-41080 to its Known Exploited Vulnerabilities catalog on Jan 10, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","privilege-escalation"],"title":"Microsoft Exchange Server Privilege Escalation Vulnerability (CVE-2022-41080)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2022-41080","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2023-01-24","cveIds":["CVE-2023-21674"],"exploited":"in-the-wild","identifiers":["CVE-2023-21674"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-21674.json","latestUpdate":{"date":"2023-01-10","title":"CISA added CVE-2023-21674 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 31, 2023)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2023-21674","stacks":["windows"],"startedAt":"2023-01-10","status":"closed","summary":"Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2023-21674 to its Known Exploited Vulnerabilities catalog on Jan 10, 2023, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability (CVE-2023-21674)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2023-21674","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2023-01-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SLIDETEAM"],"json":"https://helix.ml/threat-watch/i/slideteam-data-breach.json","latestUpdate":{"date":"2023-01-07","title":"Have I Been Pwned loaded 1.5M breached SlideTeam accounts"},"patchStatus":"no-fix-needed","product":"slideteam.net","severity":"high","severityNote":"1.5M accounts · passwords exposed","slug":"slideteam-data-breach","stacks":[],"startedAt":"2023-01-07","status":"closed","summary":"In April 2021, the \"world’s largest collection of pre-designed presentation slides\" SlideTeam had 1.4M records breached and later published to a popular hacking forum the following year. Allegedly sourced from a compromised Magento instance, the data included names, email addresses and passwords stored as salted hashes. Exposed data: email addresses, names, passwords. The breach dates from Apr 6, 2021; Have I Been Pwned loaded it on Jan 7, 2023.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"SlideTeam data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/slideteam-data-breach","vendor":"SlideTeam"},{"auto":true,"category":"breach","closedAt":"2023-01-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOORDASH"],"json":"https://helix.ml/threat-watch/i/doordash-data-breach.json","latestUpdate":{"date":"2023-01-07","title":"Have I Been Pwned loaded 367K breached DoorDash accounts"},"patchStatus":"no-fix-needed","product":"doordash.com","severity":"high","severityNote":"367K accounts · financial data exposed","slug":"doordash-data-breach","stacks":[],"startedAt":"2023-01-07","status":"closed","summary":"In August 2022, the food ordering and delivery service DoorDash disclosed a data breach that impacted a portion of their customers. DoorDash attributed the breach to an unnamed \"third-party vendor\" they stated was the victim of a phishing campaign. The incident exposed 367k unique personal email addresses alongside names, post codes and partial card data, namely the brand, expiry data and last four digits of the card. Exposed data: email addresses, geographic locations, names, partial credit card data. The breach dates from Aug 2, 2022; Have I Been Pwned loaded it on Jan 7, 2023.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","partial-credit-card-data"],"title":"DoorDash data breach: 367K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/doordash-data-breach","vendor":"DoorDash"},{"auto":true,"category":"breach","closedAt":"2023-01-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TWITTER200M"],"json":"https://helix.ml/threat-watch/i/twitter200m-data-breach.json","latestUpdate":{"date":"2023-01-05","title":"Have I Been Pwned loaded 211.5M breached Twitter (200M) accounts"},"patchStatus":"no-fix-needed","product":"twitter.com","severity":"high","severityNote":"211.5M accounts","slug":"twitter200m-data-breach","stacks":[],"startedAt":"2023-01-05","status":"closed","summary":"In early 2023, over 200M records scraped from Twitter appeared on a popular hacking forum. The data was obtained sometime in 2021 by abusing an API that enabled email addresses to be resolved to Twitter profiles. The subsequent results were then composed into a corpus of data containing email addresses alongside public Twitter profile information including names, usernames and follower counts. Exposed data: email addresses, names, social media profiles, usernames. The breach dates from Jan 1, 2021; Have I Been Pwned loaded it on Jan 5, 2023.","tags":["data-breach","hibp","email-addresses","names","social-media-profiles","usernames"],"title":"Twitter (200M) data breach: 211.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/twitter200m-data-breach","vendor":"Twitter (200M)"},{"auto":true,"category":"breach","closedAt":"2023-01-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DEEZER"],"json":"https://helix.ml/threat-watch/i/deezer-data-breach.json","latestUpdate":{"date":"2023-01-02","title":"Have I Been Pwned loaded 229.0M breached Deezer accounts"},"patchStatus":"no-fix-needed","product":"deezer.com","severity":"high","severityNote":"229.0M accounts","slug":"deezer-data-breach","stacks":[],"startedAt":"2023-01-02","status":"closed","summary":"In late 2022, the music streaming service Deezer disclosed a data breach that impacted over 240M customers. The breach dated back to a mid-2019 backup exposed by a 3rd party partner which was subsequently sold and then broadly redistributed on a popular hacking forum. Impacted data included 229M unique email addresses, IP addresses, names, usernames, genders, DoBs and the geographic location of the customer. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, names, spoken languages, usernames. The breach dates from Apr 22, 2019; Have I Been Pwned loaded it on Jan 2, 2023.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","names","spoken-languages","usernames"],"title":"Deezer data breach: 229.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/deezer-data-breach","vendor":"Deezer"},{"auto":true,"category":"breach","closedAt":"2023-01-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BENCHMARK"],"json":"https://helix.ml/threat-watch/i/benchmark-data-breach.json","latestUpdate":{"date":"2023-01-01","title":"Have I Been Pwned loaded 93K breached Benchmark accounts"},"patchStatus":"no-fix-needed","product":"benchmark.rs","severity":"high","severityNote":"93K accounts · passwords exposed","slug":"benchmark-data-breach","stacks":[],"startedAt":"2023-01-01","status":"closed","summary":"In November 2019, the Serbian technology news website Benchmark suffered a breach of its forum that exposed 93k customer records. The breach exposed IP and email addresses, usernames and passwords stored as salted MD5 hashes. A forum administrator subsequently advised that the breach was due to the forum previously running on an outdated vBulletin instance. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Nov 1, 2019; Have I Been Pwned loaded it on Jan 1, 2023.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Benchmark data breach: 93K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/benchmark-data-breach","vendor":"Benchmark"},{"auto":true,"category":"patch","closedAt":"2023-01-12","cveIds":["CVE-2018-5430"],"exploited":"in-the-wild","identifiers":["CVE-2018-5430"],"json":"https://helix.ml/threat-watch/i/tibco-jasperreports-cve-2018-5430.json","latestUpdate":{"date":"2022-12-29","title":"CISA added CVE-2018-5430 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 19, 2023)"},"patchStatus":"patched","product":"JasperReports","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"tibco-jasperreports-cve-2018-5430","stacks":[],"startedAt":"2022-12-29","status":"closed","summary":"TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. CISA added CVE-2018-5430 to its Known Exploited Vulnerabilities catalog on Dec 29, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-22"],"title":"TIBCO JasperReports Server Information Disclosure Vulnerability (CVE-2018-5430)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/tibco-jasperreports-cve-2018-5430","vendor":"TIBCO"},{"auto":true,"category":"patch","closedAt":"2023-01-12","cveIds":["CVE-2018-18809"],"exploited":"in-the-wild","identifiers":["CVE-2018-18809"],"json":"https://helix.ml/threat-watch/i/tibco-jasperreports-cve-2018-18809.json","latestUpdate":{"date":"2022-12-29","title":"CISA added CVE-2018-18809 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 19, 2023)"},"patchStatus":"patched","product":"JasperReports","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"tibco-jasperreports-cve-2018-18809","stacks":[],"startedAt":"2022-12-29","status":"closed","summary":"TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system. CISA added CVE-2018-18809 to its Known Exploited Vulnerabilities catalog on Dec 29, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"TIBCO JasperReports Library Directory Traversal Vulnerability (CVE-2018-18809)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/tibco-jasperreports-cve-2018-18809","vendor":"TIBCO"},{"auto":true,"category":"breach","closedAt":"2022-12-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GEMINI"],"json":"https://helix.ml/threat-watch/i/gemini-data-breach.json","latestUpdate":{"date":"2022-12-16","title":"Have I Been Pwned loaded 5.3M breached Gemini accounts"},"patchStatus":"no-fix-needed","product":"gemini.com","severity":"medium","severityNote":"5.3M accounts","slug":"gemini-data-breach","stacks":[],"startedAt":"2022-12-16","status":"closed","summary":"In late 2022, a hacker posted a data set to a public hacking forum which they alleged was sourced from the Gemini crypto exchange, a claim that was later proven to be false as the data was traced back to an incident at a third-party vendor. The source of the breach was later established as being Twilio, who processed the data of some Gemini customers using their Authy service for 2FA. Twilio described the incident as stemming from a sophisticated social engineering attack designed to steal employee credentials. Exposed data: email addresses, partial phone numbers. The breach dates from Dec 13, 2022; Have I Been Pwned loaded it on Dec 16, 2022.","tags":["data-breach","hibp","email-addresses","partial-phone-numbers"],"title":"Gemini data breach: 5.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gemini-data-breach","vendor":"Gemini"},{"auto":true,"category":"patch","closedAt":"2022-12-28","cveIds":["CVE-2022-42856"],"exploited":"in-the-wild","identifiers":["CVE-2022-42856"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2022-42856.json","latestUpdate":{"date":"2022-12-14","title":"CISA added CVE-2022-42856 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 4, 2023)"},"patchStatus":"patched","product":"iOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2022-42856","stacks":["ios"],"startedAt":"2022-12-14","status":"closed","summary":"Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution. CISA added CVE-2022-42856 to its Known Exploited Vulnerabilities catalog on Dec 14, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Apple iOS Type Confusion Vulnerability (CVE-2022-42856)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2022-42856","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-12-27","cveIds":["CVE-2022-42475"],"exploited":"in-the-wild","identifiers":["CVE-2022-42475"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2022-42475.json","latestUpdate":{"date":"2022-12-13","title":"CISA added CVE-2022-42475 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 3, 2023)"},"patchStatus":"patched","product":"FortiOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2022-42475","stacks":["network","vpn"],"startedAt":"2022-12-13","status":"closed","summary":"Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests. CISA added CVE-2022-42475 to its Known Exploited Vulnerabilities catalog on Dec 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-197"],"title":"Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability (CVE-2022-42475)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2022-42475","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2022-12-27","cveIds":["CVE-2022-44698"],"exploited":"in-the-wild","identifiers":["CVE-2022-44698"],"json":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2022-44698.json","latestUpdate":{"date":"2022-12-13","title":"CISA added CVE-2022-44698 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 3, 2023)"},"patchStatus":"patched","product":"Defender","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-defender-cve-2022-44698","stacks":[],"startedAt":"2022-12-13","status":"closed","summary":"Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. CISA added CVE-2022-44698 to its Known Exploited Vulnerabilities catalog on Dec 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-755"],"title":"Microsoft Defender SmartScreen Security Feature Bypass Vulnerability (CVE-2022-44698)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2022-44698","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-12-27","cveIds":["CVE-2022-27518"],"exploited":"in-the-wild","identifiers":["CVE-2022-27518"],"json":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-and-gateway-cve-2022-27518.json","latestUpdate":{"date":"2022-12-13","title":"CISA added CVE-2022-27518 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 3, 2023)"},"patchStatus":"patched","product":"Application Delivery Controller (ADC) and Gateway","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-application-delivery-controller-adc-and-gateway-cve-2022-27518","stacks":["cloud"],"startedAt":"2022-12-13","status":"closed","summary":"Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator. CISA added CVE-2022-27518 to its Known Exploited Vulnerabilities catalog on Dec 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-664"],"title":"Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability (CVE-2022-27518)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-and-gateway-cve-2022-27518","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2022-12-27","cveIds":["CVE-2022-26500"],"exploited":"in-the-wild","identifiers":["CVE-2022-26500"],"json":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2022-26500.json","latestUpdate":{"date":"2022-12-13","title":"CISA added CVE-2022-26500 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 3, 2023)"},"patchStatus":"patched","product":"Backup \u0026 Replication","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"veeam-backup-replication-cve-2022-26500","stacks":[],"startedAt":"2022-12-13","status":"closed","summary":"The Veeam Distribution Service in the Backup \u0026 Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. CISA added CVE-2022-26500 to its Known Exploited Vulnerabilities catalog on Dec 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-22"],"title":"Veeam Backup \u0026 Replication Remote Code Execution Vulnerability (CVE-2022-26500)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2022-26500","vendor":"Veeam"},{"auto":true,"category":"patch","closedAt":"2022-12-27","cveIds":["CVE-2022-26501"],"exploited":"in-the-wild","identifiers":["CVE-2022-26501"],"json":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2022-26501.json","latestUpdate":{"date":"2022-12-13","title":"CISA added CVE-2022-26501 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 3, 2023)"},"patchStatus":"patched","product":"Backup \u0026 Replication","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"veeam-backup-replication-cve-2022-26501","stacks":[],"startedAt":"2022-12-13","status":"closed","summary":"The Veeam Distribution Service in the Backup \u0026 Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. CISA added CVE-2022-26501 to its Known Exploited Vulnerabilities catalog on Dec 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-306"],"title":"Veeam Backup \u0026 Replication Remote Code Execution Vulnerability (CVE-2022-26501)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/veeam-backup-replication-cve-2022-26501","vendor":"Veeam"},{"auto":true,"category":"breach","closedAt":"2022-12-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COINTRACKER"],"json":"https://helix.ml/threat-watch/i/cointracker-data-breach.json","latestUpdate":{"date":"2022-12-12","title":"Have I Been Pwned loaded 1.6M breached CoinTracker accounts"},"patchStatus":"no-fix-needed","product":"cointracker.io","severity":"medium","severityNote":"1.6M accounts","slug":"cointracker-data-breach","stacks":[],"startedAt":"2022-12-12","status":"closed","summary":"In December 2022, the Crypto \u0026 NFT taxes service CoinTracker reported a data breach that impacted over 1.5M of their customers. The company later attributed the breach to a compromise SendGrid in an attack that targeted multiple customers of the email provider. The breach exposed email addresses and partially redacted phone numbers, with CoinTracker advising that the later did not originate from their service. Exposed data: email addresses, partial phone numbers. The breach dates from Dec 1, 2022; Have I Been Pwned loaded it on Dec 12, 2022.","tags":["data-breach","hibp","email-addresses","partial-phone-numbers"],"title":"CoinTracker data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cointracker-data-breach","vendor":"CoinTracker"},{"auto":true,"category":"breach","closedAt":"2022-12-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ABANDONIA2022"],"json":"https://helix.ml/threat-watch/i/abandonia2022-data-breach.json","latestUpdate":{"date":"2022-12-07","title":"Have I Been Pwned loaded 919K breached Abandonia (2022) accounts"},"patchStatus":"no-fix-needed","product":"abandonia.com","severity":"high","severityNote":"919K accounts · passwords exposed","slug":"abandonia2022-data-breach","stacks":[],"startedAt":"2022-12-07","status":"closed","summary":"In November 2022, the gaming website dedicated to classic DOS games Abandonia suffered a data breach resulting in the exposure of 920k unique user records. This breach was in addition to another one 7 years earlier in 2015. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Nov 15, 2022; Have I Been Pwned loaded it on Dec 7, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Abandonia (2022) data breach: 919K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/abandonia2022-data-breach","vendor":"Abandonia (2022)"},{"auto":true,"category":"patch","closedAt":"2022-12-19","cveIds":["CVE-2022-4262"],"exploited":"in-the-wild","identifiers":["CVE-2022-4262"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-4262.json","latestUpdate":{"date":"2022-12-05","title":"CISA added CVE-2022-4262 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 26, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2022-4262","stacks":["browser"],"startedAt":"2022-12-05","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-4262 to its Known Exploited Vulnerabilities catalog on Dec 5, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2022-4262)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-4262","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-12-12","cveIds":["CVE-2021-35587"],"exploited":"in-the-wild","identifiers":["CVE-2021-35587"],"json":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2021-35587.json","latestUpdate":{"date":"2022-11-28","title":"CISA added CVE-2021-35587 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 19, 2022)"},"patchStatus":"patched","product":"Fusion Middleware","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-fusion-middleware-cve-2021-35587","stacks":[],"startedAt":"2022-11-28","status":"closed","summary":"Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product. CISA added CVE-2021-35587 to its Known Exploited Vulnerabilities catalog on Nov 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-502","cwe-790"],"title":"Oracle Fusion Middleware Unspecified Vulnerability (CVE-2021-35587)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2021-35587","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-12-12","cveIds":["CVE-2022-4135"],"exploited":"in-the-wild","identifiers":["CVE-2022-4135"],"json":"https://helix.ml/threat-watch/i/google-chromium-gpu-cve-2022-4135.json","latestUpdate":{"date":"2022-11-28","title":"CISA added CVE-2022-4135 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 19, 2022)"},"patchStatus":"patched","product":"Chromium GPU","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-gpu-cve-2022-4135","stacks":["browser"],"startedAt":"2022-11-28","status":"closed","summary":"Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-4135 to its Known Exploited Vulnerabilities catalog on Nov 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium GPU Heap Buffer Overflow Vulnerability (CVE-2022-4135)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-gpu-cve-2022-4135","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2022-11-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GETREVENGEONYOUREX"],"json":"https://helix.ml/threat-watch/i/getrevengeonyourex-data-breach.json","latestUpdate":{"date":"2022-11-15","title":"Have I Been Pwned loaded 79K breached Get Revenge On Your Ex accounts"},"patchStatus":"no-fix-needed","product":"getrevengeonyourex.com","severity":"high","severityNote":"79K accounts · passwords exposed","slug":"getrevengeonyourex-data-breach","stacks":[],"startedAt":"2022-11-15","status":"closed","summary":"In September 2022, the revenge website Get Revenge On Your Ex suffered a data breach that exposed almost 80k unique email addresses. The data spanned both customers and victims including names, IP and physical addresses, phone numbers, purchase histories and plain text passwords. The data was subsequently shared on a public hacking forum, Get Revenge On Your Ex did not reply when contacted. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Sep 9, 2022; Have I Been Pwned loaded it on Nov 15, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","purchases"],"title":"Get Revenge On Your Ex data breach: 79K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/getrevengeonyourex-data-breach","vendor":"Get Revenge On Your Ex"},{"auto":true,"category":"patch","closedAt":"2022-11-28","cveIds":["CVE-2022-41049"],"exploited":"in-the-wild","identifiers":["CVE-2022-41049"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41049.json","latestUpdate":{"date":"2022-11-14","title":"CISA added CVE-2022-41049 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2022)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-41049","stacks":["windows"],"startedAt":"2022-11-14","status":"closed","summary":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. CISA added CVE-2022-41049 to its Known Exploited Vulnerabilities catalog on Nov 14, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-274"],"title":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability (CVE-2022-41049)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41049","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-11-22","cveIds":["CVE-2022-41091"],"exploited":"in-the-wild","identifiers":["CVE-2022-41091"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41091.json","latestUpdate":{"date":"2022-11-08","title":"CISA added CVE-2022-41091 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2022)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-41091","stacks":["windows"],"startedAt":"2022-11-08","status":"closed","summary":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. CISA added CVE-2022-41091 to its Known Exploited Vulnerabilities catalog on Nov 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-863"],"title":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability (CVE-2022-41091)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41091","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-11-22","cveIds":["CVE-2022-41073"],"exploited":"in-the-wild","identifiers":["CVE-2022-41073"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41073.json","latestUpdate":{"date":"2022-11-08","title":"CISA added CVE-2022-41073 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-41073","stacks":["windows"],"startedAt":"2022-11-08","status":"closed","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. CISA added CVE-2022-41073 to its Known Exploited Vulnerabilities catalog on Nov 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-787"],"title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability (CVE-2022-41073)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41073","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-11-22","cveIds":["CVE-2022-41125"],"exploited":"in-the-wild","identifiers":["CVE-2022-41125"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41125.json","latestUpdate":{"date":"2022-11-08","title":"CISA added CVE-2022-41125 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-41125","stacks":["windows"],"startedAt":"2022-11-08","status":"closed","summary":"Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. CISA added CVE-2022-41125 to its Known Exploited Vulnerabilities catalog on Nov 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-787"],"title":"Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability (CVE-2022-41125)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41125","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-11-22","cveIds":["CVE-2022-41128"],"exploited":"in-the-wild","identifiers":["CVE-2022-41128"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41128.json","latestUpdate":{"date":"2022-11-08","title":"CISA added CVE-2022-41128 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 9, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-41128","stacks":["windows"],"startedAt":"2022-11-08","status":"closed","summary":"Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution. CISA added CVE-2022-41128 to its Known Exploited Vulnerabilities catalog on Nov 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-787"],"title":"Microsoft Windows Scripting Languages Remote Code Execution Vulnerability (CVE-2022-41128)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-41128","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-11-22","cveIds":["CVE-2021-25337"],"exploited":"in-the-wild","identifiers":["CVE-2021-25337"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25337.json","latestUpdate":{"date":"2022-11-08","title":"CISA added CVE-2021-25337 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 29, 2022)"},"patchStatus":"patched","product":"Mobile Devices","severity":"high","severityNote":"CVSS 7.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25337","stacks":[],"startedAt":"2022-11-08","status":"closed","summary":"Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370. CISA added CVE-2021-25337 to its Known Exploited Vulnerabilities catalog on Nov 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-269"],"title":"Samsung Mobile Devices Improper Access Control Vulnerability (CVE-2021-25337)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25337","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2022-11-22","cveIds":["CVE-2021-25369"],"exploited":"in-the-wild","identifiers":["CVE-2021-25369"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25369.json","latestUpdate":{"date":"2022-11-08","title":"CISA added CVE-2021-25369 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 29, 2022)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25369","stacks":[],"startedAt":"2022-11-08","status":"closed","summary":"Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370. CISA added CVE-2021-25369 to its Known Exploited Vulnerabilities catalog on Nov 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Samsung Mobile Devices Improper Access Control Vulnerability (CVE-2021-25369)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25369","vendor":"Samsung"},{"auto":true,"category":"patch","closedAt":"2022-11-22","cveIds":["CVE-2021-25370"],"exploited":"in-the-wild","identifiers":["CVE-2021-25370"],"json":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25370.json","latestUpdate":{"date":"2022-11-08","title":"CISA added CVE-2021-25370 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 29, 2022)"},"patchStatus":"patched","product":"Mobile Devices","severity":"medium","severityNote":"CVSS 4.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"samsung-mobile-devices-cve-2021-25370","stacks":[],"startedAt":"2022-11-08","status":"closed","summary":"Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369. CISA added CVE-2021-25370 to its Known Exploited Vulnerabilities catalog on Nov 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Samsung Mobile Devices Memory Corruption Vulnerability (CVE-2021-25370)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/samsung-mobile-devices-cve-2021-25370","vendor":"Samsung"},{"auto":true,"category":"breach","closedAt":"2022-11-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GGCORP"],"json":"https://helix.ml/threat-watch/i/ggcorp-data-breach.json","latestUpdate":{"date":"2022-11-08","title":"Have I Been Pwned loaded 2.4M breached GGCorp accounts"},"patchStatus":"no-fix-needed","product":"ggcorp.me","severity":"high","severityNote":"2.4M accounts · passwords exposed","slug":"ggcorp-data-breach","stacks":[],"startedAt":"2022-11-08","status":"closed","summary":"In August 2022, the MMORPG website GGCorp suffered a data breach that exposed almost 2.4M unique email addresses. The data also included IP addresses, usernames and MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Aug 11, 2022; Have I Been Pwned loaded it on Nov 8, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"GGCorp data breach: 2.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ggcorp-data-breach","vendor":"GGCorp"},{"auto":true,"category":"breach","closedAt":"2022-11-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LOLZTEAM"],"json":"https://helix.ml/threat-watch/i/lolzteam-data-breach.json","latestUpdate":{"date":"2022-11-06","title":"Have I Been Pwned loaded 398K breached Lolzteam accounts"},"patchStatus":"no-fix-needed","product":"lolzteam.net","severity":"medium","severityNote":"398K accounts","slug":"lolzteam-data-breach","stacks":[],"startedAt":"2022-11-06","status":"closed","summary":"In May 2018, the Russian hacking forum Lolzteam suffered a data breach that exposed 400k members. The impacted data included usernames and email addresses which were later redistributed via another hacking forum. Exposed data: email addresses, usernames. The breach dates from May 13, 2018; Have I Been Pwned loaded it on Nov 6, 2022.","tags":["data-breach","hibp","email-addresses","usernames"],"title":"Lolzteam data breach: 398K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lolzteam-data-breach","vendor":"Lolzteam"},{"auto":true,"category":"patch","closedAt":"2022-11-11","cveIds":["CVE-2022-3723"],"exploited":"in-the-wild","identifiers":["CVE-2022-3723"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-3723.json","latestUpdate":{"date":"2022-10-28","title":"CISA added CVE-2022-3723 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 18, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2022-3723","stacks":["browser"],"startedAt":"2022-10-28","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-3723 to its Known Exploited Vulnerabilities catalog on Oct 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2022-3723)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-3723","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-11-08","cveIds":["CVE-2022-42827"],"exploited":"in-the-wild","identifiers":["CVE-2022-42827"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2022-42827.json","latestUpdate":{"date":"2022-10-25","title":"CISA added CVE-2022-42827 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 15, 2022)"},"patchStatus":"patched","product":"iOS and iPadOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-ipados-cve-2022-42827","stacks":["ios"],"startedAt":"2022-10-25","status":"closed","summary":"Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges. CISA added CVE-2022-42827 to its Known Exploited Vulnerabilities catalog on Oct 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-20","cwe-787"],"title":"Apple iOS and iPadOS Out-of-Bounds Write Vulnerability (CVE-2022-42827)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2022-42827","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-11-07","cveIds":["CVE-2020-3433"],"exploited":"in-the-wild","identifiers":["CVE-2020-3433"],"json":"https://helix.ml/threat-watch/i/cisco-anyconnect-secure-cve-2020-3433.json","latestUpdate":{"date":"2022-10-24","title":"CISA added CVE-2020-3433 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2022)"},"patchStatus":"patched","product":"AnyConnect Secure","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-anyconnect-secure-cve-2020-3433","stacks":["network","vpn","windows"],"startedAt":"2022-10-24","status":"closed","summary":"Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges. CISA added CVE-2020-3433 to its Known Exploited Vulnerabilities catalog on Oct 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-427"],"title":"Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability (CVE-2020-3433)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-anyconnect-secure-cve-2020-3433","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-11-07","cveIds":["CVE-2020-3153"],"exploited":"in-the-wild","identifiers":["CVE-2020-3153"],"json":"https://helix.ml/threat-watch/i/cisco-anyconnect-secure-cve-2020-3153.json","latestUpdate":{"date":"2022-10-24","title":"CISA added CVE-2020-3153 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2022)"},"patchStatus":"patched","product":"AnyConnect Secure","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-anyconnect-secure-cve-2020-3153","stacks":["network","vpn","windows"],"startedAt":"2022-10-24","status":"closed","summary":"Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. CISA added CVE-2020-3153 to its Known Exploited Vulnerabilities catalog on Oct 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-427"],"title":"Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability (CVE-2020-3153)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-anyconnect-secure-cve-2020-3153","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-11-07","cveIds":["CVE-2018-19323"],"exploited":"in-the-wild","identifiers":["CVE-2018-19323"],"json":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19323.json","latestUpdate":{"date":"2022-10-24","title":"CISA added CVE-2018-19323 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gigabyte-multiple-products-cve-2018-19323","stacks":[],"startedAt":"2022-10-24","status":"closed","summary":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. CISA added CVE-2018-19323 to its Known Exploited Vulnerabilities catalog on Oct 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"GIGABYTE Multiple Products Privilege Escalation Vulnerability (CVE-2018-19323)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19323","vendor":"GIGABYTE"},{"auto":true,"category":"patch","closedAt":"2022-11-07","cveIds":["CVE-2018-19322"],"exploited":"in-the-wild","identifiers":["CVE-2018-19322"],"json":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19322.json","latestUpdate":{"date":"2022-10-24","title":"CISA added CVE-2018-19322 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gigabyte-multiple-products-cve-2018-19322","stacks":[],"startedAt":"2022-10-24","status":"closed","summary":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges. CISA added CVE-2018-19322 to its Known Exploited Vulnerabilities catalog on Oct 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-749"],"title":"GIGABYTE Multiple Products Code Execution Vulnerability (CVE-2018-19322)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19322","vendor":"GIGABYTE"},{"auto":true,"category":"patch","closedAt":"2022-11-07","cveIds":["CVE-2018-19321"],"exploited":"in-the-wild","identifiers":["CVE-2018-19321"],"json":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19321.json","latestUpdate":{"date":"2022-10-24","title":"CISA added CVE-2018-19321 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gigabyte-multiple-products-cve-2018-19321","stacks":[],"startedAt":"2022-10-24","status":"closed","summary":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. CISA added CVE-2018-19321 to its Known Exploited Vulnerabilities catalog on Oct 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"GIGABYTE Multiple Products Privilege Escalation Vulnerability (CVE-2018-19321)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19321","vendor":"GIGABYTE"},{"auto":true,"category":"patch","closedAt":"2022-11-07","cveIds":["CVE-2018-19320"],"exploited":"in-the-wild","identifiers":["CVE-2018-19320"],"json":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19320.json","latestUpdate":{"date":"2022-10-24","title":"CISA added CVE-2018-19320 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 14, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gigabyte-multiple-products-cve-2018-19320","stacks":[],"startedAt":"2022-10-24","status":"closed","summary":"The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system. CISA added CVE-2018-19320 to its Known Exploited Vulnerabilities catalog on Oct 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"GIGABYTE Multiple Products Unspecified Vulnerability (CVE-2018-19320)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/gigabyte-multiple-products-cve-2018-19320","vendor":"GIGABYTE"},{"auto":true,"category":"breach","closedAt":"2022-11-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EPAL"],"json":"https://helix.ml/threat-watch/i/epal-data-breach.json","latestUpdate":{"date":"2022-10-24","title":"Have I Been Pwned loaded 108K breached E-Pal accounts"},"patchStatus":"no-fix-needed","product":"epal.gg","severity":"medium","severityNote":"108K accounts","slug":"epal-data-breach","stacks":[],"startedAt":"2022-10-24","status":"closed","summary":"In October 2022, the service dedicated to finding friends on Discord known as E-Pal disclosed a data breach. The compromised data included over 100k unique email addresses and usernames spanning approximately 1M orders. The data was subsequently distributed via a popular hacking forum. Exposed data: email addresses, purchases, usernames. The breach dates from Apr 15, 2022; Have I Been Pwned loaded it on Oct 24, 2022.","tags":["data-breach","hibp","email-addresses","purchases","usernames"],"title":"E-Pal data breach: 108K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/epal-data-breach","vendor":"E-Pal"},{"auto":true,"category":"breach","closedAt":"2022-11-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOOMWORLD"],"json":"https://helix.ml/threat-watch/i/doomworld-data-breach.json","latestUpdate":{"date":"2022-10-24","title":"Have I Been Pwned loaded 34K breached Doomworld accounts"},"patchStatus":"no-fix-needed","product":"doomworld.com","severity":"high","severityNote":"34K accounts · passwords exposed","slug":"doomworld-data-breach","stacks":[],"startedAt":"2022-10-24","status":"closed","summary":"In October 2022, the Doomworld fourm suffered a data breach that exposed 34k member records. The data included email and IP addresses, usernames and bcrypt password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 12, 2022; Have I Been Pwned loaded it on Oct 24, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Doomworld data breach: 34K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/doomworld-data-breach","vendor":"Doomworld"},{"auto":true,"category":"patch","closedAt":"2022-11-03","cveIds":["CVE-2022-41352"],"exploited":"in-the-wild","identifiers":["CVE-2022-41352"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-41352.json","latestUpdate":{"date":"2022-10-20","title":"CISA added CVE-2022-41352 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2022)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2022-41352","stacks":[],"startedAt":"2022-10-20","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts. CISA added CVE-2022-41352 to its Known Exploited Vulnerabilities catalog on Oct 20, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-22"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability (CVE-2022-41352)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-41352","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2022-11-03","cveIds":["CVE-2021-3493"],"exploited":"in-the-wild","identifiers":["CVE-2021-3493"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2021-3493.json","latestUpdate":{"date":"2022-10-20","title":"CISA added CVE-2021-3493 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 10, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2021-3493","stacks":["linux"],"startedAt":"2022-10-20","status":"closed","summary":"The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation. CISA added CVE-2021-3493 to its Known Exploited Vulnerabilities catalog on Oct 20, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-862"],"title":"Linux Kernel Privilege Escalation Vulnerability (CVE-2021-3493)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2021-3493","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-10-25","cveIds":["CVE-2022-40684"],"exploited":"in-the-wild","identifiers":["CVE-2022-40684"],"json":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2022-40684.json","latestUpdate":{"date":"2022-10-11","title":"CISA added CVE-2022-40684 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 1, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-multiple-products-cve-2022-40684","stacks":["network"],"startedAt":"2022-10-11","status":"closed","summary":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. CISA added CVE-2022-40684 to its Known Exploited Vulnerabilities catalog on Oct 11, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-288"],"title":"Fortinet Multiple Products Authentication Bypass Vulnerability (CVE-2022-40684)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2022-40684","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2022-10-25","cveIds":["CVE-2022-41033"],"exploited":"in-the-wild","identifiers":["CVE-2022-41033"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-com-event-system-service-cve-2022-41033.json","latestUpdate":{"date":"2022-10-11","title":"CISA added CVE-2022-41033 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 1, 2022)"},"patchStatus":"patched","product":"Windows COM+ Event System Service","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-com-event-system-service-cve-2022-41033","stacks":["windows"],"startedAt":"2022-10-11","status":"closed","summary":"Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2022-41033 to its Known Exploited Vulnerabilities catalog on Oct 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-843"],"title":"Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability (CVE-2022-41033)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-com-event-system-service-cve-2022-41033","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2022-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BHINNEKA"],"json":"https://helix.ml/threat-watch/i/bhinneka-data-breach.json","latestUpdate":{"date":"2022-10-06","title":"Have I Been Pwned loaded 1.3M breached Bhinneka accounts"},"patchStatus":"no-fix-needed","product":"bhinneka.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"bhinneka-data-breach","stacks":[],"startedAt":"2022-10-06","status":"closed","summary":"In early 2020, the Indonesian consumer electronics website Bhinneka suffered a data breach that exposed almost 1.3M customer records. The data included email and physical addresses, names, genders, dates of birth, phone numbers and salted password hashes. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses. The breach dates from Jan 27, 2020; Have I Been Pwned loaded it on Oct 6, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses"],"title":"Bhinneka data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bhinneka-data-breach","vendor":"Bhinneka"},{"auto":true,"category":"breach","closedAt":"2022-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WAKANIM"],"json":"https://helix.ml/threat-watch/i/wakanim-data-breach.json","latestUpdate":{"date":"2022-10-06","title":"Have I Been Pwned loaded 6.7M breached Wakanim accounts"},"patchStatus":"no-fix-needed","product":"wakanim.tv","severity":"medium","severityNote":"6.7M accounts","slug":"wakanim-data-breach","stacks":[],"startedAt":"2022-10-06","status":"closed","summary":"In August 2022, the European streaming service Wakanim suffered a data breach which was subsequently advertised and sold on a popular hacking forum. The breach exposed 6.7M customer records including email, IP and physical addresses, names and usernames. Exposed data: browser user agent details, email addresses, ip addresses, names, physical addresses, usernames. The breach dates from Aug 28, 2022; Have I Been Pwned loaded it on Oct 6, 2022.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","names","physical-addresses","usernames"],"title":"Wakanim data breach: 6.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wakanim-data-breach","vendor":"Wakanim"},{"auto":true,"category":"patch","closedAt":"2022-10-14","cveIds":["CVE-2022-41082"],"exploited":"in-the-wild","identifiers":["CVE-2022-41082"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2022-41082.json","latestUpdate":{"date":"2022-09-30","title":"CISA added CVE-2022-41082 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 21, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2022-41082","stacks":["windows"],"startedAt":"2022-09-30","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. CISA added CVE-2022-41082 to its Known Exploited Vulnerabilities catalog on Sep 30, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-502"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2022-41082)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2022-41082","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-10-14","cveIds":["CVE-2022-41040"],"exploited":"in-the-wild","identifiers":["CVE-2022-41040"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2022-41040.json","latestUpdate":{"date":"2022-09-30","title":"CISA added CVE-2022-41040 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 21, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2022-41040","stacks":["windows"],"startedAt":"2022-09-30","status":"closed","summary":"Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution. CISA added CVE-2022-41040 to its Known Exploited Vulnerabilities catalog on Sep 30, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","ssrf","cwe-918"],"title":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability (CVE-2022-41040)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2022-41040","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-10-14","cveIds":["CVE-2022-36804"],"exploited":"in-the-wild","identifiers":["CVE-2022-36804"],"json":"https://helix.ml/threat-watch/i/atlassian-bitbucket-server-and-data-center-cve-2022-36804.json","latestUpdate":{"date":"2022-09-30","title":"CISA added CVE-2022-36804 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 21, 2022)"},"patchStatus":"patched","product":"Bitbucket Server and Data Center","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-bitbucket-server-and-data-center-cve-2022-36804","stacks":["devtools"],"startedAt":"2022-09-30","status":"closed","summary":"Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request. CISA added CVE-2022-36804 to its Known Exploited Vulnerabilities catalog on Sep 30, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-88","cwe-158"],"title":"Atlassian Bitbucket Server and Data Center Command Injection Vulnerability (CVE-2022-36804)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/atlassian-bitbucket-server-and-data-center-cve-2022-36804","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2022-10-07","cveIds":["CVE-2022-3236"],"exploited":"in-the-wild","identifiers":["CVE-2022-3236"],"json":"https://helix.ml/threat-watch/i/sophos-firewall-cve-2022-3236.json","latestUpdate":{"date":"2022-09-23","title":"CISA added CVE-2022-3236 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 14, 2022)"},"patchStatus":"patched","product":"Firewall","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sophos-firewall-cve-2022-3236","stacks":["network"],"startedAt":"2022-09-23","status":"closed","summary":"A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution. CISA added CVE-2022-3236 to its Known Exploited Vulnerabilities catalog on Sep 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Sophos Firewall Code Injection Vulnerability (CVE-2022-3236)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sophos-firewall-cve-2022-3236","vendor":"Sophos"},{"auto":true,"category":"breach","closedAt":"2022-10-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TAPAIRPORTUGAL"],"json":"https://helix.ml/threat-watch/i/tapairportugal-data-breach.json","latestUpdate":{"date":"2022-09-23","title":"Have I Been Pwned loaded 6.1M breached TAP Air Portugal accounts"},"patchStatus":"no-fix-needed","product":"flytap.com","severity":"medium","severityNote":"6.1M accounts","slug":"tapairportugal-data-breach","stacks":[],"startedAt":"2022-09-23","status":"closed","summary":"In August 2022, the Portuguese airline TAP Air Portugal was the target of a ransomware attack perpetrated by the Ragnar Locker gang who later leaked the compromised data via a public dark web site. Over 5M unique email addresses were exposed alongside other personal data including names, genders, DoBs, phone numbers and physical addresses. Exposed data: dates of birth, email addresses, genders, names, nationalities, phone numbers, physical addresses, salutations, spoken languages. The breach dates from Aug 25, 2022; Have I Been Pwned loaded it on Sep 23, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","nationalities","phone-numbers","physical-addresses","salutations","spoken-languages"],"title":"TAP Air Portugal data breach: 6.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tapairportugal-data-breach","vendor":"TAP Air Portugal"},{"auto":true,"category":"patch","closedAt":"2022-10-06","cveIds":["CVE-2022-35405"],"exploited":"in-the-wild","identifiers":["CVE-2022-35405"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2022-35405.json","latestUpdate":{"date":"2022-09-22","title":"CISA added CVE-2022-35405 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 13, 2022)"},"patchStatus":"patched","product":"ManageEngine","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-cve-2022-35405","stacks":[],"startedAt":"2022-09-22","status":"closed","summary":"Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution. CISA added CVE-2022-35405 to its Known Exploited Vulnerabilities catalog on Sep 22, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-502"],"title":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability (CVE-2022-35405)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2022-35405","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2022-09-29","cveIds":["CVE-2022-40139"],"exploited":"in-the-wild","identifiers":["CVE-2022-40139"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-apex-one-as-a-service-cve-2022-40139.json","latestUpdate":{"date":"2022-09-15","title":"CISA added CVE-2022-40139 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 6, 2022)"},"patchStatus":"patched","product":"Apex One and Apex One as a Service","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-and-apex-one-as-a-service-cve-2022-40139","stacks":[],"startedAt":"2022-09-15","status":"closed","summary":"Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution. CISA added CVE-2022-40139 to its Known Exploited Vulnerabilities catalog on Sep 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-353","cwe-641"],"title":"Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability (CVE-2022-40139)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-apex-one-as-a-service-cve-2022-40139","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2022-09-29","cveIds":["CVE-2013-6282"],"exploited":"in-the-wild","identifiers":["CVE-2013-6282"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2013-6282.json","latestUpdate":{"date":"2022-09-15","title":"CISA added CVE-2013-6282 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 6, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2013-6282","stacks":["linux"],"startedAt":"2022-09-15","status":"closed","summary":"The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation. CISA added CVE-2013-6282 to its Known Exploited Vulnerabilities catalog on Sep 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-20"],"title":"Linux Kernel Improper Input Validation Vulnerability (CVE-2013-6282)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2013-6282","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-09-29","cveIds":["CVE-2013-2597"],"exploited":"in-the-wild","identifiers":["CVE-2013-2597"],"json":"https://helix.ml/threat-watch/i/code-aurora-acdb-audio-driver-cve-2013-2597.json","latestUpdate":{"date":"2022-09-15","title":"CISA added CVE-2013-2597 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 6, 2022)"},"patchStatus":"patched","product":"ACDB Audio Driver","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"code-aurora-acdb-audio-driver-cve-2013-2597","stacks":[],"startedAt":"2022-09-15","status":"closed","summary":"The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android. CISA added CVE-2013-2597 to its Known Exploited Vulnerabilities catalog on Sep 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-119"],"title":"Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability (CVE-2013-2597)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/code-aurora-acdb-audio-driver-cve-2013-2597","vendor":"Code Aurora"},{"auto":true,"category":"patch","closedAt":"2022-09-29","cveIds":["CVE-2013-2596"],"exploited":"in-the-wild","identifiers":["CVE-2013-2596"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2013-2596.json","latestUpdate":{"date":"2022-09-15","title":"CISA added CVE-2013-2596 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 6, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2013-2596","stacks":["linux"],"startedAt":"2022-09-15","status":"closed","summary":"Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation. CISA added CVE-2013-2596 to its Known Exploited Vulnerabilities catalog on Sep 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-189"],"title":"Linux Kernel Integer Overflow Vulnerability (CVE-2013-2596)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2013-2596","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-09-29","cveIds":["CVE-2013-2094"],"exploited":"in-the-wild","identifiers":["CVE-2013-2094"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2013-2094.json","latestUpdate":{"date":"2022-09-15","title":"CISA added CVE-2013-2094 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 6, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2013-2094","stacks":["linux"],"startedAt":"2022-09-15","status":"closed","summary":"Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation. CISA added CVE-2013-2094 to its Known Exploited Vulnerabilities catalog on Sep 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-189"],"title":"Linux Kernel Privilege Escalation Vulnerability (CVE-2013-2094)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2013-2094","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-09-29","cveIds":["CVE-2010-2568"],"exploited":"in-the-wild","identifiers":["CVE-2010-2568"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2010-2568.json","latestUpdate":{"date":"2022-09-15","title":"CISA added CVE-2010-2568 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 6, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2010-2568","stacks":["windows"],"startedAt":"2022-09-15","status":"closed","summary":"Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user. CISA added CVE-2010-2568 to its Known Exploited Vulnerabilities catalog on Sep 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Windows Remote Code Execution Vulnerability (CVE-2010-2568)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2010-2568","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-09-28","cveIds":["CVE-2022-37969"],"exploited":"in-the-wild","identifiers":["CVE-2022-37969"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-37969.json","latestUpdate":{"date":"2022-09-14","title":"CISA added CVE-2022-37969 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-37969","stacks":["windows"],"startedAt":"2022-09-14","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2022-37969 to its Known Exploited Vulnerabilities catalog on Sep 14, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-20","cwe-787"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (CVE-2022-37969)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-37969","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-09-28","cveIds":["CVE-2022-32917"],"exploited":"in-the-wild","identifiers":["CVE-2022-32917"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2022-32917.json","latestUpdate":{"date":"2022-09-14","title":"CISA added CVE-2022-32917 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2022)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2022-32917","stacks":["ios","macos"],"startedAt":"2022-09-14","status":"closed","summary":"Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges. CISA added CVE-2022-32917 to its Known Exploited Vulnerabilities catalog on Sep 14, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20","cwe-787"],"title":"Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability (CVE-2022-32917)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2022-32917","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2022-3075"],"exploited":"in-the-wild","identifiers":["CVE-2022-3075"],"json":"https://helix.ml/threat-watch/i/google-chromium-mojo-cve-2022-3075.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2022-3075 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"patched","product":"Chromium Mojo","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-mojo-cve-2022-3075","stacks":["browser"],"startedAt":"2022-09-08","status":"closed","summary":"Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-3075 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Google Chromium Mojo Insufficient Data Validation Vulnerability (CVE-2022-3075)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-mojo-cve-2022-3075","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2022-27593"],"exploited":"in-the-wild","identifiers":["CVE-2022-27593"],"json":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2022-27593.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2022-27593 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"patched","product":"Photo Station","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-photo-station-cve-2022-27593","stacks":[],"startedAt":"2022-09-08","status":"closed","summary":"Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign. CISA added CVE-2022-27593 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-610"],"title":"QNAP Photo Station Externally Controlled Reference Vulnerability (CVE-2022-27593)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2022-27593","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2022-26258"],"exploited":"in-the-wild","identifiers":["CVE-2022-26258"],"json":"https://helix.ml/threat-watch/i/d-link-dir-820l-cve-2022-26258.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2022-26258 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"unpatched","product":"DIR-820L","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-820l-cve-2022-26258","stacks":["network"],"startedAt":"2022-09-08","status":"closed","summary":"D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution. CISA added CVE-2022-26258 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"D-Link DIR-820L Remote Code Execution Vulnerability (CVE-2022-26258)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-dir-820l-cve-2022-26258","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2020-9934"],"exploited":"in-the-wild","identifiers":["CVE-2020-9934"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2020-9934.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2020-9934 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2020-9934","stacks":["ios","macos"],"startedAt":"2022-09-08","status":"closed","summary":"Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information. CISA added CVE-2020-9934 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple iOS, iPadOS, and macOS Input Validation Vulnerability (CVE-2020-9934)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2020-9934","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2018-7445"],"exploited":"in-the-wild","identifiers":["CVE-2018-7445"],"json":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2018-7445.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2018-7445 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"patched","product":"RouterOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mikrotik-routeros-cve-2018-7445","stacks":["network"],"startedAt":"2022-09-08","status":"closed","summary":"In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. CISA added CVE-2018-7445 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability (CVE-2018-7445)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2018-7445","vendor":"MikroTik"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2018-6530"],"exploited":"in-the-wild","identifiers":["CVE-2018-6530"],"json":"https://helix.ml/threat-watch/i/d-link-multiple-routers-cve-2018-6530.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2018-6530 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"unpatched","product":"Multiple Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-multiple-routers-cve-2018-6530","stacks":["network"],"startedAt":"2022-09-08","status":"closed","summary":"Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands. CISA added CVE-2018-6530 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"D-Link Multiple Routers OS Command Injection Vulnerability (CVE-2018-6530)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-multiple-routers-cve-2018-6530","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2018-2628"],"exploited":"in-the-wild","identifiers":["CVE-2018-2628"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2018-2628.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2018-2628 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"patched","product":"WebLogic Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2018-2628","stacks":["java"],"startedAt":"2022-09-08","status":"closed","summary":"Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server. CISA added CVE-2018-2628 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-502"],"title":"Oracle WebLogic Server Unspecified Vulnerability (CVE-2018-2628)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2018-2628","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2018-13374"],"exploited":"in-the-wild","identifiers":["CVE-2018-13374"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiadc-cve-2018-13374.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2018-13374 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"patched","product":"FortiOS and FortiADC","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-and-fortiadc-cve-2018-13374","stacks":["network","vpn"],"startedAt":"2022-09-08","status":"closed","summary":"Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server. CISA added CVE-2018-13374 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-732"],"title":"Fortinet FortiOS and FortiADC Improper Access Control Vulnerability (CVE-2018-13374)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiadc-cve-2018-13374","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2017-5521"],"exploited":"in-the-wild","identifiers":["CVE-2017-5521"],"json":"https://helix.ml/threat-watch/i/netgear-multiple-devices-cve-2017-5521.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2017-5521 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"unpatched","product":"Multiple Devices","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-multiple-devices-cve-2017-5521","stacks":["network"],"startedAt":"2022-09-08","status":"closed","summary":"Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server. CISA added CVE-2017-5521 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability (CVE-2017-5521)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/netgear-multiple-devices-cve-2017-5521","vendor":"NETGEAR"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2011-4723"],"exploited":"in-the-wild","identifiers":["CVE-2011-4723"],"json":"https://helix.ml/threat-watch/i/d-link-dir-300-router-cve-2011-4723.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2011-4723 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"unpatched","product":"DIR-300 Router","severity":"medium","severityNote":"CVSS 5.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-300-router-cve-2011-4723","stacks":["network"],"startedAt":"2022-09-08","status":"closed","summary":"The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information. CISA added CVE-2011-4723 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-310"],"title":"D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability (CVE-2011-4723)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-dir-300-router-cve-2011-4723","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-09-22","cveIds":["CVE-2011-1823"],"exploited":"in-the-wild","identifiers":["CVE-2011-1823"],"json":"https://helix.ml/threat-watch/i/android-android-os-cve-2011-1823.json","latestUpdate":{"date":"2022-09-08","title":"CISA added CVE-2011-1823 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 29, 2022)"},"patchStatus":"patched","product":"Android OS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-android-os-cve-2011-1823","stacks":["android"],"startedAt":"2022-09-08","status":"closed","summary":"The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor. CISA added CVE-2011-1823 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-189"],"title":"Android OS Privilege Escalation Vulnerability (CVE-2011-1823)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/android-android-os-cve-2011-1823","vendor":"Android"},{"auto":true,"category":"breach","closedAt":"2022-09-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BRANDNEWTUBE"],"json":"https://helix.ml/threat-watch/i/brandnewtube-data-breach.json","latestUpdate":{"date":"2022-09-08","title":"Have I Been Pwned loaded 349K breached Brand New Tube accounts"},"patchStatus":"no-fix-needed","product":"brandnewtube.com","severity":"high","severityNote":"349K accounts · passwords exposed","slug":"brandnewtube-data-breach","stacks":[],"startedAt":"2022-09-08","status":"closed","summary":"In August 2022, the streaming website Brand New Tube suffered a data breach that exposed the personal information of almost 350k subscribers. The impacted data included email and IP addresses, usernames, genders, passwords stored as unsalted SHA-1 hashes and private messages. Exposed data: email addresses, genders, ip addresses, passwords, private messages, usernames. The breach dates from Aug 14, 2022; Have I Been Pwned loaded it on Sep 8, 2022.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","passwords","private-messages","usernames"],"title":"Brand New Tube data breach: 349K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/brandnewtube-data-breach","vendor":"Brand New Tube"},{"auto":true,"category":"breach","closedAt":"2022-09-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STRIPCHAT"],"json":"https://helix.ml/threat-watch/i/stripchat-data-breach.json","latestUpdate":{"date":"2022-08-31","title":"Have I Been Pwned loaded 10.0M breached Stripchat accounts"},"patchStatus":"no-fix-needed","product":"stripchat.com","severity":"high","severityNote":"10.0M accounts","slug":"stripchat-data-breach","stacks":[],"startedAt":"2022-08-31","status":"closed","summary":"In November 2021, the live sex cams and adult chat website Stripchat left several databases exposed and unsecured. In June the following year, over 10M Stripchat records appeared on a popular hacking forum. The exposed data included usernames, email addresses and IP addresses. Exposed data: email addresses, ip addresses, usernames. The breach dates from Nov 5, 2021; Have I Been Pwned loaded it on Aug 31, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","usernames"],"title":"Stripchat data breach: 10.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/stripchat-data-breach","vendor":"Stripchat"},{"auto":true,"category":"breach","closedAt":"2022-09-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:START"],"json":"https://helix.ml/threat-watch/i/start-data-breach.json","latestUpdate":{"date":"2022-08-30","title":"Have I Been Pwned loaded 7.5M breached START accounts"},"patchStatus":"no-fix-needed","product":"start.film","severity":"high","severityNote":"7.5M accounts · passwords exposed","slug":"start-data-breach","stacks":[],"startedAt":"2022-08-30","status":"closed","summary":"In August 2022, news broke of an attack against the Russian streaming service \"START\". The incident led to the exposure of 44M records containing 7.4M unique email addresses. The impacted data also included the subscriber's country and password hash. START subsequently acknowledged the incident in a Telegram post and stated that the data dated back to 2021. Exposed data: email addresses, geographic locations, names, passwords. The breach dates from Jun 1, 2021; Have I Been Pwned loaded it on Aug 30, 2022.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords"],"title":"START data breach: 7.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/start-data-breach","vendor":"START"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2022-26352"],"exploited":"in-the-wild","identifiers":["CVE-2022-26352"],"json":"https://helix.ml/threat-watch/i/dotcms-dotcms-cve-2022-26352.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2022-26352 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"dotCMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"dotcms-dotcms-cve-2022-26352","stacks":[],"startedAt":"2022-08-25","status":"closed","summary":"dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution. CISA added CVE-2022-26352 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-22","cwe-138"],"title":"dotCMS Unrestricted Upload of File Vulnerability (CVE-2022-26352)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/dotcms-dotcms-cve-2022-26352","vendor":"dotCMS"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2022-24706"],"exploited":"in-the-wild","identifiers":["CVE-2022-24706"],"json":"https://helix.ml/threat-watch/i/apache-couchdb-cve-2022-24706.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2022-24706 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"CouchDB","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-couchdb-cve-2022-24706","stacks":[],"startedAt":"2022-08-25","status":"closed","summary":"Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges. CISA added CVE-2022-24706 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-1188"],"title":"Apache CouchDB Insecure Default Initialization of Resource Vulnerability (CVE-2022-24706)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apache-couchdb-cve-2022-24706","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2022-24112"],"exploited":"in-the-wild","identifiers":["CVE-2022-24112"],"json":"https://helix.ml/threat-watch/i/apache-apisix-cve-2022-24112.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2022-24112 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"APISIX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-apisix-cve-2022-24112","stacks":[],"startedAt":"2022-08-25","status":"closed","summary":"Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. CISA added CVE-2022-24112 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-290"],"title":"Apache APISIX Authentication Bypass Vulnerability (CVE-2022-24112)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apache-apisix-cve-2022-24112","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2022-22963"],"exploited":"in-the-wild","identifiers":["CVE-2022-22963"],"json":"https://helix.ml/threat-watch/i/vmware-tanzu-spring-cloud-cve-2022-22963.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2022-22963 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"Spring Cloud","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-tanzu-spring-cloud-cve-2022-22963","stacks":["cloud","java"],"startedAt":"2022-08-25","status":"closed","summary":"When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. CISA added CVE-2022-22963 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability (CVE-2022-22963)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/vmware-tanzu-spring-cloud-cve-2022-22963","vendor":"VMware Tanzu"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2022-2294"],"exploited":"in-the-wild","identifiers":["CVE-2022-2294"],"json":"https://helix.ml/threat-watch/i/webrtc-webrtc-cve-2022-2294.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2022-2294 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"WebRTC","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"webrtc-webrtc-cve-2022-2294","stacks":[],"startedAt":"2022-08-25","status":"closed","summary":"WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome. CISA added CVE-2022-2294 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-122"],"title":"WebRTC Heap Buffer Overflow Vulnerability (CVE-2022-2294)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/webrtc-webrtc-cve-2022-2294","vendor":"WebRTC"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2021-39226"],"exploited":"in-the-wild","identifiers":["CVE-2021-39226"],"json":"https://helix.ml/threat-watch/i/grafana-labs-grafana-cve-2021-39226.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2021-39226 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"Grafana","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"grafana-labs-grafana-cve-2021-39226","stacks":[],"startedAt":"2022-08-25","status":"closed","summary":"Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss. CISA added CVE-2021-39226 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"Grafana Authentication Bypass Vulnerability (CVE-2021-39226)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/grafana-labs-grafana-cve-2021-39226","vendor":"Grafana Labs"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2021-38406"],"exploited":"in-the-wild","identifiers":["CVE-2021-38406"],"json":"https://helix.ml/threat-watch/i/delta-electronics-dopsoft-2-cve-2021-38406.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2021-38406 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"unpatched","product":"DOPSoft 2","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"delta-electronics-dopsoft-2-cve-2021-38406","stacks":[],"startedAt":"2022-08-25","status":"closed","summary":"Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution. CISA added CVE-2021-38406 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability (CVE-2021-38406)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/delta-electronics-dopsoft-2-cve-2021-38406","vendor":"Delta Electronics"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2021-31010"],"exploited":"in-the-wild","identifiers":["CVE-2021-31010"],"json":"https://helix.ml/threat-watch/i/apple-ios-macos-watchos-cve-2021-31010.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2021-31010 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"iOS, macOS, watchOS","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-macos-watchos-cve-2021-31010","stacks":["macos"],"startedAt":"2022-08-25","status":"closed","summary":"In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions. CISA added CVE-2021-31010 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20","cwe-502"],"title":"Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability (CVE-2021-31010)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-macos-watchos-cve-2021-31010","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2020-36193"],"exploited":"in-the-wild","identifiers":["CVE-2020-36193"],"json":"https://helix.ml/threat-watch/i/pear-archive-tar-cve-2020-36193.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2020-36193 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"Archive_Tar","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"pear-archive-tar-cve-2020-36193","stacks":[],"startedAt":"2022-08-25","status":"closed","summary":"PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux. CISA added CVE-2020-36193 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22","cwe-59"],"title":"PEAR Archive_Tar Improper Link Resolution Vulnerability (CVE-2020-36193)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/pear-archive-tar-cve-2020-36193","vendor":"PEAR"},{"auto":true,"category":"patch","closedAt":"2022-09-08","cveIds":["CVE-2020-28949"],"exploited":"in-the-wild","identifiers":["CVE-2020-28949"],"json":"https://helix.ml/threat-watch/i/pear-archive-tar-cve-2020-28949.json","latestUpdate":{"date":"2022-08-25","title":"CISA added CVE-2020-28949 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 15, 2022)"},"patchStatus":"patched","product":"Archive_Tar","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"pear-archive-tar-cve-2020-28949","stacks":["rust"],"startedAt":"2022-08-25","status":"closed","summary":"PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux. CISA added CVE-2020-28949 to its Known Exploited Vulnerabilities catalog on Aug 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-74"],"title":"PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability (CVE-2020-28949)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/pear-archive-tar-cve-2020-28949","vendor":"PEAR"},{"auto":true,"category":"patch","closedAt":"2022-09-05","cveIds":["CVE-2022-0028"],"exploited":"in-the-wild","identifiers":["CVE-2022-0028"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2022-0028.json","latestUpdate":{"date":"2022-08-22","title":"CISA added CVE-2022-0028 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 12, 2022)"},"patchStatus":"patched","product":"PAN-OS","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2022-0028","stacks":["network"],"startedAt":"2022-08-22","status":"closed","summary":"A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. CISA added CVE-2022-0028 to its Known Exploited Vulnerabilities catalog on Aug 22, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-940"],"title":"Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability (CVE-2022-0028)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2022-0028","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2022-09-01","cveIds":["CVE-2022-22536"],"exploited":"in-the-wild","identifiers":["CVE-2022-22536"],"json":"https://helix.ml/threat-watch/i/sap-multiple-products-cve-2022-22536.json","latestUpdate":{"date":"2022-08-18","title":"CISA added CVE-2022-22536 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-multiple-products-cve-2022-22536","stacks":[],"startedAt":"2022-08-18","status":"closed","summary":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches. CISA added CVE-2022-22536 to its Known Exploited Vulnerabilities catalog on Aug 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-444"],"title":"SAP Multiple Products HTTP Request Smuggling Vulnerability (CVE-2022-22536)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sap-multiple-products-cve-2022-22536","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2022-09-01","cveIds":["CVE-2022-32894"],"exploited":"in-the-wild","identifiers":["CVE-2022-32894"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2022-32894.json","latestUpdate":{"date":"2022-08-18","title":"CISA added CVE-2022-32894 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2022)"},"patchStatus":"patched","product":"iOS and macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-macos-cve-2022-32894","stacks":["ios","macos"],"startedAt":"2022-08-18","status":"closed","summary":"Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges. CISA added CVE-2022-32894 to its Known Exploited Vulnerabilities catalog on Aug 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-20","cwe-787"],"title":"Apple iOS and macOS Out-of-Bounds Write Vulnerability (CVE-2022-32894)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2022-32894","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-09-01","cveIds":["CVE-2022-32893"],"exploited":"in-the-wild","identifiers":["CVE-2022-32893"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2022-32893.json","latestUpdate":{"date":"2022-08-18","title":"CISA added CVE-2022-32893 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2022)"},"patchStatus":"patched","product":"iOS and macOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-macos-cve-2022-32893","stacks":["ios","macos"],"startedAt":"2022-08-18","status":"closed","summary":"Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content. CISA added CVE-2022-32893 to its Known Exploited Vulnerabilities catalog on Aug 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-20","cwe-787"],"title":"Apple iOS and macOS Out-of-Bounds Write Vulnerability (CVE-2022-32893)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2022-32893","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-09-01","cveIds":["CVE-2022-2856"],"exploited":"in-the-wild","identifiers":["CVE-2022-2856"],"json":"https://helix.ml/threat-watch/i/google-chromium-intents-cve-2022-2856.json","latestUpdate":{"date":"2022-08-18","title":"CISA added CVE-2022-2856 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2022)"},"patchStatus":"patched","product":"Chromium Intents","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-intents-cve-2022-2856","stacks":["browser"],"startedAt":"2022-08-18","status":"closed","summary":"Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-2856 to its Known Exploited Vulnerabilities catalog on Aug 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Google Chromium Intents Insufficient Input Validation Vulnerability (CVE-2022-2856)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-intents-cve-2022-2856","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-09-01","cveIds":["CVE-2022-26923"],"exploited":"in-the-wild","identifiers":["CVE-2022-26923"],"json":"https://helix.ml/threat-watch/i/microsoft-active-directory-cve-2022-26923.json","latestUpdate":{"date":"2022-08-18","title":"CISA added CVE-2022-26923 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2022)"},"patchStatus":"patched","product":"Active Directory","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-active-directory-cve-2022-26923","stacks":[],"startedAt":"2022-08-18","status":"closed","summary":"An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM. CISA added CVE-2022-26923 to its Known Exploited Vulnerabilities catalog on Aug 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-295"],"title":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2022-26923)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-active-directory-cve-2022-26923","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-09-01","cveIds":["CVE-2022-21971"],"exploited":"in-the-wild","identifiers":["CVE-2022-21971"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-21971.json","latestUpdate":{"date":"2022-08-18","title":"CISA added CVE-2022-21971 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-21971","stacks":["windows"],"startedAt":"2022-08-18","status":"closed","summary":"Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2022-21971 to its Known Exploited Vulnerabilities catalog on Aug 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-824"],"title":"Microsoft Windows Runtime Remote Code Execution Vulnerability (CVE-2022-21971)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-21971","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-09-01","cveIds":["CVE-2017-15944"],"exploited":"in-the-wild","identifiers":["CVE-2017-15944"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2017-15944.json","latestUpdate":{"date":"2022-08-18","title":"CISA added CVE-2017-15944 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 8, 2022)"},"patchStatus":"patched","product":"PAN-OS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2017-15944","stacks":["network"],"startedAt":"2022-08-18","status":"closed","summary":"Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. CISA added CVE-2017-15944 to its Known Exploited Vulnerabilities catalog on Aug 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability (CVE-2017-15944)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2017-15944","vendor":"Palo Alto Networks"},{"auto":true,"category":"breach","closedAt":"2022-09-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BANORTE"],"json":"https://helix.ml/threat-watch/i/banorte-data-breach.json","latestUpdate":{"date":"2022-08-18","title":"Have I Been Pwned loaded 2.1M breached Banorte accounts"},"patchStatus":"no-fix-needed","product":"banorte.com","severity":"medium","severityNote":"2.1M accounts","slug":"banorte-data-breach","stacks":[],"startedAt":"2022-08-18","status":"closed","summary":"In August 2022, millions of records from Mexican bank \"Banorte\" were publicly dumped on a popular hacking forum including 2.1M unique email addresses, physical addresses, names, phone numbers, RFC (tax) numbers, genders and bank balances. Banorte have stated that the data is \"outdated\", although have not yet indicated how far back it dates to. Anecdotal feedback from HIBP subscribers suggests the data may date back 8 years to 2014. Exposed data: account balances, email addresses, genders, government issued ids, names, phone numbers, physical addresses. The breach dates from Aug 18, 2014; Have I Been Pwned loaded it on Aug 18, 2022.","tags":["data-breach","hibp","account-balances","email-addresses","genders","government-issued-ids","names","phone-numbers","physical-addresses"],"title":"Banorte data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/banorte-data-breach","vendor":"Banorte"},{"auto":true,"category":"breach","closedAt":"2022-08-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SITEPOINT"],"json":"https://helix.ml/threat-watch/i/sitepoint-data-breach.json","latestUpdate":{"date":"2022-08-17","title":"Have I Been Pwned loaded 1.0M breached SitePoint accounts"},"patchStatus":"no-fix-needed","product":"sitepoint.com","severity":"high","severityNote":"1.0M accounts · passwords exposed","slug":"sitepoint-data-breach","stacks":[],"startedAt":"2022-08-17","status":"closed","summary":"In June 2020, the web development site SitePoint suffered a data breach that exposed over 1M customer records. Impacted data included email and IP addresses, names, usernames, bios and passwords stored as bcrypt hashes. Exposed data: bios, email addresses, ip addresses, names, passwords, usernames. The breach dates from Jun 20, 2020; Have I Been Pwned loaded it on Aug 17, 2022.","tags":["data-breach","hibp","bios","email-addresses","ip-addresses","names","passwords","usernames"],"title":"SitePoint data breach: 1.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sitepoint-data-breach","vendor":"SitePoint"},{"auto":true,"category":"breach","closedAt":"2022-08-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHITEXPRESS"],"json":"https://helix.ml/threat-watch/i/shitexpress-data-breach.json","latestUpdate":{"date":"2022-08-16","title":"Have I Been Pwned loaded 23K breached Shitexpress accounts"},"patchStatus":"no-fix-needed","product":"shitexpress.com","severity":"high","severityNote":"23K accounts","slug":"shitexpress-data-breach","stacks":[],"startedAt":"2022-08-16","status":"closed","summary":"In August 2022, the online faeces delivery service Shitexpress suffered a data breach that exposed 24k unique email addresses. The addresses spanned invoices, gift cards, promotions and PayPal records. The breach also exposed the IP and email addresses of senders, physical addresses of recipients and messages accompanying the shit delivery. Exposed data: email addresses, ip addresses, names, physical addresses, private messages, purchases. The breach dates from Aug 8, 2022; Have I Been Pwned loaded it on Aug 16, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","physical-addresses","private-messages","purchases"],"title":"Shitexpress data breach: 23K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/shitexpress-data-breach","vendor":"Shitexpress"},{"auto":true,"category":"breach","closedAt":"2022-08-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TWITTER"],"json":"https://helix.ml/threat-watch/i/twitter-data-breach.json","latestUpdate":{"date":"2022-08-13","title":"Have I Been Pwned loaded 6.7M breached Twitter accounts"},"patchStatus":"no-fix-needed","product":"twitter.com","severity":"medium","severityNote":"6.7M accounts","slug":"twitter-data-breach","stacks":[],"startedAt":"2022-08-13","status":"closed","summary":"In January 2022, a vulnerability in Twitter's platform allowed an attacker to build a database of the email addresses and phone numbers of millions of users of the social platform. In a disclosure notice later shared in August 2022, Twitter advised that the vulnerability was related to a bug introduced in June 2021 and that they are directly notifying impacted customers. The impacted data included either email address or phone number alongside other public information including the username, display name, bio, location and profile photo. The data included 6.7M unique email addresses across both active and suspended accounts, the latter appearing in a separate list of 1.4M addresses. Exposed data: bios, email addresses, geographic locations, names, phone numbers, profile photos, usernames. The breach dates from Jan 1, 2022; Have I Been Pwned loaded it on Aug 13, 2022.","tags":["data-breach","hibp","bios","email-addresses","geographic-locations","names","phone-numbers","profile-photos","usernames"],"title":"Twitter data breach: 6.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/twitter-data-breach","vendor":"Twitter"},{"auto":true,"category":"patch","closedAt":"2022-08-25","cveIds":["CVE-2022-27925"],"exploited":"in-the-wild","identifiers":["CVE-2022-27925"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27925.json","latestUpdate":{"date":"2022-08-11","title":"CISA added CVE-2022-27925 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 1, 2022)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2022-27925","stacks":[],"startedAt":"2022-08-11","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution. CISA added CVE-2022-27925 to its Known Exploited Vulnerabilities catalog on Aug 11, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-22"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability (CVE-2022-27925)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27925","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2022-08-25","cveIds":["CVE-2022-37042"],"exploited":"in-the-wild","identifiers":["CVE-2022-37042"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-37042.json","latestUpdate":{"date":"2022-08-11","title":"CISA added CVE-2022-37042 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 1, 2022)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2022-37042","stacks":[],"startedAt":"2022-08-11","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution. CISA added CVE-2022-37042 to its Known Exploited Vulnerabilities catalog on Aug 11, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","auth-bypass","cwe-23"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability (CVE-2022-37042)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-37042","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2022-08-23","cveIds":["CVE-2022-34713"],"exploited":"in-the-wild","identifiers":["CVE-2022-34713"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-34713.json","latestUpdate":{"date":"2022-08-09","title":"CISA added CVE-2022-34713 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 30, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-34713","stacks":["windows"],"startedAt":"2022-08-09","status":"closed","summary":"A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application. CISA added CVE-2022-34713 to its Known Exploited Vulnerabilities catalog on Aug 9, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-34713)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-34713","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-08-23","cveIds":["CVE-2022-30333"],"exploited":"in-the-wild","identifiers":["CVE-2022-30333"],"json":"https://helix.ml/threat-watch/i/rarlab-unrar-cve-2022-30333.json","latestUpdate":{"date":"2022-08-09","title":"CISA added CVE-2022-30333 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 30, 2022)"},"patchStatus":"patched","product":"UnRAR","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"rarlab-unrar-cve-2022-30333","stacks":[],"startedAt":"2022-08-09","status":"closed","summary":"RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation. CISA added CVE-2022-30333 to its Known Exploited Vulnerabilities catalog on Aug 9, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22","cwe-59"],"title":"RARLAB UnRAR Directory Traversal Vulnerability (CVE-2022-30333)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/rarlab-unrar-cve-2022-30333","vendor":"RARLAB"},{"auto":true,"category":"breach","closedAt":"2022-08-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QUESTIONPRO"],"json":"https://helix.ml/threat-watch/i/questionpro-data-breach.json","latestUpdate":{"date":"2022-08-05","title":"Have I Been Pwned loaded 22.2M breached QuestionPro accounts"},"patchStatus":"no-fix-needed","product":"questionpro.com","severity":"medium","severityNote":"22.2M accounts","slug":"questionpro-data-breach","stacks":[],"startedAt":"2022-08-05","status":"closed","summary":"In May 2022, the survey website QuestionPro was the target of an extortion attempt relating to an alleged data breach. Over 100GB of data containing 22M unique email addresses (some of which appear to be generated by the platform), are alleged to have been extracted from the service along with IP addresses, browser user agents and results relating to surveys. QuestionPro would not confirm whether a breach had occurred (although they did confirm they were the target of an extortion attempt), so the data was initially flagged as \"unverified\". Subsequent verification by impacted HIBP subscribers later led to the removal of the unverified flag. Exposed data: browser user agent details, email addresses, ip addresses, survey results. The breach dates from May 21, 2022; Have I Been Pwned loaded it on Aug 5, 2022.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","survey-results"],"title":"QuestionPro data breach: 22.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/questionpro-data-breach","vendor":"QuestionPro"},{"auto":true,"category":"patch","closedAt":"2022-08-18","cveIds":["CVE-2022-27924"],"exploited":"in-the-wild","identifiers":["CVE-2022-27924"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27924.json","latestUpdate":{"date":"2022-08-04","title":"CISA added CVE-2022-27924 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 25, 2022)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2022-27924","stacks":[],"startedAt":"2022-08-04","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries. CISA added CVE-2022-27924 to its Known Exploited Vulnerabilities catalog on Aug 4, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-93"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability (CVE-2022-27924)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2022-27924","vendor":"Synacor"},{"auto":true,"category":"breach","closedAt":"2022-08-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TUNEDGLOBAL"],"json":"https://helix.ml/threat-watch/i/tunedglobal-data-breach.json","latestUpdate":{"date":"2022-08-03","title":"Have I Been Pwned loaded 985K breached Tuned Global accounts"},"patchStatus":"no-fix-needed","product":"tunedglobal.com","severity":"high","severityNote":"985K accounts · passwords exposed","slug":"tunedglobal-data-breach","stacks":[],"startedAt":"2022-08-03","status":"closed","summary":"In January 2021, data from a number of breached services including Tuned Global were released to a public hacking forum. The breach appears to date back to 2016 and includes 985k records containing email addresses, names, a small number of physical addresses and phone numbers and passwords stored in plain text. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Mar 16, 2016; Have I Been Pwned loaded it on Aug 3, 2022.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Tuned Global data breach: 985K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tunedglobal-data-breach","vendor":"Tuned Global"},{"auto":true,"category":"breach","closedAt":"2022-08-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MECHODOWNLOAD"],"json":"https://helix.ml/threat-watch/i/mechodownload-data-breach.json","latestUpdate":{"date":"2022-08-02","title":"Have I Been Pwned loaded 437K breached Mecho Download accounts"},"patchStatus":"no-fix-needed","product":"mechodownload.com","severity":"high","severityNote":"437K accounts · passwords exposed","slug":"mechodownload-data-breach","stacks":[],"startedAt":"2022-08-02","status":"closed","summary":"In October 2013, the (now defunct) downloads website \"Mecho Download\" suffered a data breach that exposed 438k records. Data from the vBulletin based website included email and IP addresses, usernames and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 31, 2013; Have I Been Pwned loaded it on Aug 2, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Mecho Download data breach: 437K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mechodownload-data-breach","vendor":"Mecho Download"},{"auto":true,"category":"patch","closedAt":"2022-08-12","cveIds":["CVE-2022-26138"],"exploited":"in-the-wild","identifiers":["CVE-2022-26138"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-cve-2022-26138.json","latestUpdate":{"date":"2022-07-29","title":"CISA added CVE-2022-26138 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 19, 2022)"},"patchStatus":"patched","product":"Confluence","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-cve-2022-26138","stacks":["devtools","java"],"startedAt":"2022-07-29","status":"closed","summary":"Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group. CISA added CVE-2022-26138 to its Known Exploited Vulnerabilities catalog on Jul 29, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","hard-coded-credentials","cwe-798"],"title":"Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability (CVE-2022-26138)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-cve-2022-26138","vendor":"Atlassian"},{"auto":true,"category":"breach","closedAt":"2022-08-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BATTLEFY"],"json":"https://helix.ml/threat-watch/i/battlefy-data-breach.json","latestUpdate":{"date":"2022-07-29","title":"Have I Been Pwned loaded 83K breached Battlefy accounts"},"patchStatus":"no-fix-needed","product":"battlefy.com","severity":"high","severityNote":"83K accounts · passwords exposed","slug":"battlefy-data-breach","stacks":[],"startedAt":"2022-07-29","status":"closed","summary":"In January 2016, the esports website Battlefy suffered a data breach that exposed 83k customer records. The impacted data included email addresses, usernames and passwords stored as bcrypt hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 11, 2016; Have I Been Pwned loaded it on Jul 29, 2022.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Battlefy data breach: 83K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/battlefy-data-breach","vendor":"Battlefy"},{"auto":true,"category":"breach","closedAt":"2022-08-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHADI"],"json":"https://helix.ml/threat-watch/i/shadi-data-breach.json","latestUpdate":{"date":"2022-07-20","title":"Have I Been Pwned loaded 2.0M breached Shadi.com accounts"},"patchStatus":"no-fix-needed","product":"shadi.com","severity":"high","severityNote":"2.0M accounts · passwords exposed","slug":"shadi-data-breach","stacks":[],"startedAt":"2022-07-20","status":"closed","summary":"In July 2016, the Muslim dating site Shadi.com suffered a data breach that exposed over 2M members' email addresses. The breach also exposed passwords stored as MD5 hashes alongside their plain text equivalents. Exposed data: email addresses, passwords. The breach dates from Jul 9, 2016; Have I Been Pwned loaded it on Jul 20, 2022.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Shadi.com data breach: 2.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/shadi-data-breach","vendor":"Shadi.com"},{"auto":true,"category":"breach","closedAt":"2022-08-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PPCGEEKS"],"json":"https://helix.ml/threat-watch/i/ppcgeeks-data-breach.json","latestUpdate":{"date":"2022-07-18","title":"Have I Been Pwned loaded 492K breached PPCGeeks accounts"},"patchStatus":"no-fix-needed","product":"ppcgeeks.com","severity":"high","severityNote":"492K accounts · passwords exposed","slug":"ppcgeeks-data-breach","stacks":[],"startedAt":"2022-07-18","status":"closed","summary":"In August 2016, the pocket PC fan site forum PPCGeeks suffered a data breach that exposed over 490k records. The breach of the vBulletin forum exposed email and IP addresses, usernames, dates of birth and passwords stored as salted MD5 hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Aug 19, 2016; Have I Been Pwned loaded it on Jul 18, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"PPCGeeks data breach: 492K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ppcgeeks-data-breach","vendor":"PPCGeeks"},{"auto":true,"category":"breach","closedAt":"2022-07-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JUKINMEDIA"],"json":"https://helix.ml/threat-watch/i/jukinmedia-data-breach.json","latestUpdate":{"date":"2022-07-17","title":"Have I Been Pwned loaded 314K breached JukinMedia accounts"},"patchStatus":"no-fix-needed","product":"jukinmedia.com","severity":"high","severityNote":"314K accounts · passwords exposed","slug":"jukinmedia-data-breach","stacks":[],"startedAt":"2022-07-17","status":"closed","summary":"In October 2021, the \"global leader in user-generated entertainment\" Jukin Media suffered a data breach. The breach exposed 13GB of code, configuration and data consisting of 314k unique email addresses along with names, phone numbers, IP addresses and bcrypt password hashes. Exposed data: email addresses, employers, ip addresses, names, occupations, passwords, phone numbers. The breach dates from Oct 28, 2021; Have I Been Pwned loaded it on Jul 17, 2022.","tags":["data-breach","hibp","email-addresses","employers","ip-addresses","names","occupations","passwords","phone-numbers"],"title":"JukinMedia data breach: 314K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/jukinmedia-data-breach","vendor":"JukinMedia"},{"auto":true,"category":"breach","closedAt":"2022-07-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ESKIMI"],"json":"https://helix.ml/threat-watch/i/eskimi-data-breach.json","latestUpdate":{"date":"2022-07-16","title":"Have I Been Pwned loaded 1.2M breached Eskimi accounts"},"patchStatus":"no-fix-needed","product":"eskimi.com","severity":"high","severityNote":"1.2M accounts · passwords exposed","slug":"eskimi-data-breach","stacks":[],"startedAt":"2022-07-16","status":"closed","summary":"In late 2020, the AdTech platform Eskimi suffered a data breach that exposed 26M records with 1.2M unique email addresses. The data included usernames, dates of birth, genders and passwords stored as unsalted MD5 hashes. Exposed data: dates of birth, email addresses, genders, geographic locations, passwords, usernames. The breach dates from Sep 25, 2020; Have I Been Pwned loaded it on Jul 16, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","passwords","usernames"],"title":"Eskimi data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/eskimi-data-breach","vendor":"Eskimi"},{"auto":true,"category":"breach","closedAt":"2022-07-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FAMM"],"json":"https://helix.ml/threat-watch/i/famm-data-breach.json","latestUpdate":{"date":"2022-07-16","title":"Have I Been Pwned loaded 535K breached Famm accounts"},"patchStatus":"no-fix-needed","product":"famm.us","severity":"high","severityNote":"535K accounts · passwords exposed","slug":"famm-data-breach","stacks":[],"startedAt":"2022-07-16","status":"closed","summary":"In late 2020, the Japanese family photos website Famm suffered a data breach that subsequently exposed 1.3M customer records, including 535k unique email addresses. Impacted data also included names, dates of birth, genders and passwords stored as SHA-256 hashes. Exposed data: dates of birth, email addresses, genders, names, passwords. The breach dates from Oct 8, 2020; Have I Been Pwned loaded it on Jul 16, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords"],"title":"Famm data breach: 535K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/famm-data-breach","vendor":"Famm"},{"auto":true,"category":"breach","closedAt":"2022-07-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LAPOSTEMOBILE"],"json":"https://helix.ml/threat-watch/i/lapostemobile-data-breach.json","latestUpdate":{"date":"2022-07-14","title":"Have I Been Pwned loaded 533K breached La Poste Mobile accounts"},"patchStatus":"no-fix-needed","product":"lapostemobile.fr","severity":"high","severityNote":"533K accounts · financial data exposed","slug":"lapostemobile-data-breach","stacks":[],"startedAt":"2022-07-14","status":"closed","summary":"In July 2022, the French telecommunications company La Poste Mobile was the target of an attack by the LockBit ransomware which resulted in company data being published publicly. The impacted data included 533k unique email addresses along with names, physical addresses, phone numbers, dates of births, genders and banking information. 10 days after the attack, the La Poste Mobile website remained offline. Exposed data: bank account numbers, dates of birth, email addresses, genders, names, phone numbers, physical addresses. The breach dates from Jul 4, 2022; Have I Been Pwned loaded it on Jul 14, 2022.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"La Poste Mobile data breach: 533K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lapostemobile-data-breach","vendor":"La Poste Mobile"},{"auto":true,"category":"patch","closedAt":"2022-07-26","cveIds":["CVE-2022-22047"],"exploited":"in-the-wild","identifiers":["CVE-2022-22047"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-22047.json","latestUpdate":{"date":"2022-07-12","title":"CISA added CVE-2022-22047 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 2, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-22047","stacks":["windows"],"startedAt":"2022-07-12","status":"closed","summary":"Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges. CISA added CVE-2022-22047 to its Known Exploited Vulnerabilities catalog on Jul 12, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-426"],"title":"Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability (CVE-2022-22047)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-22047","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2022-07-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MANGATOON"],"json":"https://helix.ml/threat-watch/i/mangatoon-data-breach.json","latestUpdate":{"date":"2022-07-06","title":"Have I Been Pwned loaded 23.0M breached Mangatoon accounts"},"patchStatus":"no-fix-needed","product":"mangatoon.mobi","severity":"high","severityNote":"23.0M accounts · passwords exposed","slug":"mangatoon-data-breach","stacks":[],"startedAt":"2022-07-06","status":"closed","summary":"In May 2022, the Hong Kong based Manga service Mangatoon suffered a data breach that exposed 23M subscriber records. The breach exposed names, email addresses, genders, social media account identities, auth tokens from social logins and passwords stored as salted MD5 hashes. Mangatoon did not respond to multiple attempts to make contact regarding the breach. Exposed data: auth tokens, avatars, email addresses, genders, names, passwords, social media profiles, usernames. The breach dates from May 13, 2022; Have I Been Pwned loaded it on Jul 6, 2022.","tags":["data-breach","hibp","auth-tokens","avatars","email-addresses","genders","names","passwords","social-media-profiles","usernames"],"title":"Mangatoon data breach: 23.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mangatoon-data-breach","vendor":"Mangatoon"},{"auto":true,"category":"breach","closedAt":"2022-07-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CAPIALECONOMICS"],"json":"https://helix.ml/threat-watch/i/capialeconomics-data-breach.json","latestUpdate":{"date":"2022-07-04","title":"Have I Been Pwned loaded 263K breached Capital Economics accounts"},"patchStatus":"no-fix-needed","product":"capitaleconomics.com","severity":"medium","severityNote":"263K accounts","slug":"capialeconomics-data-breach","stacks":[],"startedAt":"2022-07-04","status":"closed","summary":"In December 2020, the economic research company Capital Economics suffered a data breach that exposed 263k customer records. The exposed data included email and physical addresses, names, phone numbers, job titles and the employer of impacted customers. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses. The breach dates from Dec 12, 2020; Have I Been Pwned loaded it on Jul 4, 2022.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses"],"title":"Capital Economics data breach: 263K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/capialeconomics-data-breach","vendor":"Capital Economics"},{"auto":true,"category":"breach","closedAt":"2022-07-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOURSEDESVOLS"],"json":"https://helix.ml/threat-watch/i/boursedesvols-data-breach.json","latestUpdate":{"date":"2022-07-03","title":"Have I Been Pwned loaded 1.5M breached Bourse des Vols accounts"},"patchStatus":"no-fix-needed","product":"bourse-des-vols.com","severity":"medium","severityNote":"1.5M accounts","slug":"boursedesvols-data-breach","stacks":[],"startedAt":"2022-07-03","status":"closed","summary":"In January 2021, the French travel company Bourse des Vols suffered a data breach that exposed 1.46M unique email addresses across more than 1.2k.sql files and over 9GB of data. The impacted data exposed personal information and travel histories including names, phone numbers, IP and physical addresses, dates of birth along with flights taken and purchases. Exposed data: dates of birth, email addresses, flights taken, ip addresses, names, phone numbers, physical addresses, purchases. The breach dates from Jan 12, 2021; Have I Been Pwned loaded it on Jul 3, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","flights-taken","ip-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"Bourse des Vols data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/boursedesvols-data-breach","vendor":"Bourse des Vols"},{"auto":true,"category":"breach","closedAt":"2022-07-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOOKCHOR"],"json":"https://helix.ml/threat-watch/i/bookchor-data-breach.json","latestUpdate":{"date":"2022-07-03","title":"Have I Been Pwned loaded 498K breached Bookchor accounts"},"patchStatus":"no-fix-needed","product":"bookchor.com","severity":"high","severityNote":"498K accounts · passwords exposed","slug":"bookchor-data-breach","stacks":[],"startedAt":"2022-07-03","status":"closed","summary":"In January 2021, the Indian book trading website Bookchor suffered a data breach that exposed half a million customer records. The exposed data included email and IP addresses, names, genders, dates of birth, phone numbers and passwords stored as unsalted MD5 hashes. The data was subsequently traded on a popular hacking forum. Exposed data: dates of birth, email addresses, genders, ip addresses, names, passwords, phone numbers, social media profiles. The breach dates from Jan 28, 2021; Have I Been Pwned loaded it on Jul 3, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","names","passwords","phone-numbers","social-media-profiles"],"title":"Bookchor data breach: 498K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bookchor-data-breach","vendor":"Bookchor"},{"auto":true,"category":"patch","closedAt":"2022-07-15","cveIds":["CVE-2022-26925"],"exploited":"in-the-wild","identifiers":["CVE-2022-26925"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-26925.json","latestUpdate":{"date":"2022-07-01","title":"CISA added CVE-2022-26925 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 22, 2022)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-26925","stacks":["windows"],"startedAt":"2022-07-01","status":"closed","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM. CISA added CVE-2022-26925 to its Known Exploited Vulnerabilities catalog on Jul 1, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-306"],"title":"Microsoft Windows LSA Spoofing Vulnerability (CVE-2022-26925)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-26925","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2022-29499"],"exploited":"in-the-wild","identifiers":["CVE-2022-29499"],"json":"https://helix.ml/threat-watch/i/mitel-mivoice-connect-cve-2022-29499.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2022-29499 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"MiVoice Connect","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mitel-mivoice-connect-cve-2022-29499","stacks":[],"startedAt":"2022-06-27","status":"closed","summary":"The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation. CISA added CVE-2022-29499 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Mitel MiVoice Connect Data Validation Vulnerability (CVE-2022-29499)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mitel-mivoice-connect-cve-2022-29499","vendor":"Mitel"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2021-30533"],"exploited":"in-the-wild","identifiers":["CVE-2021-30533"],"json":"https://helix.ml/threat-watch/i/google-chromium-popupblocker-cve-2021-30533.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2021-30533 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Chromium PopupBlocker","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-popupblocker-cve-2021-30533","stacks":["browser"],"startedAt":"2022-06-27","status":"closed","summary":"Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-30533 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-863"],"title":"Google Chromium PopupBlocker Security Bypass Vulnerability (CVE-2021-30533)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-popupblocker-cve-2021-30533","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2021-4034"],"exploited":"in-the-wild","identifiers":["CVE-2021-4034"],"json":"https://helix.ml/threat-watch/i/red-hat-polkit-cve-2021-4034.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2021-4034 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Polkit","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-polkit-cve-2021-4034","stacks":["linux"],"startedAt":"2022-06-27","status":"closed","summary":"The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights. CISA added CVE-2021-4034 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","memory-corruption","cwe-787"],"title":"Red Hat Polkit Out-of-Bounds Read and Write Vulnerability (CVE-2021-4034)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/red-hat-polkit-cve-2021-4034","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2021-30983"],"exploited":"in-the-wild","identifiers":["CVE-2021-30983"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2021-30983.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2021-30983 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"iOS and iPadOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-ipados-cve-2021-30983","stacks":["ios"],"startedAt":"2022-06-27","status":"closed","summary":"Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges. CISA added CVE-2021-30983 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Apple iOS and iPadOS Buffer Overflow Vulnerability (CVE-2021-30983)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-ipados-cve-2021-30983","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2020-3837"],"exploited":"in-the-wild","identifiers":["CVE-2020-3837"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-3837.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2020-3837 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2020-3837","stacks":[],"startedAt":"2022-06-27","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. CISA added CVE-2020-3837 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2020-3837)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-3837","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2020-9907"],"exploited":"in-the-wild","identifiers":["CVE-2020-9907"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-9907.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2020-9907 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2020-9907","stacks":[],"startedAt":"2022-06-27","status":"closed","summary":"Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. CISA added CVE-2020-9907 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2020-9907)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-9907","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2019-8605"],"exploited":"in-the-wild","identifiers":["CVE-2019-8605"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2019-8605.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2019-8605 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2019-8605","stacks":[],"startedAt":"2022-06-27","status":"closed","summary":"A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges. CISA added CVE-2019-8605 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple Multiple Products Use-After-Free Vulnerability (CVE-2019-8605)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2019-8605","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-07-11","cveIds":["CVE-2018-4344"],"exploited":"in-the-wild","identifiers":["CVE-2018-4344"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2018-4344.json","latestUpdate":{"date":"2022-06-27","title":"CISA added CVE-2018-4344 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2018-4344","stacks":[],"startedAt":"2022-06-27","status":"closed","summary":"Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution. CISA added CVE-2018-4344 to its Known Exploited Vulnerabilities catalog on Jun 27, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2018-4344)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2018-4344","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-06-28","cveIds":["CVE-2022-30190"],"exploited":"in-the-wild","identifiers":["CVE-2022-30190"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-30190.json","latestUpdate":{"date":"2022-06-14","title":"CISA added CVE-2022-30190 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-30190","stacks":["windows"],"startedAt":"2022-06-14","status":"closed","summary":"A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application. CISA added CVE-2022-30190 to its Known Exploited Vulnerabilities catalog on Jun 14, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-610"],"title":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-30190)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-30190","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2022-06-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DIVXSUBTITLES"],"json":"https://helix.ml/threat-watch/i/divxsubtitles-data-breach.json","latestUpdate":{"date":"2022-06-14","title":"Have I Been Pwned loaded 783K breached DivX SubTitles accounts"},"patchStatus":"no-fix-needed","product":"divxsubtitles.net","severity":"high","severityNote":"783K accounts · passwords exposed","slug":"divxsubtitles-data-breach","stacks":[],"startedAt":"2022-06-14","status":"closed","summary":"In approximately 2010, the now defunct website DivX SubTitles suffered a data breach that exposed 783k user accounts including email addresses, usernames and plain text passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 1, 2010; Have I Been Pwned loaded it on Jun 14, 2022.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"DivX SubTitles data breach: 783K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/divxsubtitles-data-breach","vendor":"DivX SubTitles"},{"auto":true,"category":"patch","closedAt":"2022-06-23","cveIds":["CVE-2021-38163"],"exploited":"in-the-wild","identifiers":["CVE-2021-38163"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2021-38163.json","latestUpdate":{"date":"2022-06-09","title":"CISA added CVE-2021-38163 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 30, 2022)"},"patchStatus":"patched","product":"NetWeaver","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2021-38163","stacks":[],"startedAt":"2022-06-09","status":"closed","summary":"SAP NetWeaver contains a vulnerability that allows unrestricted file upload. CISA added CVE-2021-38163 to its Known Exploited Vulnerabilities catalog on Jun 9, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-23"],"title":"SAP NetWeaver Unrestricted File Upload Vulnerability (CVE-2021-38163)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2021-38163","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2022-06-23","cveIds":["CVE-2016-2386"],"exploited":"in-the-wild","identifiers":["CVE-2016-2386"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-2386.json","latestUpdate":{"date":"2022-06-09","title":"CISA added CVE-2016-2386 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 30, 2022)"},"patchStatus":"patched","product":"NetWeaver","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2016-2386","stacks":[],"startedAt":"2022-06-09","status":"closed","summary":"SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. CISA added CVE-2016-2386 to its Known Exploited Vulnerabilities catalog on Jun 9, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"SAP NetWeaver SQL Injection Vulnerability (CVE-2016-2386)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-2386","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2022-06-23","cveIds":["CVE-2016-2388"],"exploited":"in-the-wild","identifiers":["CVE-2016-2388"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-2388.json","latestUpdate":{"date":"2022-06-09","title":"CISA added CVE-2016-2388 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 30, 2022)"},"patchStatus":"patched","product":"NetWeaver","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2016-2388","stacks":[],"startedAt":"2022-06-09","status":"closed","summary":"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. CISA added CVE-2016-2388 to its Known Exploited Vulnerabilities catalog on Jun 9, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"SAP NetWeaver Information Disclosure Vulnerability (CVE-2016-2388)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-2388","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2019-7195"],"exploited":"in-the-wild","identifiers":["CVE-2019-7195"],"json":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2019-7195.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2019-7195 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Photo Station","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-photo-station-cve-2019-7195","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. CISA added CVE-2019-7195 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"QNAP Photo Station Path Traversal Vulnerability (CVE-2019-7195)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2019-7195","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2019-7194"],"exploited":"in-the-wild","identifiers":["CVE-2019-7194"],"json":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2019-7194.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2019-7194 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Photo Station","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-photo-station-cve-2019-7194","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. CISA added CVE-2019-7194 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"QNAP Photo Station Path Traversal Vulnerability (CVE-2019-7194)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2019-7194","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2019-7193"],"exploited":"in-the-wild","identifiers":["CVE-2019-7193"],"json":"https://helix.ml/threat-watch/i/qnap-qts-cve-2019-7193.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2019-7193 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"QTS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-qts-cve-2019-7193","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system. CISA added CVE-2019-7193 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-20"],"title":"QNAP QTS Improper Input Validation Vulnerability (CVE-2019-7193)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-qts-cve-2019-7193","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2019-7192"],"exploited":"in-the-wild","identifiers":["CVE-2019-7192"],"json":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2019-7192.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2019-7192 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Photo Station","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-photo-station-cve-2019-7192","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system. CISA added CVE-2019-7192 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-863"],"title":"QNAP Photo Station Improper Access Control Vulnerability (CVE-2019-7192)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-photo-station-cve-2019-7192","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2019-5825"],"exploited":"in-the-wild","identifiers":["CVE-2019-5825"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2019-5825.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2019-5825 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2019-5825","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2019-5825 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium V8 Out-of-Bounds Write Vulnerability (CVE-2019-5825)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2019-5825","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2019-15271"],"exploited":"in-the-wild","identifiers":["CVE-2019-15271"],"json":"https://helix.ml/threat-watch/i/cisco-rv-series-routers-cve-2019-15271.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2019-15271 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"RV Series Routers","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-rv-series-routers-cve-2019-15271","stacks":["network","rust"],"startedAt":"2022-06-08","status":"closed","summary":"A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges. CISA added CVE-2019-15271 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability (CVE-2019-15271)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-rv-series-routers-cve-2019-15271","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2018-6065"],"exploited":"in-the-wild","identifiers":["CVE-2018-6065"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2018-6065.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2018-6065 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2018-6065","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2018-6065 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-190","cwe-787"],"title":"Google Chromium V8 Integer Overflow Vulnerability (CVE-2018-6065)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2018-6065","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2018-4990"],"exploited":"in-the-wild","identifiers":["CVE-2018-4990"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2018-4990.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2018-4990 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2018-4990","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution. CISA added CVE-2018-4990 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-415"],"title":"Adobe Acrobat and Reader Double Free Vulnerability (CVE-2018-4990)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2018-4990","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2018-17480"],"exploited":"in-the-wild","identifiers":["CVE-2018-17480"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2018-17480.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2018-17480 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2018-17480","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2018-17480 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chromium V8 Out-of-Bounds Write Vulnerability (CVE-2018-17480)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2018-17480","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2018-17463"],"exploited":"in-the-wild","identifiers":["CVE-2018-17463"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2018-17463.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2018-17463 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2018-17463","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2018-17463 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Google Chromium V8 Remote Code Execution Vulnerability (CVE-2018-17463)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2018-17463","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2017-6862"],"exploited":"in-the-wild","identifiers":["CVE-2017-6862"],"json":"https://helix.ml/threat-watch/i/netgear-multiple-devices-cve-2017-6862.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2017-6862 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Multiple Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-multiple-devices-cve-2017-6862","stacks":["network"],"startedAt":"2022-06-08","status":"closed","summary":"Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution. CISA added CVE-2017-6862 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","memory-corruption","cwe-119"],"title":"NETGEAR Multiple Devices Buffer Overflow Vulnerability (CVE-2017-6862)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/netgear-multiple-devices-cve-2017-6862","vendor":"NETGEAR"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2017-5070"],"exploited":"in-the-wild","identifiers":["CVE-2017-5070"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2017-5070.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2017-5070 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2017-5070","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2017-5070 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2017-5070)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2017-5070","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2017-5030"],"exploited":"in-the-wild","identifiers":["CVE-2017-5030"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2017-5030.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2017-5030 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2017-5030","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2017-5030 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Google Chromium V8 Memory Corruption Vulnerability (CVE-2017-5030)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2017-5030","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2016-5198"],"exploited":"in-the-wild","identifiers":["CVE-2016-5198"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2016-5198.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2016-5198 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2016-5198","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2016-5198 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125","cwe-787"],"title":"Google Chromium V8 Out-of-Bounds Memory Vulnerability (CVE-2016-5198)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2016-5198","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2016-1646"],"exploited":"in-the-wild","identifiers":["CVE-2016-1646"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2016-1646.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2016-1646 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2016-1646","stacks":["browser"],"startedAt":"2022-06-08","status":"closed","summary":"Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2016-1646 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Google Chromium V8 Out-of-Bounds Read Vulnerability (CVE-2016-1646)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2016-1646","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2013-1331"],"exploited":"in-the-wild","identifiers":["CVE-2013-1331"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2013-1331.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2013-1331 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2013-1331","stacks":["windows"],"startedAt":"2022-06-08","status":"closed","summary":"Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document. CISA added CVE-2013-1331 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Office Buffer Overflow Vulnerability (CVE-2013-1331)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2013-1331","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2012-5054"],"exploited":"in-the-wild","identifiers":["CVE-2012-5054"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-5054.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2012-5054 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2012-5054","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments. CISA added CVE-2012-5054 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-189"],"title":"Adobe Flash Player Integer Overflow Vulnerability (CVE-2012-5054)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-5054","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2012-4969"],"exploited":"in-the-wild","identifiers":["CVE-2012-4969"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2012-4969.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2012-4969 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2012-4969","stacks":["browser","windows"],"startedAt":"2022-06-08","status":"closed","summary":"Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site. CISA added CVE-2012-4969 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption"],"title":"Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2012-4969)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2012-4969","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2012-1889"],"exploited":"in-the-wild","identifiers":["CVE-2012-1889"],"json":"https://helix.ml/threat-watch/i/microsoft-xml-core-services-cve-2012-1889.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2012-1889 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"XML Core Services","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-xml-core-services-cve-2012-1889","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution. CISA added CVE-2012-1889 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft XML Core Services Memory Corruption Vulnerability (CVE-2012-1889)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-xml-core-services-cve-2012-1889","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2012-0767"],"exploited":"in-the-wild","identifiers":["CVE-2012-0767"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-0767.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2012-0767 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2012-0767","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML. CISA added CVE-2012-0767 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability (CVE-2012-0767)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-0767","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2012-0754"],"exploited":"in-the-wild","identifiers":["CVE-2012-0754"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-0754.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2012-0754 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2012-0754","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). CISA added CVE-2012-0754 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Adobe Flash Player Memory Corruption Vulnerability (CVE-2012-0754)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-0754","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2012-0151"],"exploited":"in-the-wild","identifiers":["CVE-2012-0151"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2012-0151.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2012-0151 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2012-0151","stacks":["windows"],"startedAt":"2022-06-08","status":"closed","summary":"The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code. CISA added CVE-2012-0151 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability (CVE-2012-0151)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2012-0151","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2011-2462"],"exploited":"in-the-wild","identifiers":["CVE-2011-2462"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2011-2462.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2011-2462 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2011-2462","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS). CISA added CVE-2011-2462 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability (CVE-2011-2462)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2011-2462","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2011-0609"],"exploited":"in-the-wild","identifiers":["CVE-2011-0609"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2011-0609.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2011-0609 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2011-0609","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). CISA added CVE-2011-0609 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Adobe Flash Player Unspecified Vulnerability (CVE-2011-0609)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2011-0609","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2010-2883"],"exploited":"in-the-wild","identifiers":["CVE-2010-2883"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2010-2883.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2010-2883 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2010-2883","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). CISA added CVE-2010-2883 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability (CVE-2010-2883)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2010-2883","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2010-2572"],"exploited":"in-the-wild","identifiers":["CVE-2010-2572"],"json":"https://helix.ml/threat-watch/i/microsoft-powerpoint-cve-2010-2572.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2010-2572 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"PowerPoint","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-powerpoint-cve-2010-2572","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution. CISA added CVE-2010-2572 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft PowerPoint Buffer Overflow Vulnerability (CVE-2010-2572)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-powerpoint-cve-2010-2572","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2010-1297"],"exploited":"in-the-wild","identifiers":["CVE-2010-1297"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2010-1297.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2010-1297 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2010-1297","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). CISA added CVE-2010-1297 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Adobe Flash Player Memory Corruption Vulnerability (CVE-2010-1297)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2010-1297","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2009-4324"],"exploited":"in-the-wild","identifiers":["CVE-2009-4324"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2009-4324.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2009-4324 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2009-4324","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file. CISA added CVE-2009-4324 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-399"],"title":"Adobe Acrobat and Reader Use-After-Free Vulnerability (CVE-2009-4324)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2009-4324","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2009-3953"],"exploited":"in-the-wild","identifiers":["CVE-2009-3953"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2009-3953.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2009-3953 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2009-3953","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution. CISA added CVE-2009-3953 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability (CVE-2009-3953)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2009-3953","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2009-1862"],"exploited":"in-the-wild","identifiers":["CVE-2009-1862"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-flash-player-cve-2009-1862.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2009-1862 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"unpatched","product":"Acrobat and Reader, Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-flash-player-cve-2009-1862","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS). CISA added CVE-2009-1862 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-94"],"title":"Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability (CVE-2009-1862)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-flash-player-cve-2009-1862","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2009-0563"],"exploited":"in-the-wild","identifiers":["CVE-2009-0563"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0563.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2009-0563 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2009-0563","stacks":["windows"],"startedAt":"2022-06-08","status":"closed","summary":"Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field. CISA added CVE-2009-0563 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Office Buffer Overflow Vulnerability (CVE-2009-0563)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0563","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2009-0557"],"exploited":"in-the-wild","identifiers":["CVE-2009-0557"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0557.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2009-0557 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2009-0557","stacks":["windows"],"startedAt":"2022-06-08","status":"closed","summary":"Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object. CISA added CVE-2009-0557 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-94"],"title":"Microsoft Office Object Record Corruption Vulnerability (CVE-2009-0557)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2009-0557","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2008-0655"],"exploited":"in-the-wild","identifiers":["CVE-2008-0655"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2008-0655.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2008-0655 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2008-0655","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times. CISA added CVE-2008-0655 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Adobe Acrobat and Reader Unspecified Vulnerability (CVE-2008-0655)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2008-0655","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2007-5659"],"exploited":"in-the-wild","identifiers":["CVE-2007-5659"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2007-5659.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2007-5659 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2007-5659","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods. CISA added CVE-2007-5659 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Adobe Acrobat and Reader Buffer Overflow Vulnerability (CVE-2007-5659)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2007-5659","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-22","cveIds":["CVE-2006-2492"],"exploited":"in-the-wild","identifiers":["CVE-2006-2492"],"json":"https://helix.ml/threat-watch/i/microsoft-word-cve-2006-2492.json","latestUpdate":{"date":"2022-06-08","title":"CISA added CVE-2006-2492 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 22, 2022)"},"patchStatus":"patched","product":"Word","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-word-cve-2006-2492","stacks":[],"startedAt":"2022-06-08","status":"closed","summary":"Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code. CISA added CVE-2006-2492 to its Known Exploited Vulnerabilities catalog on Jun 8, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-120"],"title":"Microsoft Word Malformed Object Pointer Vulnerability (CVE-2006-2492)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-word-cve-2006-2492","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-16","cveIds":["CVE-2022-26134"],"exploited":"in-the-wild","identifiers":["CVE-2022-26134"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-server-data-center-cve-2022-26134.json","latestUpdate":{"date":"2022-06-02","title":"CISA added CVE-2022-26134 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 6, 2022)"},"patchStatus":"patched","product":"Confluence Server/Data Center","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-server-data-center-cve-2022-26134","stacks":["devtools","java"],"startedAt":"2022-06-02","status":"closed","summary":"Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution. CISA added CVE-2022-26134 to its Known Exploited Vulnerabilities catalog on Jun 2, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-917"],"title":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability (CVE-2022-26134)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-server-data-center-cve-2022-26134","vendor":"Atlassian"},{"auto":true,"category":"breach","closedAt":"2022-06-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADECCO"],"json":"https://helix.ml/threat-watch/i/adecco-data-breach.json","latestUpdate":{"date":"2022-05-31","title":"Have I Been Pwned loaded 4.3M breached Adecco accounts"},"patchStatus":"no-fix-needed","product":"adecco.com","severity":"high","severityNote":"4.3M accounts · passwords exposed","slug":"adecco-data-breach","stacks":[],"startedAt":"2022-05-31","status":"closed","summary":"In March 2021, news broke of a massive data breach impacting millions of Adecco customers in South America which was subsequently sold on a popular hacking forum. The breach exposed over 4M unique email addresses as well as genders, dates of birth, marital statuses, phone numbers and passwords stored as bcrypt hashes. Exposed data: email addresses, genders, geographic locations, marital statuses, names, passwords, phone numbers. The breach dates from Jan 3, 2021; Have I Been Pwned loaded it on May 31, 2022.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","marital-statuses","names","passwords","phone-numbers"],"title":"Adecco data breach: 4.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/adecco-data-breach","vendor":"Adecco"},{"auto":true,"category":"breach","closedAt":"2022-06-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CTARS"],"json":"https://helix.ml/threat-watch/i/ctars-data-breach.json","latestUpdate":{"date":"2022-05-31","title":"Have I Been Pwned loaded 12K breached CTARS accounts"},"patchStatus":"no-fix-needed","product":"ctars.com.au","severity":"high","severityNote":"12K accounts · passwords exposed","slug":"ctars-data-breach","stacks":[],"startedAt":"2022-05-31","status":"closed","summary":"In May 2022, the client management system for the Australian government's NDIS (National Disability Insurance Scheme) suffered a data breach which was subsequently posted to an online hacking forum. The CTARS cloud platform is used by care providers to record information about NDIS participants and often contains sensitive medical information. Impacted data includes over 12k unique email addresses, physical addresses, names, dates of birth, phone numbers and data related to patient conditions and treatments. Exposed data: dates of birth, email addresses, genders, names, passwords, personal health data, phone numbers, physical addresses, salutations, usernames. The breach dates from May 21, 2021; Have I Been Pwned loaded it on May 31, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","personal-health-data","phone-numbers","physical-addresses","salutations","usernames"],"title":"CTARS data breach: 12K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ctars-data-breach","vendor":"CTARS"},{"auto":true,"category":"breach","closedAt":"2022-06-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MGM2022UPDATE"],"json":"https://helix.ml/threat-watch/i/mgm2022update-data-breach.json","latestUpdate":{"date":"2022-05-29","title":"Have I Been Pwned loaded 24.8M breached MGM Resorts (2022 Update) accounts"},"patchStatus":"no-fix-needed","product":"mgmresorts.com","severity":"medium","severityNote":"24.8M accounts","slug":"mgm2022update-data-breach","stacks":[],"startedAt":"2022-05-29","status":"closed","summary":"In July 2019, MGM Resorts discovered a data breach of one of their cloud services. The breach included 10.6M guest records with 3.1M unique email addresses stemming back to 2017. In May 2022, a superset of the data totalling almost 25M unique email addresses across 142M rows was extensively shared on Telegram. On analysis, it's highly likely the data stems from the same incident with 142M records having been discovered for sale on a dark web marketplace in mid-2020. The exposed data included email and physical addresses, names, phone numbers and dates of birth. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Jul 25, 2019; Have I Been Pwned loaded it on May 29, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses"],"title":"MGM Resorts (2022 Update) data breach: 24.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mgm2022update-data-breach","vendor":"MGM Resorts (2022 Update)"},{"auto":true,"category":"breach","closedAt":"2022-06-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PREENME"],"json":"https://helix.ml/threat-watch/i/preenme-data-breach.json","latestUpdate":{"date":"2022-05-26","title":"Have I Been Pwned loaded 236K breached Preen.Me accounts"},"patchStatus":"no-fix-needed","product":"preen.me","severity":"medium","severityNote":"236K accounts","slug":"preenme-data-breach","stacks":[],"startedAt":"2022-05-26","status":"closed","summary":"In May 2020, social media marketing company Preen.Me was the target of a ransom attack that resulted in hundreds of thousands of records being publicly posted. Over 236k unique email addresses were exposed in the attack alongside names, usernames and links to social media profiles. Exposed data: email addresses, names, social media profiles, usernames. The breach dates from May 25, 2020; Have I Been Pwned loaded it on May 26, 2022.","tags":["data-breach","hibp","email-addresses","names","social-media-profiles","usernames"],"title":"Preen.Me data breach: 236K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/preenme-data-breach","vendor":"Preen.Me"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2019-3010"],"exploited":"in-the-wild","identifiers":["CVE-2019-3010"],"json":"https://helix.ml/threat-watch/i/oracle-solaris-cve-2019-3010.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2019-3010 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Solaris","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-solaris-cve-2019-3010","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2019-3010 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Oracle Solaris Privilege Escalation Vulnerability (CVE-2019-3010)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-solaris-cve-2019-3010","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2016-3393"],"exploited":"in-the-wild","identifiers":["CVE-2016-3393"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-3393.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2016-3393 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2016-3393","stacks":["windows"],"startedAt":"2022-05-25","status":"closed","summary":"A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system. CISA added CVE-2016-3393 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-284"],"title":"Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability (CVE-2016-3393)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-3393","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2016-7256"],"exploited":"in-the-wild","identifiers":["CVE-2016-7256"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-7256.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2016-7256 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2016-7256","stacks":["windows"],"startedAt":"2022-05-25","status":"closed","summary":"A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system. CISA added CVE-2016-7256 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-284"],"title":"Microsoft Windows Open Type Font Remote Code Execution Vulnerability (CVE-2016-7256)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-7256","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2016-1010"],"exploited":"in-the-wild","identifiers":["CVE-2016-1010"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-and-air-cve-2016-1010.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2016-1010 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player and AIR","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-and-air-cve-2016-1010","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code. CISA added CVE-2016-1010 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-190"],"title":"Adobe Flash Player and AIR Integer Overflow Vulnerability (CVE-2016-1010)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-and-air-cve-2016-1010","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2016-0984"],"exploited":"in-the-wild","identifiers":["CVE-2016-0984"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-and-air-cve-2016-0984.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2016-0984 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player and AIR","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-and-air-cve-2016-0984","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code. CISA added CVE-2016-0984 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Flash Player and AIR Use-After-Free Vulnerability (CVE-2016-0984)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-and-air-cve-2016-0984","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2016-0034"],"exploited":"in-the-wild","identifiers":["CVE-2016-0034"],"json":"https://helix.ml/threat-watch/i/microsoft-silverlight-cve-2016-0034.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2016-0034 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Silverlight","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-silverlight-cve-2016-0034","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS). CISA added CVE-2016-0034 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Microsoft Silverlight Runtime Remote Code Execution Vulnerability (CVE-2016-0034)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-silverlight-cve-2016-0034","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-0310"],"exploited":"in-the-wild","identifiers":["CVE-2015-0310"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-0310.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-0310 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-0310","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism. CISA added CVE-2015-0310 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-264"],"title":"Adobe Flash Player ASLR Bypass Vulnerability (CVE-2015-0310)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-0310","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-0016"],"exploited":"in-the-wild","identifiers":["CVE-2015-0016"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-0016.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-0016 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2015-0016","stacks":["windows"],"startedAt":"2022-05-25","status":"closed","summary":"Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges. CISA added CVE-2015-0016 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","path-traversal","cwe-22"],"title":"Microsoft Windows TS WebProxy Directory Traversal Vulnerability (CVE-2015-0016)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-0016","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-0071"],"exploited":"in-the-wild","identifiers":["CVE-2015-0071"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-0071.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-0071 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2015-0071","stacks":["browser","windows"],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site. CISA added CVE-2015-0071 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-264"],"title":"Microsoft Internet Explorer ASLR Bypass Vulnerability (CVE-2015-0071)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-0071","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-2360"],"exploited":"in-the-wild","identifiers":["CVE-2015-2360"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2015-2360.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-2360 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2015-2360","stacks":["windows"],"startedAt":"2022-05-25","status":"closed","summary":"Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS). CISA added CVE-2015-2360 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-119"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2015-2360)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2015-2360","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-2425"],"exploited":"in-the-wild","identifiers":["CVE-2015-2425"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-2425.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-2425 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2015-2425","stacks":["browser","windows"],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). CISA added CVE-2015-2425 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-2425)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-2425","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-1769"],"exploited":"in-the-wild","identifiers":["CVE-2015-1769"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-1769.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-1769 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 6.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2015-1769","stacks":["windows"],"startedAt":"2022-05-25","status":"closed","summary":"A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links. CISA added CVE-2015-1769 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Windows Mount Manager Privilege Escalation Vulnerability (CVE-2015-1769)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-1769","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-4495"],"exploited":"in-the-wild","identifiers":["CVE-2015-4495"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2015-4495.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-4495 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Firefox","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-cve-2015-4495","stacks":["browser"],"startedAt":"2022-05-25","status":"closed","summary":"Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges. CISA added CVE-2015-4495 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Mozilla Firefox Security Feature Bypass Vulnerability (CVE-2015-4495)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2015-4495","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-8651"],"exploited":"in-the-wild","identifiers":["CVE-2015-8651"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-8651.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-8651 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-8651","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Integer overflow in Adobe Flash Player allows attackers to execute code. CISA added CVE-2015-8651 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-189"],"title":"Adobe Flash Player Integer Overflow Vulnerability (CVE-2015-8651)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-8651","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-6175"],"exploited":"in-the-wild","identifiers":["CVE-2015-6175"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-6175.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-6175 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2015-6175","stacks":["linux","windows"],"startedAt":"2022-05-25","status":"closed","summary":"The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application. CISA added CVE-2015-6175 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2015-6175)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-6175","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2015-1671"],"exploited":"in-the-wild","identifiers":["CVE-2015-1671"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-1671.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2015-1671 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2015-1671","stacks":["windows"],"startedAt":"2022-05-25","status":"closed","summary":"A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts. CISA added CVE-2015-1671 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-19"],"title":"Microsoft Windows Remote Code Execution Vulnerability (CVE-2015-1671)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-1671","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2014-4148"],"exploited":"in-the-wild","identifiers":["CVE-2014-4148"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-4148.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2014-4148 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2014-4148","stacks":["windows"],"startedAt":"2022-05-25","status":"closed","summary":"A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts. CISA added CVE-2014-4148 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Microsoft Windows Remote Code Execution Vulnerability (CVE-2014-4148)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-4148","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2014-8439"],"exploited":"in-the-wild","identifiers":["CVE-2014-8439"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-8439.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2014-8439 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2014-8439","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution. CISA added CVE-2014-8439 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Adobe Flash Player Dereferenced Pointer Vulnerability (CVE-2014-8439)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-8439","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2014-4123"],"exploited":"in-the-wild","identifiers":["CVE-2014-4123"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-4123.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2014-4123 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2014-4123","stacks":["browser","windows"],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. CISA added CVE-2014-4123 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Internet Explorer Privilege Escalation Vulnerability (CVE-2014-4123)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-4123","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2014-0546"],"exploited":"in-the-wild","identifiers":["CVE-2014-0546"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2014-0546.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2014-0546 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2014-0546","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context. CISA added CVE-2014-0546 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Adobe Reader and Acrobat Sandbox Bypass Vulnerability (CVE-2014-0546)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2014-0546","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2014-2817"],"exploited":"in-the-wild","identifiers":["CVE-2014-2817"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-2817.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2014-2817 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2014-2817","stacks":["browser","windows"],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. CISA added CVE-2014-2817 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Internet Explorer Privilege Escalation Vulnerability (CVE-2014-2817)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-2817","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2014-4077"],"exploited":"in-the-wild","identifiers":["CVE-2014-4077"],"json":"https://helix.ml/threat-watch/i/microsoft-input-method-editor-ime-japanese-cve-2014-4077.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2014-4077 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Input Method Editor (IME) Japanese","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-input-method-editor-ime-japanese-cve-2014-4077","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation. CISA added CVE-2014-4077 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft IME Japanese Privilege Escalation Vulnerability (CVE-2014-4077)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-input-method-editor-ime-japanese-cve-2014-4077","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2014-3153"],"exploited":"in-the-wild","identifiers":["CVE-2014-3153"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2014-3153.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2014-3153 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2014-3153","stacks":["linux"],"startedAt":"2022-05-25","status":"closed","summary":"The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges. CISA added CVE-2014-3153 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-269"],"title":"Linux Kernel Privilege Escalation Vulnerability (CVE-2014-3153)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2014-3153","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2013-7331"],"exploited":"in-the-wild","identifiers":["CVE-2013-7331"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-7331.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2013-7331 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2013-7331","stacks":["browser","windows"],"startedAt":"2022-05-25","status":"closed","summary":"An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications. CISA added CVE-2013-7331 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2013-7331)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-7331","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2013-3993"],"exploited":"in-the-wild","identifiers":["CVE-2013-3993"],"json":"https://helix.ml/threat-watch/i/ibm-infosphere-biginsights-cve-2013-3993.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2013-3993 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"InfoSphere BigInsights","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-infosphere-biginsights-cve-2013-3993","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data. CISA added CVE-2013-3993 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-264"],"title":"IBM InfoSphere BigInsights Invalid Input Vulnerability (CVE-2013-3993)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/ibm-infosphere-biginsights-cve-2013-3993","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2013-3896"],"exploited":"in-the-wild","identifiers":["CVE-2013-3896"],"json":"https://helix.ml/threat-watch/i/microsoft-silverlight-cve-2013-3896.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2013-3896 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Silverlight","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-silverlight-cve-2013-3896","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application. CISA added CVE-2013-3896 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Microsoft Silverlight Information Disclosure Vulnerability (CVE-2013-3896)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-silverlight-cve-2013-3896","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2013-2423"],"exploited":"in-the-wild","identifiers":["CVE-2013-2423"],"json":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2013-2423.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2013-2423 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Java Runtime Environment (JRE)","severity":"low","severityNote":"CVSS 3.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-runtime-environment-jre-cve-2013-2423","stacks":["java"],"startedAt":"2022-05-25","status":"closed","summary":"Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity. CISA added CVE-2013-2423 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle JRE Unspecified Vulnerability (CVE-2013-2423)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2013-2423","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2013-0431"],"exploited":"in-the-wild","identifiers":["CVE-2013-0431"],"json":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2013-0431.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2013-0431 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Java Runtime Environment (JRE)","severity":"low","severityNote":"CVSS 3.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-runtime-environment-jre-cve-2013-0431","stacks":["java"],"startedAt":"2022-05-25","status":"closed","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox. CISA added CVE-2013-0431 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Oracle JRE Sandbox Bypass Vulnerability (CVE-2013-0431)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2013-0431","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2013-0422"],"exploited":"in-the-wild","identifiers":["CVE-2013-0422"],"json":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2013-0422.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2013-0422 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Java Runtime Environment (JRE)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-runtime-environment-jre-cve-2013-0422","stacks":["java"],"startedAt":"2022-05-25","status":"closed","summary":"A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system. CISA added CVE-2013-0422 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-264"],"title":"Oracle JRE Remote Code Execution Vulnerability (CVE-2013-0422)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2013-0422","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2013-0074"],"exploited":"in-the-wild","identifiers":["CVE-2013-0074"],"json":"https://helix.ml/threat-watch/i/microsoft-silverlight-cve-2013-0074.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2013-0074 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"unpatched","product":"Silverlight","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-silverlight-cve-2013-0074","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application. CISA added CVE-2013-0074 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Microsoft Silverlight Double Dereference Vulnerability (CVE-2013-0074)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-silverlight-cve-2013-0074","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2012-1710"],"exploited":"in-the-wild","identifiers":["CVE-2012-1710"],"json":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2012-1710.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2012-1710 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Fusion Middleware","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-fusion-middleware-cve-2012-1710","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer. CISA added CVE-2012-1710 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Oracle Fusion Middleware Unspecified Vulnerability (CVE-2012-1710)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2012-1710","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2010-1428"],"exploited":"in-the-wild","identifiers":["CVE-2010-1428"],"json":"https://helix.ml/threat-watch/i/red-hat-jboss-cve-2010-1428.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2010-1428 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"JBoss","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-jboss-cve-2010-1428","stacks":["java","linux"],"startedAt":"2022-05-25","status":"closed","summary":"Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information. CISA added CVE-2010-1428 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-264"],"title":"Red Hat JBoss Information Disclosure Vulnerability (CVE-2010-1428)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/red-hat-jboss-cve-2010-1428","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2010-0840"],"exploited":"in-the-wild","identifiers":["CVE-2010-0840"],"json":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2010-0840.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2010-0840 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"Java Runtime Environment (JRE)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-runtime-environment-jre-cve-2010-0840","stacks":["java"],"startedAt":"2022-05-25","status":"closed","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors. CISA added CVE-2010-0840 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle JRE Unspecified Vulnerability (CVE-2010-0840)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-java-runtime-environment-jre-cve-2010-0840","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-06-08","cveIds":["CVE-2010-0738"],"exploited":"in-the-wild","identifiers":["CVE-2010-0738"],"json":"https://helix.ml/threat-watch/i/red-hat-jboss-cve-2010-0738.json","latestUpdate":{"date":"2022-05-25","title":"CISA added CVE-2010-0738 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 15, 2022)"},"patchStatus":"patched","product":"JBoss","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-jboss-cve-2010-0738","stacks":["java","linux"],"startedAt":"2022-05-25","status":"closed","summary":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method. CISA added CVE-2010-0738 to its Known Exploited Vulnerabilities catalog on May 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-264"],"title":"Red Hat JBoss Authentication Bypass Vulnerability (CVE-2010-0738)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/red-hat-jboss-cve-2010-0738","vendor":"Red Hat"},{"auto":true,"category":"breach","closedAt":"2022-06-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AMARTFURNITURE"],"json":"https://helix.ml/threat-watch/i/amartfurniture-data-breach.json","latestUpdate":{"date":"2022-05-25","title":"Have I Been Pwned loaded 108K breached Amart Furniture accounts"},"patchStatus":"no-fix-needed","product":"amartfurniture.com.au","severity":"high","severityNote":"108K accounts · passwords exposed","slug":"amartfurniture-data-breach","stacks":[],"startedAt":"2022-05-25","status":"closed","summary":"In May 2022, the Australian retailer Amart Furniture advised that their warranty claims database hosted on Amazon Web Services had been the target of a cyber attack. Over 100k records containing email and physical address, names, phone numbers and passwords stored as bcrypt hashes were exposed and shared online by the attacker. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from May 16, 2022; Have I Been Pwned loaded it on May 25, 2022.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Amart Furniture data breach: 108K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/amartfurniture-data-breach","vendor":"Amart Furniture"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2018-8611"],"exploited":"in-the-wild","identifiers":["CVE-2018-8611"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8611.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2018-8611 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2018-8611","stacks":["linux","windows"],"startedAt":"2022-05-24","status":"closed","summary":"A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. CISA added CVE-2018-8611 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-404"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2018-8611)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8611","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2018-19953"],"exploited":"in-the-wild","identifiers":["CVE-2018-19953"],"json":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2018-19953.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2018-19953 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Network Attached Storage (NAS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-network-attached-storage-nas-cve-2018-19953","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. CISA added CVE-2018-19953 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","xss","cwe-79","cwe-80"],"title":"QNAP NAS File Station Cross-Site Scripting Vulnerability (CVE-2018-19953)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2018-19953","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2018-19949"],"exploited":"in-the-wild","identifiers":["CVE-2018-19949"],"json":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2018-19949.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2018-19949 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Network Attached Storage (NAS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-network-attached-storage-nas-cve-2018-19949","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands. CISA added CVE-2018-19949 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-77","cwe-78"],"title":"QNAP NAS File Station Command Injection Vulnerability (CVE-2018-19949)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2018-19949","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2018-19943"],"exploited":"in-the-wild","identifiers":["CVE-2018-19943"],"json":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2018-19943.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2018-19943 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Network Attached Storage (NAS)","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-network-attached-storage-nas-cve-2018-19943","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. CISA added CVE-2018-19943 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","xss","cwe-79","cwe-80"],"title":"QNAP NAS File Station Cross-Site Scripting Vulnerability (CVE-2018-19943)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2018-19943","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-0147"],"exploited":"in-the-wild","identifiers":["CVE-2017-0147"],"json":"https://helix.ml/threat-watch/i/microsoft-smbv1-server-cve-2017-0147.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-0147 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"SMBv1 server","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-smbv1-server-cve-2017-0147","stacks":["windows"],"startedAt":"2022-05-24","status":"closed","summary":"The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet. CISA added CVE-2017-0147 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-200"],"title":"Microsoft Windows SMBv1 Information Disclosure Vulnerability (CVE-2017-0147)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-smbv1-server-cve-2017-0147","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-0022"],"exploited":"in-the-wild","identifiers":["CVE-2017-0022"],"json":"https://helix.ml/threat-watch/i/microsoft-xml-core-services-cve-2017-0022.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-0022 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"XML Core Services","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-xml-core-services-cve-2017-0022","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site. CISA added CVE-2017-0022 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Microsoft XML Core Services Information Disclosure Vulnerability (CVE-2017-0022)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-xml-core-services-cve-2017-0022","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-0005"],"exploited":"in-the-wild","identifiers":["CVE-2017-0005"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0005.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-0005 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2017-0005","stacks":["windows"],"startedAt":"2022-05-24","status":"closed","summary":"The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application. CISA added CVE-2017-0005 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-119"],"title":"Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability (CVE-2017-0005)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0005","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-0149"],"exploited":"in-the-wild","identifiers":["CVE-2017-0149"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0149.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-0149 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2017-0149","stacks":["browser","windows"],"startedAt":"2022-05-24","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website. CISA added CVE-2017-0149 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2017-0149)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0149","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-0210"],"exploited":"in-the-wild","identifiers":["CVE-2017-0210"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0210.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-0210 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2017-0210","stacks":["browser","windows"],"startedAt":"2022-05-24","status":"closed","summary":"A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information. CISA added CVE-2017-0210 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Internet Explorer Privilege Escalation Vulnerability (CVE-2017-0210)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0210","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-8291"],"exploited":"in-the-wild","identifiers":["CVE-2017-8291"],"json":"https://helix.ml/threat-watch/i/artifex-ghostscript-cve-2017-8291.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-8291 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Ghostscript","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"artifex-ghostscript-cve-2017-8291","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a \"/OutputFile. CISA added CVE-2017-8291 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-704"],"title":"Artifex Ghostscript Type Confusion Vulnerability (CVE-2017-8291)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/artifex-ghostscript-cve-2017-8291","vendor":"Artifex"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-8543"],"exploited":"in-the-wild","identifiers":["CVE-2017-8543"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-8543.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-8543 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Windows","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2017-8543","stacks":["windows"],"startedAt":"2022-05-24","status":"closed","summary":"Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory. CISA added CVE-2017-8543 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-281"],"title":"Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8543)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-8543","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2017-18362"],"exploited":"in-the-wild","identifiers":["CVE-2017-18362"],"json":"https://helix.ml/threat-watch/i/kaseya-virtual-system-server-administrator-vsa-cve-2017-18362.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2017-18362 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"unpatched","product":"Virtual System/Server Administrator (VSA)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"kaseya-virtual-system-server-administrator-vsa-cve-2017-18362","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. CISA added CVE-2017-18362 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"Kaseya VSA SQL Injection Vulnerability (CVE-2017-18362)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/kaseya-virtual-system-server-administrator-vsa-cve-2017-18362","vendor":"Kaseya"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-0162"],"exploited":"in-the-wild","identifiers":["CVE-2016-0162"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2016-0162.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-0162 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2016-0162","stacks":["browser","windows"],"startedAt":"2022-05-24","status":"closed","summary":"An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer. CISA added CVE-2016-0162 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2016-0162)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2016-0162","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-3351"],"exploited":"in-the-wild","identifiers":["CVE-2016-3351"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-and-edge-cve-2016-3351.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-3351 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Internet Explorer and Edge","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-and-edge-cve-2016-3351","stacks":["browser","windows"],"startedAt":"2022-05-24","status":"closed","summary":"An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. CISA added CVE-2016-3351 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-200"],"title":"Microsoft Internet Explorer and Edge Information Disclosure Vulnerability (CVE-2016-3351)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-and-edge-cve-2016-3351","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-4655"],"exploited":"in-the-wild","identifiers":["CVE-2016-4655"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2016-4655.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-4655 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"iOS","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2016-4655","stacks":["ios"],"startedAt":"2022-05-24","status":"closed","summary":"The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application. CISA added CVE-2016-4655 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Apple iOS Information Disclosure Vulnerability (CVE-2016-4655)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2016-4655","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-4656"],"exploited":"in-the-wild","identifiers":["CVE-2016-4656"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2016-4656.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-4656 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"iOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2016-4656","stacks":["ios"],"startedAt":"2022-05-24","status":"closed","summary":"A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application. CISA added CVE-2016-4656 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-264"],"title":"Apple iOS Memory Corruption Vulnerability (CVE-2016-4656)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2016-4656","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-4657"],"exploited":"in-the-wild","identifiers":["CVE-2016-4657"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2016-4657.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-4657 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"iOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2016-4657","stacks":["browser","ios"],"startedAt":"2022-05-24","status":"closed","summary":"Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2016-4657 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Apple iOS Webkit Memory Corruption Vulnerability (CVE-2016-4657)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2016-4657","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-6366"],"exploited":"in-the-wild","identifiers":["CVE-2016-6366"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2016-6366.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-6366 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Adaptive Security Appliance (ASA)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-cve-2016-6366","stacks":["network"],"startedAt":"2022-05-24","status":"closed","summary":"A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code. CISA added CVE-2016-6366 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability (CVE-2016-6366)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2016-6366","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-6367"],"exploited":"in-the-wild","identifiers":["CVE-2016-6367"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2016-6367.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-6367 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Adaptive Security Appliance (ASA)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-cve-2016-6367","stacks":["network"],"startedAt":"2022-05-24","status":"closed","summary":"A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code. CISA added CVE-2016-6367 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability (CVE-2016-6367)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2016-6367","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-06-07","cveIds":["CVE-2016-3298"],"exploited":"in-the-wild","identifiers":["CVE-2016-3298"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2016-3298.json","latestUpdate":{"date":"2022-05-24","title":"CISA added CVE-2016-3298 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 14, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2016-3298","stacks":["browser","windows"],"startedAt":"2022-05-24","status":"closed","summary":"An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk. CISA added CVE-2016-3298 to its Known Exploited Vulnerabilities catalog on May 24, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability (CVE-2016-3298)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2016-3298","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2022-06-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FANPASS"],"json":"https://helix.ml/threat-watch/i/fanpass-data-breach.json","latestUpdate":{"date":"2022-05-24","title":"Have I Been Pwned loaded 112K breached Fanpass accounts"},"patchStatus":"no-fix-needed","product":"fanpass.co.uk","severity":"high","severityNote":"112K accounts · passwords exposed","slug":"fanpass-data-breach","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"In April 2022, the UK based website for buying and selling soccer tickets Fanpass suffered a data breach which exposed 112k customer records. Impacted data includes names, phone numbers, physical addresses, purchase histories and salted password hashes. Exposed data: email addresses, genders, names, partial dates of birth, passwords, phone numbers, physical addresses, purchases, social media profiles. The breach dates from Apr 30, 2022; Have I Been Pwned loaded it on May 24, 2022.","tags":["data-breach","hibp","email-addresses","genders","names","partial-dates-of-birth","passwords","phone-numbers","physical-addresses","purchases","social-media-profiles"],"title":"Fanpass data breach: 112K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/fanpass-data-breach","vendor":"Fanpass"},{"auto":true,"category":"breach","closedAt":"2022-06-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SIRHURT"],"json":"https://helix.ml/threat-watch/i/sirhurt-data-breach.json","latestUpdate":{"date":"2022-05-24","title":"Have I Been Pwned loaded 90K breached SirHurt accounts"},"patchStatus":"no-fix-needed","product":"sirhurt.net","severity":"high","severityNote":"90K accounts · passwords exposed","slug":"sirhurt-data-breach","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"In April 2021, the the Roblox cheats website SirHurt suffered a data breach that exposed over 90k customer records. The exposed data included email and IP addresses, usernames and passwords stored as MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 23, 2021; Have I Been Pwned loaded it on May 24, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"SirHurt data breach: 90K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sirhurt-data-breach","vendor":"SirHurt"},{"auto":true,"category":"breach","closedAt":"2022-06-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WENDYS"],"json":"https://helix.ml/threat-watch/i/wendys-data-breach.json","latestUpdate":{"date":"2022-05-24","title":"Have I Been Pwned loaded 52K breached Wendy's accounts"},"patchStatus":"no-fix-needed","product":"wendys.com.ph","severity":"high","severityNote":"52K accounts · passwords exposed","slug":"wendys-data-breach","stacks":[],"startedAt":"2022-05-24","status":"closed","summary":"In March 2018, Wendy's in the Philippines suffered a data breach which impacted over 52k customers and job applicants. The breach exposed extensive personal information including names, email and IP addresses, physical addresses, phone numbers and passwords stored as MD5 hashes. Exposed data: education levels, email addresses, ip addresses, job applications, names, passwords, phone numbers, physical addresses. The breach dates from Mar 31, 2018; Have I Been Pwned loaded it on May 24, 2022.","tags":["data-breach","hibp","education-levels","email-addresses","ip-addresses","job-applications","names","passwords","phone-numbers","physical-addresses"],"title":"Wendy's data breach: 52K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wendys-data-breach","vendor":"Wendy's"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2022-20821"],"exploited":"in-the-wild","identifiers":["CVE-2022-20821"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2022-20821.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2022-20821 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"IOS XR","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-cve-2022-20821","stacks":["ios","network"],"startedAt":"2022-05-23","status":"closed","summary":"Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container. CISA added CVE-2022-20821 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-923"],"title":"Cisco IOS XR Open Port Vulnerability (CVE-2022-20821)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2022-20821","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2021-1048"],"exploited":"in-the-wild","identifiers":["CVE-2021-1048"],"json":"https://helix.ml/threat-watch/i/android-kernel-cve-2021-1048.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2021-1048 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-kernel-cve-2021-1048","stacks":["android","linux"],"startedAt":"2022-05-23","status":"closed","summary":"Android kernel contains a use-after-free vulnerability that allows for privilege escalation. CISA added CVE-2021-1048 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-416"],"title":"Android Kernel Use-After-Free Vulnerability (CVE-2021-1048)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/android-kernel-cve-2021-1048","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2021-0920"],"exploited":"in-the-wild","identifiers":["CVE-2021-0920"],"json":"https://helix.ml/threat-watch/i/android-kernel-cve-2021-0920.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2021-0920 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"medium","severityNote":"CVSS 6.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-kernel-cve-2021-0920","stacks":["android","linux"],"startedAt":"2022-05-23","status":"closed","summary":"Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation. CISA added CVE-2021-0920 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-362","cwe-416"],"title":"Android Kernel Race Condition Vulnerability (CVE-2021-0920)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/android-kernel-cve-2021-0920","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2021-30883"],"exploited":"in-the-wild","identifiers":["CVE-2021-30883"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30883.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2021-30883 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-30883","stacks":[],"startedAt":"2022-05-23","status":"closed","summary":"Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution. CISA added CVE-2021-30883 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2021-30883)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30883","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2020-1027"],"exploited":"in-the-wild","identifiers":["CVE-2020-1027"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1027.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2020-1027 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-1027","stacks":["linux","windows"],"startedAt":"2022-05-23","status":"closed","summary":"An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. CISA added CVE-2020-1027 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-787"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2020-1027)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1027","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2020-0638"],"exploited":"in-the-wild","identifiers":["CVE-2020-0638"],"json":"https://helix.ml/threat-watch/i/microsoft-update-notification-manager-cve-2020-0638.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2020-0638 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Update Notification Manager","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-update-notification-manager-cve-2020-0638","stacks":[],"startedAt":"2022-05-23","status":"closed","summary":"Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2020-0638 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Update Notification Manager Privilege Escalation Vulnerability (CVE-2020-0638)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-update-notification-manager-cve-2020-0638","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-7286"],"exploited":"in-the-wild","identifiers":["CVE-2019-7286"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2019-7286.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-7286 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2019-7286","stacks":[],"startedAt":"2022-05-23","status":"closed","summary":"Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation. CISA added CVE-2019-7286 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2019-7286)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2019-7286","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-7287"],"exploited":"in-the-wild","identifiers":["CVE-2019-7287"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2019-7287.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-7287 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"iOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2019-7287","stacks":["ios"],"startedAt":"2022-05-23","status":"closed","summary":"Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution. CISA added CVE-2019-7287 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Apple iOS Memory Corruption Vulnerability (CVE-2019-7287)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2019-7287","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-0676"],"exploited":"in-the-wild","identifiers":["CVE-2019-0676"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-0676.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-0676 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2019-0676","stacks":["browser","windows"],"startedAt":"2022-05-23","status":"closed","summary":"An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk. CISA added CVE-2019-0676 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2019-0676)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-0676","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-5786"],"exploited":"in-the-wild","identifiers":["CVE-2019-5786"],"json":"https://helix.ml/threat-watch/i/google-chrome-blink-cve-2019-5786.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-5786 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Chrome Blink","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chrome-blink-cve-2019-5786","stacks":["browser"],"startedAt":"2022-05-23","status":"closed","summary":"Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page. CISA added CVE-2019-5786 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chrome Blink Use-After-Free Vulnerability (CVE-2019-5786)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chrome-blink-cve-2019-5786","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-0703"],"exploited":"in-the-wild","identifiers":["CVE-2019-0703"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0703.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-0703 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-0703","stacks":["windows"],"startedAt":"2022-05-23","status":"closed","summary":"An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server. CISA added CVE-2019-0703 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Microsoft Windows SMB Information Disclosure Vulnerability (CVE-2019-0703)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0703","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-0880"],"exploited":"in-the-wild","identifiers":["CVE-2019-0880"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0880.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-0880 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-0880","stacks":["windows"],"startedAt":"2022-05-23","status":"closed","summary":"A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity. CISA added CVE-2019-0880 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2019-0880)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0880","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-13720"],"exploited":"in-the-wild","identifiers":["CVE-2019-13720"],"json":"https://helix.ml/threat-watch/i/google-chrome-webaudio-cve-2019-13720.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-13720 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Chrome WebAudio","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chrome-webaudio-cve-2019-13720","stacks":["browser"],"startedAt":"2022-05-23","status":"closed","summary":"Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. CISA added CVE-2019-13720 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chrome WebAudio Use-After-Free Vulnerability (CVE-2019-13720)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chrome-webaudio-cve-2019-13720","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-11707"],"exploited":"in-the-wild","identifiers":["CVE-2019-11707"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2019-11707.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-11707 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Firefox and Thunderbird","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-and-thunderbird-cve-2019-11707","stacks":["browser"],"startedAt":"2022-05-23","status":"closed","summary":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash. CISA added CVE-2019-11707 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability (CVE-2019-11707)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2019-11707","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-11708"],"exploited":"in-the-wild","identifiers":["CVE-2019-11708"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2019-11708.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-11708 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Firefox and Thunderbird","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-and-thunderbird-cve-2019-11708","stacks":["browser"],"startedAt":"2022-05-23","status":"closed","summary":"Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. CISA added CVE-2019-11708 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability (CVE-2019-11708)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2019-11708","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-8720"],"exploited":"in-the-wild","identifiers":["CVE-2019-8720"],"json":"https://helix.ml/threat-watch/i/webkitgtk-webkitgtk-cve-2019-8720.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-8720 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"WebKitGTK","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"webkitgtk-webkitgtk-cve-2019-8720","stacks":["browser","ios"],"startedAt":"2022-05-23","status":"closed","summary":"WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution. CISA added CVE-2019-8720 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"WebKitGTK Memory Corruption Vulnerability (CVE-2019-8720)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/webkitgtk-webkitgtk-cve-2019-8720","vendor":"WebKitGTK"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-18426"],"exploited":"in-the-wild","identifiers":["CVE-2019-18426"],"json":"https://helix.ml/threat-watch/i/meta-platforms-whatsapp-cve-2019-18426.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-18426 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"WhatsApp","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"meta-platforms-whatsapp-cve-2019-18426","stacks":[],"startedAt":"2022-05-23","status":"closed","summary":"A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading. CISA added CVE-2019-18426 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"WhatsApp Cross-Site Scripting Vulnerability (CVE-2019-18426)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/meta-platforms-whatsapp-cve-2019-18426","vendor":"Meta Platforms"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-1385"],"exploited":"in-the-wild","identifiers":["CVE-2019-1385"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1385.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-1385 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1385","stacks":["windows"],"startedAt":"2022-05-23","status":"closed","summary":"A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. CISA added CVE-2019-1385 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability (CVE-2019-1385)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1385","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2019-1130"],"exploited":"in-the-wild","identifiers":["CVE-2019-1130"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1130.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2019-1130 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1130","stacks":["windows"],"startedAt":"2022-05-23","status":"closed","summary":"A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. CISA added CVE-2019-1130 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability (CVE-2019-1130)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1130","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2018-5002"],"exploited":"in-the-wild","identifiers":["CVE-2018-5002"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2018-5002.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2018-5002 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2018-5002","stacks":[],"startedAt":"2022-05-23","status":"closed","summary":"Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution. CISA added CVE-2018-5002 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Adobe Flash Player Stack-based Buffer Overflow Vulnerability (CVE-2018-5002)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2018-5002","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-06-06","cveIds":["CVE-2018-8589"],"exploited":"in-the-wild","identifiers":["CVE-2018-8589"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2018-8589.json","latestUpdate":{"date":"2022-05-23","title":"CISA added CVE-2018-8589 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 13, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2018-8589","stacks":["windows"],"startedAt":"2022-05-23","status":"closed","summary":"A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system. CISA added CVE-2018-8589 to its Known Exploited Vulnerabilities catalog on May 23, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2018-8589)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2018-8589","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-05-30","cveIds":["CVE-2022-30525"],"exploited":"in-the-wild","identifiers":["CVE-2022-30525"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2022-30525.json","latestUpdate":{"date":"2022-05-16","title":"CISA added CVE-2022-30525 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 6, 2022)"},"patchStatus":"patched","product":"Multiple Firewalls","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-firewalls-cve-2022-30525","stacks":["network"],"startedAt":"2022-05-16","status":"closed","summary":"A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. CISA added CVE-2022-30525 to its Known Exploited Vulnerabilities catalog on May 16, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zyxel Multiple Firewalls OS Command Injection Vulnerability (CVE-2022-30525)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-firewalls-cve-2022-30525","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2022-05-30","cveIds":["CVE-2022-22947"],"exploited":"in-the-wild","identifiers":["CVE-2022-22947"],"json":"https://helix.ml/threat-watch/i/vmware-spring-cloud-gateway-cve-2022-22947.json","latestUpdate":{"date":"2022-05-16","title":"CISA added CVE-2022-22947 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 6, 2022)"},"patchStatus":"patched","product":"Spring Cloud Gateway","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-spring-cloud-gateway-cve-2022-22947","stacks":["cloud","java"],"startedAt":"2022-05-16","status":"closed","summary":"Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. CISA added CVE-2022-22947 to its Known Exploited Vulnerabilities catalog on May 16, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"VMware Spring Cloud Gateway Code Injection Vulnerability (CVE-2022-22947)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/vmware-spring-cloud-gateway-cve-2022-22947","vendor":"VMware"},{"auto":true,"category":"breach","closedAt":"2022-05-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OGUSERS2021"],"json":"https://helix.ml/threat-watch/i/ogusers2021-data-breach.json","latestUpdate":{"date":"2022-05-16","title":"Have I Been Pwned loaded 348K breached OGUsers (2021 breach) accounts"},"patchStatus":"no-fix-needed","product":"ogusers.com","severity":"high","severityNote":"348K accounts · passwords exposed","slug":"ogusers2021-data-breach","stacks":[],"startedAt":"2022-05-16","status":"closed","summary":"In April 2021, the account hijacking and SIM swapping forum OGusers suffered a data breach, the fourth since December 2018. The breach was subsequently sold on a rival hacking forum and contained usernames, email and IP addresses and passwords stored as either salted MD5 or argon2 hashes. A total of 348k unique email addresses appeared in the breach. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 11, 2021; Have I Been Pwned loaded it on May 16, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"OGUsers (2021 breach) data breach: 348K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ogusers2021-data-breach","vendor":"OGUsers (2021 breach)"},{"auto":true,"category":"breach","closedAt":"2022-05-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BLACKBERRYFANS"],"json":"https://helix.ml/threat-watch/i/blackberryfans-data-breach.json","latestUpdate":{"date":"2022-05-16","title":"Have I Been Pwned loaded 174K breached BlackBerry Fans accounts"},"patchStatus":"no-fix-needed","product":"blackberryfans.org","severity":"high","severityNote":"174K accounts · passwords exposed","slug":"blackberryfans-data-breach","stacks":[],"startedAt":"2022-05-16","status":"closed","summary":"In May 2022, the Chinese BlackBerry enthusiasts website BlackBerry Fans suffered a data breach that exposed 174k member records. The impacted data included usernames, email and IP addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 6, 2022; Have I Been Pwned loaded it on May 16, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"BlackBerry Fans data breach: 174K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/blackberryfans-data-breach","vendor":"BlackBerry Fans"},{"auto":true,"category":"breach","closedAt":"2022-05-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PARAGONCHEATS"],"json":"https://helix.ml/threat-watch/i/paragoncheats-data-breach.json","latestUpdate":{"date":"2022-05-14","title":"Have I Been Pwned loaded 188K breached Paragon Cheats accounts"},"patchStatus":"no-fix-needed","product":"paragoncheats.com","severity":"medium","severityNote":"188K accounts","slug":"paragoncheats-data-breach","stacks":[],"startedAt":"2022-05-14","status":"closed","summary":"In May 2021, the Grand Theft Auto Online cheats website Paragon Cheats suffered a data breach that lead to the shutdown of the service. The breach exposed 188k customer records including usernames, email and IP addresses. Exposed data: browser user agent details, email addresses, ip addresses, usernames. The breach dates from May 22, 2021; Have I Been Pwned loaded it on May 14, 2022.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","usernames"],"title":"Paragon Cheats data breach: 188K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/paragoncheats-data-breach","vendor":"Paragon Cheats"},{"auto":true,"category":"patch","closedAt":"2022-05-24","cveIds":["CVE-2022-1388"],"exploited":"in-the-wild","identifiers":["CVE-2022-1388"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-cve-2022-1388.json","latestUpdate":{"date":"2022-05-10","title":"CISA added CVE-2022-1388 to the Known Exploited Vulnerabilities catalog (federal remediation due May 31, 2022)"},"patchStatus":"patched","product":"BIG-IP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-cve-2022-1388","stacks":["network"],"startedAt":"2022-05-10","status":"closed","summary":"F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. CISA added CVE-2022-1388 to its Known Exploited Vulnerabilities catalog on May 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","auth-bypass","cwe-306"],"title":"F5 BIG-IP Missing Authentication Vulnerability (CVE-2022-1388)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-cve-2022-1388","vendor":"F5"},{"auto":true,"category":"patch","closedAt":"2022-05-18","cveIds":["CVE-2021-1789"],"exploited":"in-the-wild","identifiers":["CVE-2021-1789"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-1789.json","latestUpdate":{"date":"2022-05-04","title":"CISA added CVE-2021-1789 to the Known Exploited Vulnerabilities catalog (federal remediation due May 25, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-1789","stacks":[],"startedAt":"2022-05-04","status":"closed","summary":"A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. CISA added CVE-2021-1789 to its Known Exploited Vulnerabilities catalog on May 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-843"],"title":"Apple Multiple Products Type Confusion Vulnerability (CVE-2021-1789)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-1789","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-05-18","cveIds":["CVE-2019-8506"],"exploited":"in-the-wild","identifiers":["CVE-2019-8506"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2019-8506.json","latestUpdate":{"date":"2022-05-04","title":"CISA added CVE-2019-8506 to the Known Exploited Vulnerabilities catalog (federal remediation due May 25, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2019-8506","stacks":[],"startedAt":"2022-05-04","status":"closed","summary":"A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. CISA added CVE-2019-8506 to its Known Exploited Vulnerabilities catalog on May 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-843"],"title":"Apple Multiple Products Type Confusion Vulnerability (CVE-2019-8506)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2019-8506","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-05-18","cveIds":["CVE-2014-4113"],"exploited":"in-the-wild","identifiers":["CVE-2014-4113"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2014-4113.json","latestUpdate":{"date":"2022-05-04","title":"CISA added CVE-2014-4113 to the Known Exploited Vulnerabilities catalog (federal remediation due May 25, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2014-4113","stacks":["windows"],"startedAt":"2022-05-04","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2014-4113 to its Known Exploited Vulnerabilities catalog on May 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2014-4113)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2014-4113","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-05-18","cveIds":["CVE-2014-0322"],"exploited":"in-the-wild","identifiers":["CVE-2014-0322"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-0322.json","latestUpdate":{"date":"2022-05-04","title":"CISA added CVE-2014-0322 to the Known Exploited Vulnerabilities catalog (federal remediation due May 25, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2014-0322","stacks":["browser","windows"],"startedAt":"2022-05-04","status":"closed","summary":"Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code. CISA added CVE-2014-0322 to its Known Exploited Vulnerabilities catalog on May 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2014-0322)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-0322","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-05-18","cveIds":["CVE-2014-0160"],"exploited":"in-the-wild","identifiers":["CVE-2014-0160"],"json":"https://helix.ml/threat-watch/i/openssl-openssl-cve-2014-0160.json","latestUpdate":{"date":"2022-05-04","title":"CISA added CVE-2014-0160 to the Known Exploited Vulnerabilities catalog (federal remediation due May 25, 2022)"},"patchStatus":"patched","product":"OpenSSL","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"openssl-openssl-cve-2014-0160","stacks":[],"startedAt":"2022-05-04","status":"closed","summary":"The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information. CISA added CVE-2014-0160 to its Known Exploited Vulnerabilities catalog on May 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-125"],"title":"OpenSSL Information Disclosure Vulnerability (CVE-2014-0160)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/openssl-openssl-cve-2014-0160","vendor":"OpenSSL"},{"auto":true,"category":"breach","closedAt":"2022-05-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AIMWARE"],"json":"https://helix.ml/threat-watch/i/aimware-data-breach.json","latestUpdate":{"date":"2022-05-02","title":"Have I Been Pwned loaded 305K breached Aimware accounts"},"patchStatus":"no-fix-needed","product":"aimware.net","severity":"high","severityNote":"305K accounts · passwords exposed","slug":"aimware-data-breach","stacks":[],"startedAt":"2022-05-02","status":"closed","summary":"In mid-2019, the video game cheats website \"Aimware\" suffered a data breach that exposed hundreds of thousands of subscribers' personal information. Data included email and IP addresses, usernames, forum posts, private messages, website activity and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, private messages, usernames, website activity. The breach dates from Apr 28, 2019; Have I Been Pwned loaded it on May 2, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames","website-activity"],"title":"Aimware data breach: 305K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/aimware-data-breach","vendor":"Aimware"},{"auto":true,"category":"breach","closedAt":"2022-05-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PAYHERE"],"json":"https://helix.ml/threat-watch/i/payhere-data-breach.json","latestUpdate":{"date":"2022-05-02","title":"Have I Been Pwned loaded 1.6M breached PayHere accounts"},"patchStatus":"no-fix-needed","product":"payhere.lk","severity":"high","severityNote":"1.6M accounts · financial data exposed","slug":"payhere-data-breach","stacks":[],"startedAt":"2022-05-02","status":"closed","summary":"In late March 2022, the Sri Lankan payment gateway PayHere suffered a data breach that exposed more than 65GB of payment records including over 1.5M unique email addresses. The data also included IP and physical addresses, names, phone numbers, purchase histories and partially obfuscated credit card data (card type, first 6 and last 4 digits plus expiry date). A month later, PayHere published a blog on the incident titled Ensuring Integrity on PayHere Cybersecurity Incident. Exposed data: email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Mar 27, 2022; Have I Been Pwned loaded it on May 2, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"PayHere data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/payhere-data-breach","vendor":"PayHere"},{"auto":true,"category":"breach","closedAt":"2022-05-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DEVILTORRENTS"],"json":"https://helix.ml/threat-watch/i/deviltorrents-data-breach.json","latestUpdate":{"date":"2022-05-01","title":"Have I Been Pwned loaded 63K breached Devil-Torrents.pl accounts"},"patchStatus":"no-fix-needed","product":"devil-torrents.pl","severity":"high","severityNote":"63K accounts · passwords exposed","slug":"deviltorrents-data-breach","stacks":[],"startedAt":"2022-05-01","status":"closed","summary":"In early 2021, the Polish torrents website Devil-Torrents.pl suffered a data breach. A subset of the data including 63k unique email addresses and cracked passwords were subsequently socialised on a popular data breach sharing service. Exposed data: email addresses, passwords. The breach dates from Jan 4, 2021; Have I Been Pwned loaded it on May 1, 2022.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Devil-Torrents.pl data breach: 63K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/deviltorrents-data-breach","vendor":"Devil-Torrents.pl"},{"auto":true,"category":"patch","closedAt":"2022-05-09","cveIds":["CVE-2022-29464"],"exploited":"in-the-wild","identifiers":["CVE-2022-29464"],"json":"https://helix.ml/threat-watch/i/wso2-multiple-products-cve-2022-29464.json","latestUpdate":{"date":"2022-04-25","title":"CISA added CVE-2022-29464 to the Known Exploited Vulnerabilities catalog (federal remediation due May 16, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"wso2-multiple-products-cve-2022-29464","stacks":[],"startedAt":"2022-04-25","status":"closed","summary":"Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. CISA added CVE-2022-29464 to its Known Exploited Vulnerabilities catalog on Apr 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-22"],"title":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability (CVE-2022-29464)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/wso2-multiple-products-cve-2022-29464","vendor":"WSO2"},{"auto":true,"category":"patch","closedAt":"2022-05-09","cveIds":["CVE-2022-26904"],"exploited":"in-the-wild","identifiers":["CVE-2022-26904"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-26904.json","latestUpdate":{"date":"2022-04-25","title":"CISA added CVE-2022-26904 to the Known Exploited Vulnerabilities catalog (federal remediation due May 16, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-26904","stacks":["windows"],"startedAt":"2022-04-25","status":"closed","summary":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2022-26904 to its Known Exploited Vulnerabilities catalog on Apr 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-362"],"title":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability (CVE-2022-26904)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-26904","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-05-09","cveIds":["CVE-2022-21919"],"exploited":"in-the-wild","identifiers":["CVE-2022-21919"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-21919.json","latestUpdate":{"date":"2022-04-25","title":"CISA added CVE-2022-21919 to the Known Exploited Vulnerabilities catalog (federal remediation due May 16, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-21919","stacks":["windows"],"startedAt":"2022-04-25","status":"closed","summary":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2022-21919 to its Known Exploited Vulnerabilities catalog on Apr 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-1386"],"title":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability (CVE-2022-21919)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-21919","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-05-09","cveIds":["CVE-2022-0847"],"exploited":"in-the-wild","identifiers":["CVE-2022-0847"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0847.json","latestUpdate":{"date":"2022-04-25","title":"CISA added CVE-2022-0847 to the Known Exploited Vulnerabilities catalog (federal remediation due May 16, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2022-0847","stacks":["linux"],"startedAt":"2022-04-25","status":"closed","summary":"Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of \"Dirty Pipe.\". CISA added CVE-2022-0847 to its Known Exploited Vulnerabilities catalog on Apr 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-665"],"title":"Linux Kernel Privilege Escalation Vulnerability (CVE-2022-0847)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2022-0847","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-05-09","cveIds":["CVE-2021-41357"],"exploited":"in-the-wild","identifiers":["CVE-2021-41357"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-41357.json","latestUpdate":{"date":"2022-04-25","title":"CISA added CVE-2021-41357 to the Known Exploited Vulnerabilities catalog (federal remediation due May 16, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2021-41357","stacks":["windows"],"startedAt":"2022-04-25","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-41357 to its Known Exploited Vulnerabilities catalog on Apr 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2021-41357)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-41357","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-05-09","cveIds":["CVE-2021-40450"],"exploited":"in-the-wild","identifiers":["CVE-2021-40450"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-40450.json","latestUpdate":{"date":"2022-04-25","title":"CISA added CVE-2021-40450 to the Known Exploited Vulnerabilities catalog (federal remediation due May 16, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2021-40450","stacks":["windows"],"startedAt":"2022-04-25","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-40450 to its Known Exploited Vulnerabilities catalog on Apr 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2021-40450)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-40450","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-05-09","cveIds":["CVE-2019-1003029"],"exploited":"in-the-wild","identifiers":["CVE-2019-1003029"],"json":"https://helix.ml/threat-watch/i/jenkins-script-security-plugin-cve-2019-1003029.json","latestUpdate":{"date":"2022-04-25","title":"CISA added CVE-2019-1003029 to the Known Exploited Vulnerabilities catalog (federal remediation due May 16, 2022)"},"patchStatus":"patched","product":"Script Security Plugin","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"jenkins-script-security-plugin-cve-2019-1003029","stacks":["devtools"],"startedAt":"2022-04-25","status":"closed","summary":"Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox. CISA added CVE-2019-1003029 to its Known Exploited Vulnerabilities catalog on Apr 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Jenkins Script Security Plugin Sandbox Bypass Vulnerability (CVE-2019-1003029)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/jenkins-script-security-plugin-cve-2019-1003029","vendor":"Jenkins"},{"auto":true,"category":"patch","closedAt":"2022-05-03","cveIds":["CVE-2018-6882"],"exploited":"in-the-wild","identifiers":["CVE-2018-6882"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2018-6882.json","latestUpdate":{"date":"2022-04-19","title":"CISA added CVE-2018-6882 to the Known Exploited Vulnerabilities catalog (federal remediation due May 10, 2022)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2018-6882","stacks":[],"startedAt":"2022-04-19","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML. CISA added CVE-2018-6882 to its Known Exploited Vulnerabilities catalog on Apr 19, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","xss","cwe-79"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2018-6882)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2018-6882","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2022-05-03","cveIds":["CVE-2019-3568"],"exploited":"in-the-wild","identifiers":["CVE-2019-3568"],"json":"https://helix.ml/threat-watch/i/meta-platforms-whatsapp-cve-2019-3568.json","latestUpdate":{"date":"2022-04-19","title":"CISA added CVE-2019-3568 to the Known Exploited Vulnerabilities catalog (federal remediation due May 10, 2022)"},"patchStatus":"patched","product":"WhatsApp","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"meta-platforms-whatsapp-cve-2019-3568","stacks":[],"startedAt":"2022-04-19","status":"closed","summary":"A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. CISA added CVE-2019-3568 to its Known Exploited Vulnerabilities catalog on Apr 19, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-122"],"title":"WhatsApp VOIP Stack Buffer Overflow Vulnerability (CVE-2019-3568)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/meta-platforms-whatsapp-cve-2019-3568","vendor":"Meta Platforms"},{"auto":true,"category":"patch","closedAt":"2022-05-03","cveIds":["CVE-2022-22718"],"exploited":"in-the-wild","identifiers":["CVE-2022-22718"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-22718.json","latestUpdate":{"date":"2022-04-19","title":"CISA added CVE-2022-22718 to the Known Exploited Vulnerabilities catalog (federal remediation due May 10, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-22718","stacks":["windows"],"startedAt":"2022-04-19","status":"closed","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation. CISA added CVE-2022-22718 to its Known Exploited Vulnerabilities catalog on Apr 19, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability (CVE-2022-22718)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-22718","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2022-22960"],"exploited":"in-the-wild","identifiers":["CVE-2022-22960"],"json":"https://helix.ml/threat-watch/i/vmware-multiple-products-cve-2022-22960.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2022-22960 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-multiple-products-cve-2022-22960","stacks":["cloud"],"startedAt":"2022-04-15","status":"closed","summary":"VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. CISA added CVE-2022-22960 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-250"],"title":"VMware Multiple Products Privilege Escalation Vulnerability (CVE-2022-22960)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/vmware-multiple-products-cve-2022-22960","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2022-1364"],"exploited":"in-the-wild","identifiers":["CVE-2022-1364"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-1364.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2022-1364 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2022-1364","stacks":["browser"],"startedAt":"2022-04-15","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-1364 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2022-1364)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-1364","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2019-3929"],"exploited":"in-the-wild","identifiers":["CVE-2019-3929"],"json":"https://helix.ml/threat-watch/i/crestron-multiple-products-cve-2019-3929.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2019-3929 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"crestron-multiple-products-cve-2019-3929","stacks":[],"startedAt":"2022-04-15","status":"closed","summary":"Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root. CISA added CVE-2019-3929 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-79"],"title":"Crestron Multiple Products Command Injection Vulnerability (CVE-2019-3929)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/crestron-multiple-products-cve-2019-3929","vendor":"Crestron"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2019-16057"],"exploited":"in-the-wild","identifiers":["CVE-2019-16057"],"json":"https://helix.ml/threat-watch/i/d-link-dns-320-storage-device-cve-2019-16057.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2019-16057 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"unpatched","product":"DNS-320 Storage Device","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dns-320-storage-device-cve-2019-16057","stacks":["network"],"startedAt":"2022-04-15","status":"closed","summary":"The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution. CISA added CVE-2019-16057 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"D-Link DNS-320 Remote Code Execution Vulnerability (CVE-2019-16057)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-dns-320-storage-device-cve-2019-16057","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2018-7841"],"exploited":"in-the-wild","identifiers":["CVE-2018-7841"],"json":"https://helix.ml/threat-watch/i/schneider-electric-u-motion-builder-cve-2018-7841.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2018-7841 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"unpatched","product":"U.motion Builder","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"schneider-electric-u-motion-builder-cve-2018-7841","stacks":[],"startedAt":"2022-04-15","status":"closed","summary":"A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered. CISA added CVE-2018-7841 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Schneider Electric U.motion Builder SQL Injection Vulnerability (CVE-2018-7841)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/schneider-electric-u-motion-builder-cve-2018-7841","vendor":"Schneider Electric"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2016-4523"],"exploited":"in-the-wild","identifiers":["CVE-2016-4523"],"json":"https://helix.ml/threat-watch/i/trihedral-vtscada-formerly-vts-cve-2016-4523.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2016-4523 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"patched","product":"VTScada (formerly VTS)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"trihedral-vtscada-formerly-vts-cve-2016-4523","stacks":[],"startedAt":"2022-04-15","status":"closed","summary":"The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS). CISA added CVE-2016-4523 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability (CVE-2016-4523)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/trihedral-vtscada-formerly-vts-cve-2016-4523","vendor":"Trihedral"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2014-0780"],"exploited":"in-the-wild","identifiers":["CVE-2014-0780"],"json":"https://helix.ml/threat-watch/i/indusoft-web-studio-cve-2014-0780.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2014-0780 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"patched","product":"Web Studio","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"indusoft-web-studio-cve-2014-0780","stacks":[],"startedAt":"2022-04-15","status":"closed","summary":"InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution. CISA added CVE-2014-0780 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"InduSoft Web Studio NTWebServer Directory Traversal Vulnerability (CVE-2014-0780)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/indusoft-web-studio-cve-2014-0780","vendor":"InduSoft"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2010-5330"],"exploited":"in-the-wild","identifiers":["CVE-2010-5330"],"json":"https://helix.ml/threat-watch/i/ubiquiti-airos-cve-2010-5330.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2010-5330 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"patched","product":"AirOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ubiquiti-airos-cve-2010-5330","stacks":["network"],"startedAt":"2022-04-15","status":"closed","summary":"Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi. CISA added CVE-2010-5330 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Ubiquiti AirOS Command Injection Vulnerability (CVE-2010-5330)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/ubiquiti-airos-cve-2010-5330","vendor":"Ubiquiti"},{"auto":true,"category":"patch","closedAt":"2022-04-29","cveIds":["CVE-2007-3010"],"exploited":"in-the-wild","identifiers":["CVE-2007-3010"],"json":"https://helix.ml/threat-watch/i/alcatel-omnipcx-enterprise-cve-2007-3010.json","latestUpdate":{"date":"2022-04-15","title":"CISA added CVE-2007-3010 to the Known Exploited Vulnerabilities catalog (federal remediation due May 6, 2022)"},"patchStatus":"patched","product":"OmniPCX Enterprise","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"alcatel-omnipcx-enterprise-cve-2007-3010","stacks":[],"startedAt":"2022-04-15","status":"closed","summary":"masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands. CISA added CVE-2007-3010 to its Known Exploited Vulnerabilities catalog on Apr 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability (CVE-2007-3010)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/alcatel-omnipcx-enterprise-cve-2007-3010","vendor":"Alcatel"},{"auto":true,"category":"breach","closedAt":"2022-04-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AVVO"],"json":"https://helix.ml/threat-watch/i/avvo-data-breach.json","latestUpdate":{"date":"2022-04-15","title":"Have I Been Pwned loaded 4.1M breached Avvo accounts"},"patchStatus":"no-fix-needed","product":"avvo.com","severity":"high","severityNote":"4.1M accounts · passwords exposed","slug":"avvo-data-breach","stacks":[],"startedAt":"2022-04-15","status":"closed","summary":"In approximately December 2019, an alleged data breach of the lawyer directory service Avvo was published to an online hacking forum and used in an extortion scam (it's possible the exposure dates back earlier than that). The data contained 4.1M unique email addresses alongside SHA-1 hashes, most likely representing user passwords. Multiple attempts at contacting Avvo over the course of a week were unsuccessful and the authenticity of the data was eventually verified with common Avvo and HIBP subscribers. Exposed data: email addresses, passwords. The breach dates from Dec 17, 2019; Have I Been Pwned loaded it on Apr 15, 2022.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Avvo data breach: 4.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/avvo-data-breach","vendor":"Avvo"},{"auto":true,"category":"patch","closedAt":"2022-04-28","cveIds":["CVE-2022-22954"],"exploited":"in-the-wild","identifiers":["CVE-2022-22954"],"json":"https://helix.ml/threat-watch/i/vmware-workspace-one-access-and-identity-manager-cve-2022-22954.json","latestUpdate":{"date":"2022-04-14","title":"CISA added CVE-2022-22954 to the Known Exploited Vulnerabilities catalog (federal remediation due May 5, 2022)"},"patchStatus":"patched","product":"Workspace ONE Access and Identity Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-workspace-one-access-and-identity-manager-cve-2022-22954","stacks":["cloud"],"startedAt":"2022-04-14","status":"closed","summary":"VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. CISA added CVE-2022-22954 to its Known Exploited Vulnerabilities catalog on Apr 14, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability (CVE-2022-22954)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/vmware-workspace-one-access-and-identity-manager-cve-2022-22954","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2022-24521"],"exploited":"in-the-wild","identifiers":["CVE-2022-24521"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-24521.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2022-24521 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-24521","stacks":["windows"],"startedAt":"2022-04-13","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2022-24521 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-787","cwe-1285"],"title":"Microsoft Windows CLFS Driver Privilege Escalation Vulnerability (CVE-2022-24521)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-24521","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2018-7602"],"exploited":"in-the-wild","identifiers":["CVE-2018-7602"],"json":"https://helix.ml/threat-watch/i/drupal-core-cve-2018-7602.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2018-7602 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"patched","product":"Core","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"drupal-core-cve-2018-7602","stacks":["php"],"startedAt":"2022-04-13","status":"closed","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. CISA added CVE-2018-7602 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Drupal Core Remote Code Execution Vulnerability (CVE-2018-7602)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/drupal-core-cve-2018-7602","vendor":"Drupal"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2018-20753"],"exploited":"in-the-wild","identifiers":["CVE-2018-20753"],"json":"https://helix.ml/threat-watch/i/kaseya-virtual-system-server-administrator-vsa-cve-2018-20753.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2018-20753 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"patched","product":"Virtual System/Server Administrator (VSA)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"kaseya-virtual-system-server-administrator-vsa-cve-2018-20753","stacks":[],"startedAt":"2022-04-13","status":"closed","summary":"Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. CISA added CVE-2018-20753 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Kaseya VSA Remote Code Execution Vulnerability (CVE-2018-20753)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/kaseya-virtual-system-server-administrator-vsa-cve-2018-20753","vendor":"Kaseya"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2015-5123"],"exploited":"in-the-wild","identifiers":["CVE-2015-5123"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-5123.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2015-5123 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-5123","stacks":[],"startedAt":"2022-04-13","status":"closed","summary":"Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). CISA added CVE-2015-5123 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-5123)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-5123","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2015-5122"],"exploited":"in-the-wild","identifiers":["CVE-2015-5122"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-5122.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2015-5122 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-5122","stacks":[],"startedAt":"2022-04-13","status":"closed","summary":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). CISA added CVE-2015-5122 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-5122)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-5122","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2015-3113"],"exploited":"in-the-wild","identifiers":["CVE-2015-3113"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-3113.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2015-3113 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-3113","stacks":[],"startedAt":"2022-04-13","status":"closed","summary":"Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code. CISA added CVE-2015-3113 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Adobe Flash Player Heap-Based Buffer Overflow Vulnerability (CVE-2015-3113)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-3113","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2015-2502"],"exploited":"in-the-wild","identifiers":["CVE-2015-2502"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-2502.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2015-2502 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2015-2502","stacks":["browser","windows"],"startedAt":"2022-04-13","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS). CISA added CVE-2015-2502 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-2502)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-2502","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2015-0313"],"exploited":"in-the-wild","identifiers":["CVE-2015-0313"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-0313.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2015-0313 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-0313","stacks":[],"startedAt":"2022-04-13","status":"closed","summary":"Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code. CISA added CVE-2015-0313 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-0313)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-0313","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2015-0311"],"exploited":"in-the-wild","identifiers":["CVE-2015-0311"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-0311.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2015-0311 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-0311","stacks":[],"startedAt":"2022-04-13","status":"closed","summary":"Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code. CISA added CVE-2015-0311 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Adobe Flash Player Remote Code Execution Vulnerability (CVE-2015-0311)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-0311","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-27","cveIds":["CVE-2014-9163"],"exploited":"in-the-wild","identifiers":["CVE-2014-9163"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-9163.json","latestUpdate":{"date":"2022-04-13","title":"CISA added CVE-2014-9163 to the Known Exploited Vulnerabilities catalog (federal remediation due May 4, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2014-9163","stacks":[],"startedAt":"2022-04-13","status":"closed","summary":"Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely. CISA added CVE-2014-9163 to its Known Exploited Vulnerabilities catalog on Apr 13, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption"],"title":"Adobe Flash Player Stack-Based Buffer Overflow Vulnerability (CVE-2014-9163)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2014-9163","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2022-23176"],"exploited":"in-the-wild","identifiers":["CVE-2022-23176"],"json":"https://helix.ml/threat-watch/i/watchguard-firebox-and-xtm-cve-2022-23176.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2022-23176 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"patched","product":"Firebox and XTM","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"watchguard-firebox-and-xtm-cve-2022-23176","stacks":[],"startedAt":"2022-04-11","status":"closed","summary":"WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. CISA added CVE-2022-23176 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"WatchGuard Firebox and XTM Privilege Escalation Vulnerability (CVE-2022-23176)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/watchguard-firebox-and-xtm-cve-2022-23176","vendor":"WatchGuard"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2021-42287"],"exploited":"in-the-wild","identifiers":["CVE-2021-42287"],"json":"https://helix.ml/threat-watch/i/microsoft-active-directory-cve-2021-42287.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2021-42287 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"patched","product":"Active Directory","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-active-directory-cve-2021-42287","stacks":[],"startedAt":"2022-04-11","status":"closed","summary":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-42287 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-269"],"title":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2021-42287)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-active-directory-cve-2021-42287","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2021-42278"],"exploited":"in-the-wild","identifiers":["CVE-2021-42278"],"json":"https://helix.ml/threat-watch/i/microsoft-active-directory-cve-2021-42278.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2021-42278 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"patched","product":"Active Directory","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-active-directory-cve-2021-42278","stacks":[],"startedAt":"2022-04-11","status":"closed","summary":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-42278 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-20"],"title":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2021-42278)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-active-directory-cve-2021-42278","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2021-39793"],"exploited":"in-the-wild","identifiers":["CVE-2021-39793"],"json":"https://helix.ml/threat-watch/i/google-pixel-cve-2021-39793.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2021-39793 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"patched","product":"Pixel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-pixel-cve-2021-39793","stacks":["android"],"startedAt":"2022-04-11","status":"closed","summary":"Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege. CISA added CVE-2021-39793 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Pixel Out-of-Bounds Write Vulnerability (CVE-2021-39793)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-pixel-cve-2021-39793","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2021-27852"],"exploited":"in-the-wild","identifiers":["CVE-2021-27852"],"json":"https://helix.ml/threat-watch/i/checkbox-checkbox-survey-cve-2021-27852.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2021-27852 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"unpatched","product":"Checkbox Survey","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"checkbox-checkbox-survey-cve-2021-27852","stacks":["rust"],"startedAt":"2022-04-11","status":"closed","summary":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. CISA added CVE-2021-27852 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Checkbox Survey Deserialization of Untrusted Data Vulnerability (CVE-2021-27852)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/checkbox-checkbox-survey-cve-2021-27852","vendor":"Checkbox"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2021-22600"],"exploited":"in-the-wild","identifiers":["CVE-2021-22600"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2021-22600.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2021-22600 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2021-22600","stacks":["linux"],"startedAt":"2022-04-11","status":"closed","summary":"Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation. CISA added CVE-2021-22600 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-415"],"title":"Linux Kernel Privilege Escalation Vulnerability (CVE-2021-22600)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2021-22600","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2020-2509"],"exploited":"in-the-wild","identifiers":["CVE-2020-2509"],"json":"https://helix.ml/threat-watch/i/qnap-qnap-network-attached-storage-nas-cve-2020-2509.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2020-2509 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"patched","product":"QNAP Network-Attached Storage (NAS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-qnap-network-attached-storage-nas-cve-2020-2509","stacks":[],"startedAt":"2022-04-11","status":"closed","summary":"QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. CISA added CVE-2020-2509 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77","cwe-78"],"title":"QNAP Network-Attached Storage (NAS) Command Injection Vulnerability (CVE-2020-2509)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-qnap-network-attached-storage-nas-cve-2020-2509","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-04-25","cveIds":["CVE-2017-11317"],"exploited":"in-the-wild","identifiers":["CVE-2017-11317"],"json":"https://helix.ml/threat-watch/i/telerik-user-interface-ui-for-asp-net-ajax-cve-2017-11317.json","latestUpdate":{"date":"2022-04-11","title":"CISA added CVE-2017-11317 to the Known Exploited Vulnerabilities catalog (federal remediation due May 2, 2022)"},"patchStatus":"patched","product":"User Interface (UI) for ASP.NET AJAX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"telerik-user-interface-ui-for-asp-net-ajax-cve-2017-11317","stacks":["dotnet"],"startedAt":"2022-04-11","status":"closed","summary":"Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code. CISA added CVE-2017-11317 to its Known Exploited Vulnerabilities catalog on Apr 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-326"],"title":"Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability (CVE-2017-11317)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/telerik-user-interface-ui-for-asp-net-ajax-cve-2017-11317","vendor":"Telerik"},{"auto":true,"category":"breach","closedAt":"2022-04-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRAVELIO"],"json":"https://helix.ml/threat-watch/i/travelio-data-breach.json","latestUpdate":{"date":"2022-04-08","title":"Have I Been Pwned loaded 471K breached Travelio accounts"},"patchStatus":"no-fix-needed","product":"travelio.com","severity":"high","severityNote":"471K accounts · passwords exposed","slug":"travelio-data-breach","stacks":[],"startedAt":"2022-04-08","status":"closed","summary":"In November 2021, the Indonesian real estate website Travelio suffered a data breach that exposed over 470k customer accounts. The data included email addresses, names, password hashes, phone numbers and for some accounts, dates of birth, physical address and Facebook auth tokens. Exposed data: auth tokens, dates of birth, email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Nov 23, 2021; Have I Been Pwned loaded it on Apr 8, 2022.","tags":["data-breach","hibp","auth-tokens","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Travelio data breach: 471K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/travelio-data-breach","vendor":"Travelio"},{"auto":true,"category":"patch","closedAt":"2022-04-20","cveIds":["CVE-2021-3156"],"exploited":"in-the-wild","identifiers":["CVE-2021-3156"],"json":"https://helix.ml/threat-watch/i/sudo-sudo-cve-2021-3156.json","latestUpdate":{"date":"2022-04-06","title":"CISA added CVE-2021-3156 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2022)"},"patchStatus":"patched","product":"Sudo","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sudo-sudo-cve-2021-3156","stacks":["linux"],"startedAt":"2022-04-06","status":"closed","summary":"Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. CISA added CVE-2021-3156 to its Known Exploited Vulnerabilities catalog on Apr 6, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-122","cwe-193"],"title":"Sudo Heap-Based Buffer Overflow Vulnerability (CVE-2021-3156)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sudo-sudo-cve-2021-3156","vendor":"Sudo"},{"auto":true,"category":"patch","closedAt":"2022-04-20","cveIds":["CVE-2021-31166"],"exploited":"in-the-wild","identifiers":["CVE-2021-31166"],"json":"https://helix.ml/threat-watch/i/microsoft-http-protocol-stack-cve-2021-31166.json","latestUpdate":{"date":"2022-04-06","title":"CISA added CVE-2021-31166 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2022)"},"patchStatus":"patched","product":"HTTP Protocol Stack","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-http-protocol-stack-cve-2021-31166","stacks":[],"startedAt":"2022-04-06","status":"closed","summary":"Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. CISA added CVE-2021-31166 to its Known Exploited Vulnerabilities catalog on Apr 6, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-416"],"title":"Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2021-31166)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-http-protocol-stack-cve-2021-31166","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-20","cveIds":["CVE-2017-0148"],"exploited":"in-the-wild","identifiers":["CVE-2017-0148"],"json":"https://helix.ml/threat-watch/i/microsoft-smbv1-server-cve-2017-0148.json","latestUpdate":{"date":"2022-04-06","title":"CISA added CVE-2017-0148 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 27, 2022)"},"patchStatus":"patched","product":"SMBv1 server","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-smbv1-server-cve-2017-0148","stacks":[],"startedAt":"2022-04-06","status":"closed","summary":"The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. CISA added CVE-2017-0148 to its Known Exploited Vulnerabilities catalog on Apr 6, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Microsoft SMBv1 Server Remote Code Execution Vulnerability (CVE-2017-0148)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-smbv1-server-cve-2017-0148","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-18","cveIds":["CVE-2022-22965"],"exploited":"in-the-wild","identifiers":["CVE-2022-22965"],"json":"https://helix.ml/threat-watch/i/vmware-spring-framework-cve-2022-22965.json","latestUpdate":{"date":"2022-04-04","title":"CISA added CVE-2022-22965 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 25, 2022)"},"patchStatus":"patched","product":"Spring Framework","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-spring-framework-cve-2022-22965","stacks":["cloud","java"],"startedAt":"2022-04-04","status":"closed","summary":"Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. CISA added CVE-2022-22965 to its Known Exploited Vulnerabilities catalog on Apr 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Spring Framework JDK 9+ Remote Code Execution Vulnerability (CVE-2022-22965)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/vmware-spring-framework-cve-2022-22965","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2022-04-18","cveIds":["CVE-2022-22675"],"exploited":"in-the-wild","identifiers":["CVE-2022-22675"],"json":"https://helix.ml/threat-watch/i/apple-macos-cve-2022-22675.json","latestUpdate":{"date":"2022-04-04","title":"CISA added CVE-2022-22675 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 25, 2022)"},"patchStatus":"patched","product":"macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-macos-cve-2022-22675","stacks":["macos"],"startedAt":"2022-04-04","status":"closed","summary":"macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges. CISA added CVE-2022-22675 to its Known Exploited Vulnerabilities catalog on Apr 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-20","cwe-125"],"title":"Apple macOS Out-of-Bounds Write Vulnerability (CVE-2022-22675)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-macos-cve-2022-22675","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-04-18","cveIds":["CVE-2022-22674"],"exploited":"in-the-wild","identifiers":["CVE-2022-22674"],"json":"https://helix.ml/threat-watch/i/apple-macos-cve-2022-22674.json","latestUpdate":{"date":"2022-04-04","title":"CISA added CVE-2022-22674 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 25, 2022)"},"patchStatus":"patched","product":"macOS","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-macos-cve-2022-22674","stacks":["macos"],"startedAt":"2022-04-04","status":"closed","summary":"macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. CISA added CVE-2022-22674 to its Known Exploited Vulnerabilities catalog on Apr 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-20","cwe-125"],"title":"Apple macOS Out-of-Bounds Read Vulnerability (CVE-2022-22674)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apple-macos-cve-2022-22674","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-04-18","cveIds":["CVE-2021-45382"],"exploited":"in-the-wild","identifiers":["CVE-2021-45382"],"json":"https://helix.ml/threat-watch/i/d-link-multiple-routers-cve-2021-45382.json","latestUpdate":{"date":"2022-04-04","title":"CISA added CVE-2021-45382 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 25, 2022)"},"patchStatus":"unpatched","product":"Multiple Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-multiple-routers-cve-2021-45382","stacks":["network"],"startedAt":"2022-04-04","status":"closed","summary":"A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file. CISA added CVE-2021-45382 to its Known Exploited Vulnerabilities catalog on Apr 4, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"D-Link Multiple Routers Remote Code Execution Vulnerability (CVE-2021-45382)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-multiple-routers-cve-2021-45382","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-04-14","cveIds":["CVE-2022-26871"],"exploited":"in-the-wild","identifiers":["CVE-2022-26871"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-central-cve-2022-26871.json","latestUpdate":{"date":"2022-03-31","title":"CISA added CVE-2022-26871 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"patched","product":"Apex Central","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-central-cve-2022-26871","stacks":[],"startedAt":"2022-03-31","status":"closed","summary":"An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution. CISA added CVE-2022-26871 to its Known Exploited Vulnerabilities catalog on Mar 31, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-184"],"title":"Trend Micro Apex Central Arbitrary File Upload Vulnerability (CVE-2022-26871)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-central-cve-2022-26871","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2022-04-14","cveIds":["CVE-2022-1040"],"exploited":"in-the-wild","identifiers":["CVE-2022-1040"],"json":"https://helix.ml/threat-watch/i/sophos-firewall-cve-2022-1040.json","latestUpdate":{"date":"2022-03-31","title":"CISA added CVE-2022-1040 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"patched","product":"Firewall","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sophos-firewall-cve-2022-1040","stacks":["network"],"startedAt":"2022-03-31","status":"closed","summary":"An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. CISA added CVE-2022-1040 to its Known Exploited Vulnerabilities catalog on Mar 31, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-158"],"title":"Sophos Firewall Authentication Bypass Vulnerability (CVE-2022-1040)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sophos-firewall-cve-2022-1040","vendor":"Sophos"},{"auto":true,"category":"patch","closedAt":"2022-04-14","cveIds":["CVE-2021-34484"],"exploited":"in-the-wild","identifiers":["CVE-2021-34484"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34484.json","latestUpdate":{"date":"2022-03-31","title":"CISA added CVE-2021-34484 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-34484","stacks":["windows"],"startedAt":"2022-03-31","status":"closed","summary":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-34484 to its Known Exploited Vulnerabilities catalog on Mar 31, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-269"],"title":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability (CVE-2021-34484)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34484","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-14","cveIds":["CVE-2021-28799"],"exploited":"in-the-wild","identifiers":["CVE-2021-28799"],"json":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2021-28799.json","latestUpdate":{"date":"2022-03-31","title":"CISA added CVE-2021-28799 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"patched","product":"Network Attached Storage (NAS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-network-attached-storage-nas-cve-2021-28799","stacks":[],"startedAt":"2022-03-31","status":"closed","summary":"QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. CISA added CVE-2021-28799 to its Known Exploited Vulnerabilities catalog on Mar 31, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-285"],"title":"QNAP NAS Improper Authorization Vulnerability (CVE-2021-28799)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/qnap-network-attached-storage-nas-cve-2021-28799","vendor":"QNAP"},{"auto":true,"category":"patch","closedAt":"2022-04-14","cveIds":["CVE-2021-21551"],"exploited":"in-the-wild","identifiers":["CVE-2021-21551"],"json":"https://helix.ml/threat-watch/i/dell-dbutil-driver-cve-2021-21551.json","latestUpdate":{"date":"2022-03-31","title":"CISA added CVE-2021-21551 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"patched","product":"dbutil Driver","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"dell-dbutil-driver-cve-2021-21551","stacks":[],"startedAt":"2022-03-31","status":"closed","summary":"Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure. CISA added CVE-2021-21551 to its Known Exploited Vulnerabilities catalog on Mar 31, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-782"],"title":"Dell dbutil Driver Insufficient Access Control Vulnerability (CVE-2021-21551)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/dell-dbutil-driver-cve-2021-21551","vendor":"Dell"},{"auto":true,"category":"patch","closedAt":"2022-04-14","cveIds":["CVE-2018-10562"],"exploited":"in-the-wild","identifiers":["CVE-2018-10562"],"json":"https://helix.ml/threat-watch/i/dasan-gigabit-passive-optical-network-gpon-routers-cve-2018-10562.json","latestUpdate":{"date":"2022-03-31","title":"CISA added CVE-2018-10562 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"unpatched","product":"Gigabit Passive Optical Network (GPON) Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"dasan-gigabit-passive-optical-network-gpon-routers-cve-2018-10562","stacks":["network"],"startedAt":"2022-03-31","status":"closed","summary":"Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution. CISA added CVE-2018-10562 to its Known Exploited Vulnerabilities catalog on Mar 31, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","auth-bypass","cwe-78"],"title":"Dasan GPON Routers Command Injection Vulnerability (CVE-2018-10562)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/dasan-gigabit-passive-optical-network-gpon-routers-cve-2018-10562","vendor":"Dasan"},{"auto":true,"category":"patch","closedAt":"2022-04-14","cveIds":["CVE-2018-10561"],"exploited":"in-the-wild","identifiers":["CVE-2018-10561"],"json":"https://helix.ml/threat-watch/i/dasan-gigabit-passive-optical-network-gpon-routers-cve-2018-10561.json","latestUpdate":{"date":"2022-03-31","title":"CISA added CVE-2018-10561 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"unpatched","product":"Gigabit Passive Optical Network (GPON) Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"dasan-gigabit-passive-optical-network-gpon-routers-cve-2018-10561","stacks":["network"],"startedAt":"2022-03-31","status":"closed","summary":"Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution. CISA added CVE-2018-10561 to its Known Exploited Vulnerabilities catalog on Mar 31, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-287"],"title":"Dasan GPON Routers Authentication Bypass Vulnerability (CVE-2018-10561)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/dasan-gigabit-passive-optical-network-gpon-routers-cve-2018-10561","vendor":"Dasan"},{"auto":true,"category":"breach","closedAt":"2022-04-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROYALENFIELD"],"json":"https://helix.ml/threat-watch/i/royalenfield-data-breach.json","latestUpdate":{"date":"2022-03-31","title":"Have I Been Pwned loaded 420K breached Royal Enfield accounts"},"patchStatus":"no-fix-needed","product":"royalenfield.com","severity":"high","severityNote":"420K accounts · passwords exposed","slug":"royalenfield-data-breach","stacks":[],"startedAt":"2022-03-31","status":"closed","summary":"In January 2020, motorcycle maker Royal Enfield left a database publicly exposed that resulted in the inadvertent publication of over 400k customers. The impacted data included email and physical addresses, names, motorcycle information, social media profiles, passwords, and other personal information. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, social media profiles, vehicle details. The breach dates from Jan 1, 2019; Have I Been Pwned loaded it on Mar 31, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","social-media-profiles","vehicle-details"],"title":"Royal Enfield data breach: 420K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/royalenfield-data-breach","vendor":"Royal Enfield"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2022-1096"],"exploited":"in-the-wild","identifiers":["CVE-2022-1096"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-1096.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2022-1096 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2022-1096","stacks":["browser"],"startedAt":"2022-03-28","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-1096 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2022-1096)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2022-1096","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2022-0543"],"exploited":"in-the-wild","identifiers":["CVE-2022-0543"],"json":"https://helix.ml/threat-watch/i/redis-debian-specific-redis-servers-cve-2022-0543.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2022-0543 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Debian-specific Redis Servers","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"redis-debian-specific-redis-servers-cve-2022-0543","stacks":["database","linux"],"startedAt":"2022-03-28","status":"closed","summary":"Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. CISA added CVE-2022-0543 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-862"],"title":"Debian-specific Redis Server Lua Sandbox Escape Vulnerability (CVE-2022-0543)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/redis-debian-specific-redis-servers-cve-2022-0543","vendor":"Redis"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2021-38646"],"exploited":"in-the-wild","identifiers":["CVE-2021-38646"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2021-38646.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2021-38646 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2021-38646","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution. CISA added CVE-2021-38646 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability (CVE-2021-38646)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2021-38646","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2021-34486"],"exploited":"in-the-wild","identifiers":["CVE-2021-34486"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34486.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2021-34486 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-34486","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation. CISA added CVE-2021-34486 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Microsoft Windows Event Tracing Privilege Escalation Vulnerability (CVE-2021-34486)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34486","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2021-26085"],"exploited":"in-the-wild","identifiers":["CVE-2021-26085"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-server-cve-2021-26085.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2021-26085 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Confluence Server","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-server-cve-2021-26085","stacks":["devtools","java"],"startedAt":"2022-03-28","status":"closed","summary":"Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. CISA added CVE-2021-26085 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-425"],"title":"Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability (CVE-2021-26085)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-server-cve-2021-26085","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2021-20028"],"exploited":"in-the-wild","identifiers":["CVE-2021-20028"],"json":"https://helix.ml/threat-watch/i/sonicwall-secure-remote-access-sra-cve-2021-20028.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2021-20028 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"unpatched","product":"Secure Remote Access (SRA)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-secure-remote-access-sra-cve-2021-20028","stacks":["vpn"],"startedAt":"2022-03-28","status":"closed","summary":"SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection. CISA added CVE-2021-20028 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability (CVE-2021-20028)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sonicwall-secure-remote-access-sra-cve-2021-20028","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2019-7483"],"exploited":"in-the-wild","identifiers":["CVE-2019-7483"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma100-cve-2019-7483.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2019-7483 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"SMA100","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma100-cve-2019-7483","stacks":["vpn"],"startedAt":"2022-03-28","status":"closed","summary":"In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. CISA added CVE-2019-7483 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"SonicWall SMA100 Directory Traversal Vulnerability (CVE-2019-7483)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma100-cve-2019-7483","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2018-8440"],"exploited":"in-the-wild","identifiers":["CVE-2018-8440"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8440.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2018-8440 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2018-8440","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). CISA added CVE-2018-8440 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2018-8440)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8440","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2018-8406"],"exploited":"in-the-wild","identifiers":["CVE-2018-8406"],"json":"https://helix.ml/threat-watch/i/microsoft-directx-graphics-kernel-dxgkrnl-cve-2018-8406.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2018-8406 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"DirectX Graphics Kernel (DXGKRNL)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-directx-graphics-kernel-dxgkrnl-cve-2018-8406","stacks":["linux"],"startedAt":"2022-03-28","status":"closed","summary":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. CISA added CVE-2018-8406 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-404"],"title":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability (CVE-2018-8406)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-directx-graphics-kernel-dxgkrnl-cve-2018-8406","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2018-8405"],"exploited":"in-the-wild","identifiers":["CVE-2018-8405"],"json":"https://helix.ml/threat-watch/i/microsoft-directx-graphics-kernel-dxgkrnl-cve-2018-8405.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2018-8405 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"DirectX Graphics Kernel (DXGKRNL)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-directx-graphics-kernel-dxgkrnl-cve-2018-8405","stacks":["linux"],"startedAt":"2022-03-28","status":"closed","summary":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. CISA added CVE-2018-8405 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-404"],"title":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability (CVE-2018-8405)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-directx-graphics-kernel-dxgkrnl-cve-2018-8405","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2017-0213"],"exploited":"in-the-wild","identifiers":["CVE-2017-0213"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0213.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2017-0213 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2017-0213","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application. CISA added CVE-2017-0213 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2017-0213)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0213","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2017-0059"],"exploited":"in-the-wild","identifiers":["CVE-2017-0059"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0059.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2017-0059 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2017-0059","stacks":["browser","windows"],"startedAt":"2022-03-28","status":"closed","summary":"Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site. CISA added CVE-2017-0059 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2017-0059)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0059","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2017-0037"],"exploited":"in-the-wild","identifiers":["CVE-2017-0037"],"json":"https://helix.ml/threat-watch/i/microsoft-edge-and-internet-explorer-cve-2017-0037.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2017-0037 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Edge and Internet Explorer","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-edge-and-internet-explorer-cve-2017-0037","stacks":["browser","windows"],"startedAt":"2022-03-28","status":"closed","summary":"Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution. CISA added CVE-2017-0037 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-704"],"title":"Microsoft Edge and Internet Explorer Type Confusion Vulnerability (CVE-2017-0037)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-edge-and-internet-explorer-cve-2017-0037","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2016-7201"],"exploited":"in-the-wild","identifiers":["CVE-2016-7201"],"json":"https://helix.ml/threat-watch/i/microsoft-edge-cve-2016-7201.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2016-7201 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Edge","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-edge-cve-2016-7201","stacks":["browser"],"startedAt":"2022-03-28","status":"closed","summary":"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CISA added CVE-2016-7201 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Edge Memory Corruption Vulnerability (CVE-2016-7201)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-edge-cve-2016-7201","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2016-7200"],"exploited":"in-the-wild","identifiers":["CVE-2016-7200"],"json":"https://helix.ml/threat-watch/i/microsoft-edge-cve-2016-7200.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2016-7200 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Edge","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-edge-cve-2016-7200","stacks":["browser"],"startedAt":"2022-03-28","status":"closed","summary":"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CISA added CVE-2016-7200 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Edge Memory Corruption Vulnerability (CVE-2016-7200)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-edge-cve-2016-7200","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2016-0189"],"exploited":"in-the-wild","identifiers":["CVE-2016-0189"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2016-0189.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2016-0189 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2016-0189","stacks":["browser","windows"],"startedAt":"2022-03-28","status":"closed","summary":"The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CISA added CVE-2016-0189 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-119"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2016-0189)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2016-0189","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2016-0151"],"exploited":"in-the-wild","identifiers":["CVE-2016-0151"],"json":"https://helix.ml/threat-watch/i/microsoft-client-server-run-time-subsystem-csrss-cve-2016-0151.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2016-0151 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Client-Server Run-time Subsystem (CSRSS)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-client-server-run-time-subsystem-csrss-cve-2016-0151","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application. CISA added CVE-2016-0151 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-264"],"title":"Microsoft Windows CSRSS Security Feature Bypass Vulnerability (CVE-2016-0151)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-client-server-run-time-subsystem-csrss-cve-2016-0151","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2016-0040"],"exploited":"in-the-wild","identifiers":["CVE-2016-0040"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-0040.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2016-0040 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2016-0040","stacks":["linux","windows"],"startedAt":"2022-03-28","status":"closed","summary":"The kernel in Microsoft Windows allows local users to gain privileges via a crafted application. CISA added CVE-2016-0040 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2016-0040)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-0040","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2015-2426"],"exploited":"in-the-wild","identifiers":["CVE-2015-2426"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-2426.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2015-2426 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2015-2426","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts. CISA added CVE-2015-2426 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability (CVE-2015-2426)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2015-2426","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2015-2419"],"exploited":"in-the-wild","identifiers":["CVE-2015-2419"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-2419.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2015-2419 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2015-2419","stacks":["browser","windows"],"startedAt":"2022-03-28","status":"closed","summary":"JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CISA added CVE-2015-2419 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-2419)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2015-2419","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2015-1770"],"exploited":"in-the-wild","identifiers":["CVE-2015-1770"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-1770.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2015-1770 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2015-1770","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document. CISA added CVE-2015-1770 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-19"],"title":"Microsoft Office Uninitialized Memory Use Vulnerability (CVE-2015-1770)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-1770","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2013-3660"],"exploited":"in-the-wild","identifiers":["CVE-2013-3660"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2013-3660.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2013-3660 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2013-3660","stacks":["windows"],"startedAt":"2022-03-28","status":"closed","summary":"The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges. CISA added CVE-2013-3660 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-119"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2013-3660)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2013-3660","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2013-2729"],"exploited":"in-the-wild","identifiers":["CVE-2013-2729"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2013-2729.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2013-2729 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2013-2729","stacks":[],"startedAt":"2022-03-28","status":"closed","summary":"Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code. CISA added CVE-2013-2729 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-189"],"title":"Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability (CVE-2013-2729)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2013-2729","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2013-2551"],"exploited":"in-the-wild","identifiers":["CVE-2013-2551"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-2551.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2013-2551 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2013-2551","stacks":["browser","windows"],"startedAt":"2022-03-28","status":"closed","summary":"Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object. CISA added CVE-2013-2551 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-416"],"title":"Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2013-2551)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-2551","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2013-2465"],"exploited":"in-the-wild","identifiers":["CVE-2013-2465"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2013-2465.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2013-2465 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Java SE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-cve-2013-2465","stacks":["java"],"startedAt":"2022-03-28","status":"closed","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D. CISA added CVE-2013-2465 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Oracle Java SE Unspecified Vulnerability (CVE-2013-2465)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2013-2465","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2013-1690"],"exploited":"in-the-wild","identifiers":["CVE-2013-1690"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2013-1690.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2013-1690 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Firefox and Thunderbird","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-and-thunderbird-cve-2013-1690","stacks":["browser"],"startedAt":"2022-03-28","status":"closed","summary":"Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site. CISA added CVE-2013-1690 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability (CVE-2013-1690)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2013-1690","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2012-5076"],"exploited":"in-the-wild","identifiers":["CVE-2012-5076"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-5076.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2012-5076 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Java SE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-cve-2012-5076","stacks":["java"],"startedAt":"2022-03-28","status":"closed","summary":"The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CISA added CVE-2012-5076 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle Java SE Sandbox Bypass Vulnerability (CVE-2012-5076)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-5076","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2012-2539"],"exploited":"in-the-wild","identifiers":["CVE-2012-2539"],"json":"https://helix.ml/threat-watch/i/microsoft-word-cve-2012-2539.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2012-2539 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Word","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-word-cve-2012-2539","stacks":[],"startedAt":"2022-03-28","status":"closed","summary":"Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data. CISA added CVE-2012-2539 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-399"],"title":"Microsoft Word Remote Code Execution Vulnerability (CVE-2012-2539)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-word-cve-2012-2539","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2012-2034"],"exploited":"in-the-wild","identifiers":["CVE-2012-2034"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-2034.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2012-2034 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2012-2034","stacks":[],"startedAt":"2022-03-28","status":"closed","summary":"Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS). CISA added CVE-2012-2034 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Adobe Flash Player Memory Corruption Vulnerability (CVE-2012-2034)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-2034","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2012-0518"],"exploited":"in-the-wild","identifiers":["CVE-2012-0518"],"json":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2012-0518.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2012-0518 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Fusion Middleware","severity":"medium","severityNote":"CVSS 4.7 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-fusion-middleware-cve-2012-0518","stacks":[],"startedAt":"2022-03-28","status":"closed","summary":"Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors. CISA added CVE-2012-0518 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-601"],"title":"Oracle Fusion Middleware Unspecified Vulnerability (CVE-2012-0518)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2012-0518","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2011-2005"],"exploited":"in-the-wild","identifiers":["CVE-2011-2005"],"json":"https://helix.ml/threat-watch/i/microsoft-ancillary-function-driver-afd-sys-cve-2011-2005.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2011-2005 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 18, 2022)"},"patchStatus":"patched","product":"Ancillary Function Driver (afd.sys)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-ancillary-function-driver-afd-sys-cve-2011-2005","stacks":[],"startedAt":"2022-03-28","status":"closed","summary":"afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application. CISA added CVE-2011-2005 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-264"],"title":"Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability (CVE-2011-2005)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-ancillary-function-driver-afd-sys-cve-2011-2005","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-11","cveIds":["CVE-2010-4398"],"exploited":"in-the-wild","identifiers":["CVE-2010-4398"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2010-4398.json","latestUpdate":{"date":"2022-03-28","title":"CISA added CVE-2010-4398 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 21, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2010-4398","stacks":["linux","windows"],"startedAt":"2022-03-28","status":"closed","summary":"Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature. CISA added CVE-2010-4398 to its Known Exploited Vulnerabilities catalog on Mar 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability (CVE-2010-4398)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2010-4398","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2016-11021"],"exploited":"in-the-wild","identifiers":["CVE-2016-11021"],"json":"https://helix.ml/threat-watch/i/d-link-dcs-930l-devices-cve-2016-11021.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2016-11021 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"unpatched","product":"DCS-930L Devices","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dcs-930l-devices-cve-2016-11021","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command. CISA added CVE-2016-11021 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"D-Link DCS-930L Devices OS Command Injection Vulnerability (CVE-2016-11021)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-dcs-930l-devices-cve-2016-11021","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2016-10174"],"exploited":"in-the-wild","identifiers":["CVE-2016-10174"],"json":"https://helix.ml/threat-watch/i/netgear-wnr2000v5-router-cve-2016-10174.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2016-10174 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"WNR2000v5 Router","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-wnr2000v5-router-cve-2016-10174","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution. CISA added CVE-2016-10174 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability (CVE-2016-10174)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/netgear-wnr2000v5-router-cve-2016-10174","vendor":"NETGEAR"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2016-0752"],"exploited":"in-the-wild","identifiers":["CVE-2016-0752"],"json":"https://helix.ml/threat-watch/i/rails-ruby-on-rails-cve-2016-0752.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2016-0752 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Ruby on Rails","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"rails-ruby-on-rails-cve-2016-0752","stacks":["ruby"],"startedAt":"2022-03-25","status":"closed","summary":"Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files. CISA added CVE-2016-0752 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Ruby on Rails Directory Traversal Vulnerability (CVE-2016-0752)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/rails-ruby-on-rails-cve-2016-0752","vendor":"Rails"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2015-4068"],"exploited":"in-the-wild","identifiers":["CVE-2015-4068"],"json":"https://helix.ml/threat-watch/i/arcserve-unified-data-protection-udp-cve-2015-4068.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2015-4068 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Unified Data Protection (UDP)","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"arcserve-unified-data-protection-udp-cve-2015-4068","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service. CISA added CVE-2015-4068 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability (CVE-2015-4068)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/arcserve-unified-data-protection-udp-cve-2015-4068","vendor":"Arcserve"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2015-3035"],"exploited":"in-the-wild","identifiers":["CVE-2015-3035"],"json":"https://helix.ml/threat-watch/i/tp-link-multiple-archer-devices-cve-2015-3035.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2015-3035 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Multiple Archer Devices","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"tp-link-multiple-archer-devices-cve-2015-3035","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/. CISA added CVE-2015-3035 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"TP-Link Multiple Archer Devices Directory Traversal Vulnerability (CVE-2015-3035)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/tp-link-multiple-archer-devices-cve-2015-3035","vendor":"TP-Link"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2015-1427"],"exploited":"in-the-wild","identifiers":["CVE-2015-1427"],"json":"https://helix.ml/threat-watch/i/elastic-elasticsearch-cve-2015-1427.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2015-1427 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Elasticsearch","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"elastic-elasticsearch-cve-2015-1427","stacks":["database"],"startedAt":"2022-03-25","status":"closed","summary":"The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands. CISA added CVE-2015-1427 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-284"],"title":"Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability (CVE-2015-1427)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/elastic-elasticsearch-cve-2015-1427","vendor":"Elastic"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2015-1187"],"exploited":"in-the-wild","identifiers":["CVE-2015-1187"],"json":"https://helix.ml/threat-watch/i/d-link-and-trendnet-multiple-devices-cve-2015-1187.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2015-1187 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"unpatched","product":"Multiple Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-and-trendnet-multiple-devices-cve-2015-1187","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution. CISA added CVE-2015-1187 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-287"],"title":"D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability (CVE-2015-1187)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-and-trendnet-multiple-devices-cve-2015-1187","vendor":"D-Link and TRENDnet"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2015-0666"],"exploited":"in-the-wild","identifiers":["CVE-2015-0666"],"json":"https://helix.ml/threat-watch/i/cisco-prime-data-center-network-manager-dcnm-cve-2015-0666.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2015-0666 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Prime Data Center Network Manager (DCNM)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-prime-data-center-network-manager-dcnm-cve-2015-0666","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files. CISA added CVE-2015-0666 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability (CVE-2015-0666)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-prime-data-center-network-manager-dcnm-cve-2015-0666","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2014-6332"],"exploited":"in-the-wild","identifiers":["CVE-2014-6332"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-6332.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2014-6332 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2014-6332","stacks":["windows"],"startedAt":"2022-03-25","status":"closed","summary":"OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site. CISA added CVE-2014-6332 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Microsoft Windows Object Linking \u0026 Embedding (OLE) Automation Array Remote Code Execution Vulnerability (CVE-2014-6332)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-6332","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2014-6324"],"exploited":"in-the-wild","identifiers":["CVE-2014-6324"],"json":"https://helix.ml/threat-watch/i/microsoft-kerberos-key-distribution-center-kdc-cve-2014-6324.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2014-6324 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Kerberos Key Distribution Center (KDC)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-kerberos-key-distribution-center-kdc-cve-2014-6324","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges. CISA added CVE-2014-6324 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability (CVE-2014-6324)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/microsoft-kerberos-key-distribution-center-kdc-cve-2014-6324","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2014-6287"],"exploited":"in-the-wild","identifiers":["CVE-2014-6287"],"json":"https://helix.ml/threat-watch/i/rejetto-http-file-server-hfs-cve-2014-6287.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2014-6287 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"HTTP File Server (HFS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"rejetto-http-file-server-hfs-cve-2014-6287","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs. CISA added CVE-2014-6287 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability (CVE-2014-6287)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/rejetto-http-file-server-hfs-cve-2014-6287","vendor":"Rejetto"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2014-3120"],"exploited":"in-the-wild","identifiers":["CVE-2014-3120"],"json":"https://helix.ml/threat-watch/i/elastic-elasticsearch-cve-2014-3120.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2014-3120 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Elasticsearch","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"elastic-elasticsearch-cve-2014-3120","stacks":["database"],"startedAt":"2022-03-25","status":"closed","summary":"Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code. CISA added CVE-2014-3120 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-284"],"title":"Elasticsearch Remote Code Execution Vulnerability (CVE-2014-3120)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/elastic-elasticsearch-cve-2014-3120","vendor":"Elastic"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2014-0130"],"exploited":"in-the-wild","identifiers":["CVE-2014-0130"],"json":"https://helix.ml/threat-watch/i/rails-ruby-on-rails-cve-2014-0130.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2014-0130 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Ruby on Rails","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"rails-ruby-on-rails-cve-2014-0130","stacks":["ruby"],"startedAt":"2022-03-25","status":"closed","summary":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request. CISA added CVE-2014-0130 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Ruby on Rails Directory Traversal Vulnerability (CVE-2014-0130)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/rails-ruby-on-rails-cve-2014-0130","vendor":"Rails"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2013-5223"],"exploited":"in-the-wild","identifiers":["CVE-2013-5223"],"json":"https://helix.ml/threat-watch/i/d-link-dsl-2760u-cve-2013-5223.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2013-5223 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"DSL-2760U","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dsl-2760u-cve-2013-5223","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML. CISA added CVE-2013-5223 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability (CVE-2013-5223)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/d-link-dsl-2760u-cve-2013-5223","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2013-4810"],"exploited":"in-the-wild","identifiers":["CVE-2013-4810"],"json":"https://helix.ml/threat-watch/i/hewlett-packard-hp-procurve-manager-pcm-pcm-identity-driven-manager-idm-and-application-lifecycle-management-cve-2013-48.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2013-4810 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"hewlett-packard-hp-procurve-manager-pcm-pcm-identity-driven-manager-idm-and-application-lifecycle-management-cve-2013-48","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet. CISA added CVE-2013-4810 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"HP Multiple Products Remote Code Execution Vulnerability (CVE-2013-4810)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/hewlett-packard-hp-procurve-manager-pcm-pcm-identity-driven-manager-idm-and-application-lifecycle-management-cve-2013-48","vendor":"Hewlett Packard (HP)"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2013-2251"],"exploited":"in-the-wild","identifiers":["CVE-2013-2251"],"json":"https://helix.ml/threat-watch/i/apache-struts-cve-2013-2251.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2013-2251 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Struts","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-cve-2013-2251","stacks":["java"],"startedAt":"2022-03-25","status":"closed","summary":"Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. CISA added CVE-2013-2251 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Apache Struts Improper Input Validation Vulnerability (CVE-2013-2251)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2013-2251","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2012-1823"],"exploited":"in-the-wild","identifiers":["CVE-2012-1823"],"json":"https://helix.ml/threat-watch/i/php-php-cve-2012-1823.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2012-1823 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"PHP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"php-php-cve-2012-1823","stacks":["php"],"startedAt":"2022-03-25","status":"closed","summary":"sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code. CISA added CVE-2012-1823 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"PHP-CGI Query String Parameter Vulnerability (CVE-2012-1823)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/php-php-cve-2012-1823","vendor":"PHP"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2010-4345"],"exploited":"in-the-wild","identifiers":["CVE-2010-4345"],"json":"https://helix.ml/threat-watch/i/exim-exim-cve-2010-4345.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2010-4345 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Exim","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"exim-exim-cve-2010-4345","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands. CISA added CVE-2010-4345 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Exim Privilege Escalation Vulnerability (CVE-2010-4345)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/exim-exim-cve-2010-4345","vendor":"Exim"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2010-4344"],"exploited":"in-the-wild","identifiers":["CVE-2010-4344"],"json":"https://helix.ml/threat-watch/i/exim-exim-cve-2010-4344.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2010-4344 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Exim","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"exim-exim-cve-2010-4344","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session. CISA added CVE-2010-4344 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Exim Heap-Based Buffer Overflow Vulnerability (CVE-2010-4344)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/exim-exim-cve-2010-4344","vendor":"Exim"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2010-3035"],"exploited":"in-the-wild","identifiers":["CVE-2010-3035"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2010-3035.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2010-3035 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"IOS XR","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-cve-2010-3035","stacks":["ios","network"],"startedAt":"2022-03-25","status":"closed","summary":"Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). CISA added CVE-2010-3035 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability (CVE-2010-3035)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2010-3035","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2010-2861"],"exploited":"in-the-wild","identifiers":["CVE-2010-2861"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2010-2861.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2010-2861 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2010-2861","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files. CISA added CVE-2010-2861 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"Adobe ColdFusion Directory Traversal Vulnerability (CVE-2010-2861)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2010-2861","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2009-2055"],"exploited":"in-the-wild","identifiers":["CVE-2009-2055"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2009-2055.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2009-2055 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"IOS XR","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-cve-2009-2055","stacks":["ios","network"],"startedAt":"2022-03-25","status":"closed","summary":"Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). CISA added CVE-2009-2055 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability (CVE-2009-2055)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2009-2055","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2009-1151"],"exploited":"in-the-wild","identifiers":["CVE-2009-1151"],"json":"https://helix.ml/threat-watch/i/phpmyadmin-phpmyadmin-cve-2009-1151.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2009-1151 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"phpMyAdmin","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"phpmyadmin-phpmyadmin-cve-2009-1151","stacks":["php"],"startedAt":"2022-03-25","status":"closed","summary":"Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. CISA added CVE-2009-1151 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"phpMyAdmin Remote Code Execution Vulnerability (CVE-2009-1151)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/phpmyadmin-phpmyadmin-cve-2009-1151","vendor":"phpMyAdmin"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2009-0927"],"exploited":"in-the-wild","identifiers":["CVE-2009-0927"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2009-0927.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2009-0927 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2009-0927","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code. CISA added CVE-2009-0927 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-20"],"title":"Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability (CVE-2009-0927)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2009-0927","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2005-2773"],"exploited":"in-the-wild","identifiers":["CVE-2005-2773"],"json":"https://helix.ml/threat-watch/i/hewlett-packard-hp-openview-network-node-manager-cve-2005-2773.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2005-2773 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"OpenView Network Node Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"hewlett-packard-hp-openview-network-node-manager-cve-2005-2773","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system. CISA added CVE-2005-2773 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"HP OpenView Network Node Manager Remote Code Execution Vulnerability (CVE-2005-2773)","updatedAt":"2026-10-25T09:11:39Z","url":"https://helix.ml/threat-watch/i/hewlett-packard-hp-openview-network-node-manager-cve-2005-2773","vendor":"Hewlett Packard (HP)"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2022-26318"],"exploited":"in-the-wild","identifiers":["CVE-2022-26318"],"json":"https://helix.ml/threat-watch/i/watchguard-firebox-and-xtm-appliances-cve-2022-26318.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2022-26318 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Firebox and XTM Appliances","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"watchguard-firebox-and-xtm-appliances-cve-2022-26318","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code. CISA added CVE-2022-26318 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-122"],"title":"WatchGuard Firebox and XTM Appliances Arbitrary Code Execution (CVE-2022-26318)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/watchguard-firebox-and-xtm-appliances-cve-2022-26318","vendor":"WatchGuard"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2022-26143"],"exploited":"in-the-wild","identifiers":["CVE-2022-26143"],"json":"https://helix.ml/threat-watch/i/mitel-micollab-mivoice-business-express-cve-2022-26143.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2022-26143 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"MiCollab, MiVoice Business Express","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mitel-micollab-mivoice-business-express-cve-2022-26143","stacks":["node"],"startedAt":"2022-03-25","status":"closed","summary":"A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system. CISA added CVE-2022-26143 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-306","cwe-406"],"title":"MiCollab, MiVoice Business Express Access Control Vulnerability (CVE-2022-26143)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mitel-micollab-mivoice-business-express-cve-2022-26143","vendor":"Mitel"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2022-21999"],"exploited":"in-the-wild","identifiers":["CVE-2022-21999"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-21999.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2022-21999 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2022-21999","stacks":["windows"],"startedAt":"2022-03-25","status":"closed","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation. CISA added CVE-2022-21999 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-40","cwe-1386"],"title":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability (CVE-2022-21999)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2022-21999","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2021-42237"],"exploited":"in-the-wild","identifiers":["CVE-2021-42237"],"json":"https://helix.ml/threat-watch/i/sitecore-xp-cve-2021-42237.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2021-42237 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"XP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sitecore-xp-cve-2021-42237","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution. CISA added CVE-2021-42237 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-502"],"title":"Sitecore XP Remote Command Execution Vulnerability (CVE-2021-42237)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sitecore-xp-cve-2021-42237","vendor":"Sitecore"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2021-22941"],"exploited":"in-the-wild","identifiers":["CVE-2021-22941"],"json":"https://helix.ml/threat-watch/i/citrix-sharefile-cve-2021-22941.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2021-22941 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"ShareFile","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-sharefile-cve-2021-22941","stacks":["cloud"],"startedAt":"2022-03-25","status":"closed","summary":"Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller. CISA added CVE-2021-22941 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-284"],"title":"Citrix ShareFile Improper Access Control Vulnerability (CVE-2021-22941)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/citrix-sharefile-cve-2021-22941","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-9377"],"exploited":"in-the-wild","identifiers":["CVE-2020-9377"],"json":"https://helix.ml/threat-watch/i/d-link-dir-610-devices-cve-2020-9377.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-9377 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"unpatched","product":"DIR-610 Devices","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-610-devices-cve-2020-9377","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php. CISA added CVE-2020-9377 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"D-Link DIR-610 Devices Remote Command Execution (CVE-2020-9377)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/d-link-dir-610-devices-cve-2020-9377","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-9054"],"exploited":"in-the-wild","identifiers":["CVE-2020-9054"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-network-attached-storage-nas-devices-cve-2020-9054.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-9054 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Multiple Network-Attached Storage (NAS) Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-network-attached-storage-nas-devices-cve-2020-9054","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code. CISA added CVE-2020-9054 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Zyxel Multiple NAS Devices OS Command Injection Vulnerability (CVE-2020-9054)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-network-attached-storage-nas-devices-cve-2020-9054","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-7247"],"exploited":"in-the-wild","identifiers":["CVE-2020-7247"],"json":"https://helix.ml/threat-watch/i/openbsd-opensmtpd-cve-2020-7247.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-7247 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"OpenSMTPD","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"openbsd-opensmtpd-cve-2020-7247","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. CISA added CVE-2020-7247 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-755","cwe-78"],"title":"OpenSMTPD Remote Code Execution Vulnerability (CVE-2020-7247)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/openbsd-opensmtpd-cve-2020-7247","vendor":"OpenBSD"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-5410"],"exploited":"in-the-wild","identifiers":["CVE-2020-5410"],"json":"https://helix.ml/threat-watch/i/vmware-tanzu-spring-cloud-configuration-config-server-cve-2020-5410.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-5410 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Spring Cloud Configuration (Config) Server","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-tanzu-spring-cloud-configuration-config-server-cve-2020-5410","stacks":["cloud","java"],"startedAt":"2022-03-25","status":"closed","summary":"Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files. CISA added CVE-2020-5410 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-23"],"title":"VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability (CVE-2020-5410)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-tanzu-spring-cloud-configuration-config-server-cve-2020-5410","vendor":"VMware Tanzu"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-25223"],"exploited":"in-the-wild","identifiers":["CVE-2020-25223"],"json":"https://helix.ml/threat-watch/i/sophos-sg-utm-cve-2020-25223.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-25223 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"SG UTM","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sophos-sg-utm-cve-2020-25223","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM. CISA added CVE-2020-25223 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Sophos SG UTM Remote Code Execution Vulnerability (CVE-2020-25223)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sophos-sg-utm-cve-2020-25223","vendor":"Sophos"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-2506"],"exploited":"in-the-wild","identifiers":["CVE-2020-2506"],"json":"https://helix.ml/threat-watch/i/qnap-systems-helpdesk-cve-2020-2506.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-2506 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Helpdesk","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qnap-systems-helpdesk-cve-2020-2506","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information. CISA added CVE-2020-2506 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"QNAP Helpdesk Improper Access Control Vulnerability (CVE-2020-2506)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/qnap-systems-helpdesk-cve-2020-2506","vendor":"QNAP Systems"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-2021"],"exploited":"in-the-wild","identifiers":["CVE-2020-2021"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2020-2021.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-2021 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"PAN-OS","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2020-2021","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication. CISA added CVE-2020-2021 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-347"],"title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CVE-2020-2021)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2020-2021","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-1956"],"exploited":"in-the-wild","identifiers":["CVE-2020-1956"],"json":"https://helix.ml/threat-watch/i/apache-kylin-cve-2020-1956.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-1956 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Kylin","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-kylin-cve-2020-1956","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution. CISA added CVE-2020-1956 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Apache Kylin OS Command Injection Vulnerability (CVE-2020-1956)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-kylin-cve-2020-1956","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2020-1631"],"exploited":"in-the-wild","identifiers":["CVE-2020-1631"],"json":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2020-1631.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2020-1631 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Junos OS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"juniper-junos-os-cve-2020-1631","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution. CISA added CVE-2020-1631 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22","cwe-73"],"title":"Juniper Junos OS Path Traversal Vulnerability (CVE-2020-1631)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/juniper-junos-os-cve-2020-1631","vendor":"Juniper"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-6340"],"exploited":"in-the-wild","identifiers":["CVE-2019-6340"],"json":"https://helix.ml/threat-watch/i/drupal-core-cve-2019-6340.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-6340 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Core","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"drupal-core-cve-2019-6340","stacks":["php"],"startedAt":"2022-03-25","status":"closed","summary":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. CISA added CVE-2019-6340 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-502"],"title":"Drupal Core Remote Code Execution Vulnerability (CVE-2019-6340)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/drupal-core-cve-2019-6340","vendor":"Drupal"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-2616"],"exploited":"in-the-wild","identifiers":["CVE-2019-2616"],"json":"https://helix.ml/threat-watch/i/oracle-bi-publisher-formerly-xml-publisher-cve-2019-2616.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-2616 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"BI Publisher (Formerly XML Publisher)","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-bi-publisher-formerly-xml-publisher-cve-2019-2616","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass. CISA added CVE-2019-2616 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass"],"title":"Oracle BI Publisher Unauthorized Access Vulnerability (CVE-2019-2616)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-bi-publisher-formerly-xml-publisher-cve-2019-2616","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-16920"],"exploited":"in-the-wild","identifiers":["CVE-2019-16920"],"json":"https://helix.ml/threat-watch/i/d-link-multiple-routers-cve-2019-16920.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-16920 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"unpatched","product":"Multiple Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-multiple-routers-cve-2019-16920","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise. CISA added CVE-2019-16920 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"D-Link Multiple Routers Command Injection Vulnerability (CVE-2019-16920)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/d-link-multiple-routers-cve-2019-16920","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-15107"],"exploited":"in-the-wild","identifiers":["CVE-2019-15107"],"json":"https://helix.ml/threat-watch/i/webmin-webmin-cve-2019-15107.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-15107 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Webmin","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"webmin-webmin-cve-2019-15107","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability. CISA added CVE-2019-15107 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"Webmin Command Injection Vulnerability (CVE-2019-15107)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/webmin-webmin-cve-2019-15107","vendor":"Webmin"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-12991"],"exploited":"in-the-wild","identifiers":["CVE-2019-12991"],"json":"https://helix.ml/threat-watch/i/citrix-sd-wan-and-netscaler-cve-2019-12991.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-12991 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"SD-WAN and NetScaler","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-sd-wan-and-netscaler-cve-2019-12991","stacks":["cloud","vpn"],"startedAt":"2022-03-25","status":"closed","summary":"Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. CISA added CVE-2019-12991 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Citrix SD-WAN and NetScaler Command Injection Vulnerability (CVE-2019-12991)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/citrix-sd-wan-and-netscaler-cve-2019-12991","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-12989"],"exploited":"in-the-wild","identifiers":["CVE-2019-12989"],"json":"https://helix.ml/threat-watch/i/citrix-sd-wan-and-netscaler-cve-2019-12989.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-12989 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"SD-WAN and NetScaler","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-sd-wan-and-netscaler-cve-2019-12989","stacks":["cloud","vpn"],"startedAt":"2022-03-25","status":"closed","summary":"Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection. CISA added CVE-2019-12989 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Citrix SD-WAN and NetScaler SQL Injection Vulnerability (CVE-2019-12989)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/citrix-sd-wan-and-netscaler-cve-2019-12989","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-11043"],"exploited":"in-the-wild","identifiers":["CVE-2019-11043"],"json":"https://helix.ml/threat-watch/i/php-fastcgi-process-manager-fpm-cve-2019-11043.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-11043 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"FastCGI Process Manager (FPM)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"php-fastcgi-process-manager-fpm-cve-2019-11043","stacks":["php"],"startedAt":"2022-03-25","status":"closed","summary":"In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution. CISA added CVE-2019-11043 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-120"],"title":"PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability (CVE-2019-11043)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/php-fastcgi-process-manager-fpm-cve-2019-11043","vendor":"PHP"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-10068"],"exploited":"in-the-wild","identifiers":["CVE-2019-10068"],"json":"https://helix.ml/threat-watch/i/kentico-xperience-cve-2019-10068.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-10068 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Xperience","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"kentico-xperience-cve-2019-10068","stacks":["rust"],"startedAt":"2022-03-25","status":"closed","summary":"Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution. CISA added CVE-2019-10068 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Kentico Xperience Deserialization of Untrusted Data Vulnerability (CVE-2019-10068)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/kentico-xperience-cve-2019-10068","vendor":"Kentico"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-1003030"],"exploited":"in-the-wild","identifiers":["CVE-2019-1003030"],"json":"https://helix.ml/threat-watch/i/jenkins-matrix-project-plugin-cve-2019-1003030.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-1003030 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Matrix Project Plugin","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"jenkins-matrix-project-plugin-cve-2019-1003030","stacks":["devtools"],"startedAt":"2022-03-25","status":"closed","summary":"Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution. CISA added CVE-2019-1003030 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Jenkins Matrix Project Plugin Remote Code Execution Vulnerability (CVE-2019-1003030)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/jenkins-matrix-project-plugin-cve-2019-1003030","vendor":"Jenkins"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2019-0903"],"exploited":"in-the-wild","identifiers":["CVE-2019-0903"],"json":"https://helix.ml/threat-watch/i/microsoft-graphics-device-interface-gdi-cve-2019-0903.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2019-0903 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Graphics Device Interface (GDI)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-graphics-device-interface-gdi-cve-2019-0903","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. CISA added CVE-2019-0903 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft GDI Remote Code Execution Vulnerability (CVE-2019-0903)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-graphics-device-interface-gdi-cve-2019-0903","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-8414"],"exploited":"in-the-wild","identifiers":["CVE-2018-8414"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8414.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-8414 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2018-8414","stacks":["windows"],"startedAt":"2022-03-25","status":"closed","summary":"A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths. CISA added CVE-2018-8414 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Windows Shell Remote Code Execution Vulnerability (CVE-2018-8414)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8414","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-8373"],"exploited":"in-the-wild","identifiers":["CVE-2018-8373"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-scripting-engine-cve-2018-8373.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-8373 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Internet Explorer Scripting Engine","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-scripting-engine-cve-2018-8373","stacks":["browser","windows"],"startedAt":"2022-03-25","status":"closed","summary":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. CISA added CVE-2018-8373 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Microsoft Scripting Engine Memory Corruption Vulnerability (CVE-2018-8373)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-scripting-engine-cve-2018-8373","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-6961"],"exploited":"in-the-wild","identifiers":["CVE-2018-6961"],"json":"https://helix.ml/threat-watch/i/vmware-sd-wan-edge-cve-2018-6961.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-6961 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"SD-WAN Edge","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-sd-wan-edge-cve-2018-6961","stacks":["browser","cloud"],"startedAt":"2022-03-25","status":"closed","summary":"VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution. CISA added CVE-2018-6961 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability (CVE-2018-6961)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-sd-wan-edge-cve-2018-6961","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-14839"],"exploited":"in-the-wild","identifiers":["CVE-2018-14839"],"json":"https://helix.ml/threat-watch/i/lg-n1a1-nas-cve-2018-14839.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-14839 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"N1A1 NAS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"lg-n1a1-nas-cve-2018-14839","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability. CISA added CVE-2018-14839 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"LG N1A1 NAS Remote Command Execution Vulnerability (CVE-2018-14839)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/lg-n1a1-nas-cve-2018-14839","vendor":"LG"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-1273"],"exploited":"in-the-wild","identifiers":["CVE-2018-1273"],"json":"https://helix.ml/threat-watch/i/vmware-tanzu-spring-data-commons-cve-2018-1273.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-1273 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Spring Data Commons","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-tanzu-spring-data-commons-cve-2018-1273","stacks":["cloud","java"],"startedAt":"2022-03-25","status":"closed","summary":"Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution. CISA added CVE-2018-1273 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"VMware Tanzu Spring Data Commons Property Binder Vulnerability (CVE-2018-1273)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-tanzu-spring-data-commons-cve-2018-1273","vendor":"VMware Tanzu"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-11138"],"exploited":"in-the-wild","identifiers":["CVE-2018-11138"],"json":"https://helix.ml/threat-watch/i/quest-kace-system-management-appliance-cve-2018-11138.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-11138 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"KACE System Management Appliance","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"quest-kace-system-management-appliance-cve-2018-11138","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution. CISA added CVE-2018-11138 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"Quest KACE System Management Appliance Remote Command Execution Vulnerability (CVE-2018-11138)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/quest-kace-system-management-appliance-cve-2018-11138","vendor":"Quest"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-0147"],"exploited":"in-the-wild","identifiers":["CVE-2018-0147"],"json":"https://helix.ml/threat-watch/i/cisco-secure-access-control-system-acs-cve-2018-0147.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-0147 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Secure Access Control System (ACS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-secure-access-control-system-acs-cve-2018-0147","stacks":["java","network"],"startedAt":"2022-03-25","status":"closed","summary":"A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. CISA added CVE-2018-0147 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-20"],"title":"Cisco Secure Access Control System Java Deserialization Vulnerability (CVE-2018-0147)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-secure-access-control-system-acs-cve-2018-0147","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2018-0125"],"exploited":"in-the-wild","identifiers":["CVE-2018-0125"],"json":"https://helix.ml/threat-watch/i/cisco-vpn-routers-cve-2018-0125.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2018-0125 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"VPN Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-vpn-routers-cve-2018-0125","stacks":["network","vpn"],"startedAt":"2022-03-25","status":"closed","summary":"A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system. CISA added CVE-2018-0125 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Cisco VPN Routers Remote Code Execution Vulnerability (CVE-2018-0125)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-vpn-routers-cve-2018-0125","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2017-6334"],"exploited":"in-the-wild","identifiers":["CVE-2017-6334"],"json":"https://helix.ml/threat-watch/i/netgear-dgn2200-devices-cve-2017-6334.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2017-6334 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"unpatched","product":"DGN2200 Devices","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-dgn2200-devices-cve-2017-6334","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands. CISA added CVE-2017-6334 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"NETGEAR DGN2200 Devices OS Command Injection Vulnerability (CVE-2017-6334)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/netgear-dgn2200-devices-cve-2017-6334","vendor":"NETGEAR"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2017-6316"],"exploited":"in-the-wild","identifiers":["CVE-2017-6316"],"json":"https://helix.ml/threat-watch/i/citrix-netscaler-sd-wan-enterprise-cloudbridge-virtual-wan-and-xenmobile-server-cve-2017-6316.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2017-6316 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-netscaler-sd-wan-enterprise-cloudbridge-virtual-wan-and-xenmobile-server-cve-2017-6316","stacks":["cloud","vpn"],"startedAt":"2022-03-25","status":"closed","summary":"A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server. CISA added CVE-2017-6316 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Citrix Multiple Products Remote Code Execution Vulnerability (CVE-2017-6316)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/citrix-netscaler-sd-wan-enterprise-cloudbridge-virtual-wan-and-xenmobile-server-cve-2017-6316","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2017-3881"],"exploited":"in-the-wild","identifiers":["CVE-2017-3881"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2017-3881.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2017-3881 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-cve-2017-3881","stacks":["ios","network"],"startedAt":"2022-03-25","status":"closed","summary":"A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. CISA added CVE-2017-3881 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Cisco IOS and IOS XE Remote Code Execution Vulnerability (CVE-2017-3881)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2017-3881","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2017-12617"],"exploited":"in-the-wild","identifiers":["CVE-2017-12617"],"json":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2017-12617.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2017-12617 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Tomcat","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-tomcat-cve-2017-12617","stacks":["java"],"startedAt":"2022-03-25","status":"closed","summary":"When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. CISA added CVE-2017-12617 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-434"],"title":"Apache Tomcat Remote Code Execution Vulnerability (CVE-2017-12617)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2017-12617","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2017-12615"],"exploited":"in-the-wild","identifiers":["CVE-2017-12615"],"json":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2017-12615.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2017-12615 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Tomcat","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-tomcat-cve-2017-12615","stacks":["java","windows"],"startedAt":"2022-03-25","status":"closed","summary":"When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. CISA added CVE-2017-12615 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-434"],"title":"Apache Tomcat on Windows Remote Code Execution Vulnerability (CVE-2017-12615)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2017-12615","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2017-0146"],"exploited":"in-the-wild","identifiers":["CVE-2017-0146"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0146.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2017-0146 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2017-0146","stacks":["windows"],"startedAt":"2022-03-25","status":"closed","summary":"The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution. CISA added CVE-2017-0146 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Microsoft Windows SMB Remote Code Execution Vulnerability (CVE-2017-0146)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0146","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2016-7892"],"exploited":"in-the-wild","identifiers":["CVE-2016-7892"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-7892.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2016-7892 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2016-7892","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class. CISA added CVE-2016-7892 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2016-7892)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-7892","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2016-4171"],"exploited":"in-the-wild","identifiers":["CVE-2016-4171"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-4171.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2016-4171 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2016-4171","stacks":[],"startedAt":"2022-03-25","status":"closed","summary":"Unspecified vulnerability in Adobe Flash Player allows for remote code execution. CISA added CVE-2016-4171 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Adobe Flash Player Remote Code Execution Vulnerability (CVE-2016-4171)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-4171","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-04-08","cveIds":["CVE-2016-1555"],"exploited":"in-the-wild","identifiers":["CVE-2016-1555"],"json":"https://helix.ml/threat-watch/i/netgear-wireless-access-point-wap-devices-cve-2016-1555.json","latestUpdate":{"date":"2022-03-25","title":"CISA added CVE-2016-1555 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 15, 2022)"},"patchStatus":"patched","product":"Wireless Access Point (WAP) Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-wireless-access-point-wap-devices-cve-2016-1555","stacks":["network"],"startedAt":"2022-03-25","status":"closed","summary":"Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution. CISA added CVE-2016-1555 to its Known Exploited Vulnerabilities catalog on Mar 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"NETGEAR Multiple WAP Devices Command Injection Vulnerability (CVE-2016-1555)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/netgear-wireless-access-point-wap-devices-cve-2016-1555","vendor":"NETGEAR"},{"auto":true,"category":"breach","closedAt":"2022-04-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZAPHOSTING"],"json":"https://helix.ml/threat-watch/i/zaphosting-data-breach.json","latestUpdate":{"date":"2022-03-19","title":"Have I Been Pwned loaded 746K breached ZAP-Hosting accounts"},"patchStatus":"no-fix-needed","product":"zap-hosting.com","severity":"medium","severityNote":"746K accounts","slug":"zaphosting-data-breach","stacks":[],"startedAt":"2022-03-19","status":"closed","summary":"In November 2021, web host ZAP-Hosting suffered a data breach that exposed over 60GB of data containing 746k unique email addresses. The breach also contained support chat logs, IP addresses, names, purchases, physical addresses and phone numbers. Exposed data: browser user agent details, chat logs, email addresses, ip addresses, names, phone numbers, physical addresses, purchases. The breach dates from Nov 22, 2021; Have I Been Pwned loaded it on Mar 19, 2022.","tags":["data-breach","hibp","browser-user-agent-details","chat-logs","email-addresses","ip-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"ZAP-Hosting data breach: 746K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/zaphosting-data-breach","vendor":"ZAP-Hosting"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2020-5135"],"exploited":"in-the-wild","identifiers":["CVE-2020-5135"],"json":"https://helix.ml/threat-watch/i/sonicwall-sonicos-cve-2020-5135.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2020-5135 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"SonicOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sonicos-cve-2020-5135","stacks":["vpn"],"startedAt":"2022-03-15","status":"closed","summary":"A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. CISA added CVE-2020-5135 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-120"],"title":"SonicWall SonicOS Buffer Overflow Vulnerability (CVE-2020-5135)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonicwall-sonicos-cve-2020-5135","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1405"],"exploited":"in-the-wild","identifiers":["CVE-2019-1405"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1405.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1405 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1405","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation. CISA added CVE-2019-1405 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability (CVE-2019-1405)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1405","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1322"],"exploited":"in-the-wild","identifiers":["CVE-2019-1322"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1322.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1322 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1322","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. CISA added CVE-2019-1322 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2019-1322)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1322","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1315"],"exploited":"in-the-wild","identifiers":["CVE-2019-1315"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1315.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1315 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1315","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. CISA added CVE-2019-1315 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability (CVE-2019-1315)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1315","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1253"],"exploited":"in-the-wild","identifiers":["CVE-2019-1253"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1253.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1253 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1253","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions. CISA added CVE-2019-1253 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability (CVE-2019-1253)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1253","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1132"],"exploited":"in-the-wild","identifiers":["CVE-2019-1132"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-1132.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1132 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2019-1132","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. CISA added CVE-2019-1132 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-1132)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-1132","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1129"],"exploited":"in-the-wild","identifiers":["CVE-2019-1129"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1129.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1129 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1129","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. CISA added CVE-2019-1129 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability (CVE-2019-1129)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1129","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1069"],"exploited":"in-the-wild","identifiers":["CVE-2019-1069"],"json":"https://helix.ml/threat-watch/i/microsoft-task-scheduler-cve-2019-1069.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1069 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Task Scheduler","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-task-scheduler-cve-2019-1069","stacks":[],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations. CISA added CVE-2019-1069 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Task Scheduler Privilege Escalation Vulnerability (CVE-2019-1069)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-task-scheduler-cve-2019-1069","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-1064"],"exploited":"in-the-wild","identifiers":["CVE-2019-1064"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1064.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-1064 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1064","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. CISA added CVE-2019-1064 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability (CVE-2019-1064)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1064","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-0841"],"exploited":"in-the-wild","identifiers":["CVE-2019-0841"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0841.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-0841 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-0841","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. CISA added CVE-2019-0841 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-59"],"title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability (CVE-2019-0841)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0841","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2019-0543"],"exploited":"in-the-wild","identifiers":["CVE-2019-0543"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0543.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2019-0543 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-0543","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. CISA added CVE-2019-0543 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-287"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2019-0543)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0543","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2018-8120"],"exploited":"in-the-wild","identifiers":["CVE-2018-8120"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2018-8120.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2018-8120 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2018-8120","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. CISA added CVE-2018-8120 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-404"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2018-8120)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2018-8120","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2017-0101"],"exploited":"in-the-wild","identifiers":["CVE-2017-0101"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0101.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2017-0101 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2017-0101","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory. CISA added CVE-2017-0101 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-119"],"title":"Microsoft Windows Transaction Manager Privilege Escalation Vulnerability (CVE-2017-0101)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0101","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2016-3309"],"exploited":"in-the-wild","identifiers":["CVE-2016-3309"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-3309.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2016-3309 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2016-3309","stacks":["linux","windows"],"startedAt":"2022-03-15","status":"closed","summary":"A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. CISA added CVE-2016-3309 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","privilege-escalation","cwe-264"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2016-3309)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-3309","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-29","cveIds":["CVE-2015-2546"],"exploited":"in-the-wild","identifiers":["CVE-2015-2546"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2015-2546.json","latestUpdate":{"date":"2022-03-15","title":"CISA added CVE-2015-2546 to the Known Exploited Vulnerabilities catalog (federal remediation due Apr 5, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 8.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2015-2546","stacks":["windows"],"startedAt":"2022-03-15","status":"closed","summary":"The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application. CISA added CVE-2015-2546 to its Known Exploited Vulnerabilities catalog on Mar 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-119"],"title":"Microsoft Win32k Memory Corruption Vulnerability (CVE-2015-2546)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2015-2546","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2022-26486"],"exploited":"in-the-wild","identifiers":["CVE-2022-26486"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2022-26486.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2022-26486 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 21, 2022)"},"patchStatus":"patched","product":"Firefox","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-cve-2022-26486","stacks":["browser"],"startedAt":"2022-03-07","status":"closed","summary":"Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution. CISA added CVE-2022-26486 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Mozilla Firefox Use-After-Free Vulnerability (CVE-2022-26486)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2022-26486","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2022-26485"],"exploited":"in-the-wild","identifiers":["CVE-2022-26485"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2022-26485.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2022-26485 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 21, 2022)"},"patchStatus":"patched","product":"Firefox","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-cve-2022-26485","stacks":["browser"],"startedAt":"2022-03-07","status":"closed","summary":"Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution. CISA added CVE-2022-26485 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Mozilla Firefox Use-After-Free Vulnerability (CVE-2022-26485)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2022-26485","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2021-21973"],"exploited":"in-the-wild","identifiers":["CVE-2021-21973"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-and-cloud-foundation-cve-2021-21973.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2021-21973 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 21, 2022)"},"patchStatus":"patched","product":"vCenter Server and Cloud Foundation","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-and-cloud-foundation-cve-2021-21973","stacks":["cloud"],"startedAt":"2022-03-07","status":"closed","summary":"VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure. CISA added CVE-2021-21973 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-20","cwe-918"],"title":"VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability (CVE-2021-21973)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-and-cloud-foundation-cve-2021-21973","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2020-8218"],"exploited":"in-the-wild","identifiers":["CVE-2020-8218"],"json":"https://helix.ml/threat-watch/i/pulse-secure-pulse-connect-secure-cve-2020-8218.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2020-8218 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"pulse-secure-pulse-connect-secure-cve-2020-8218","stacks":["vpn"],"startedAt":"2022-03-07","status":"closed","summary":"A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. CISA added CVE-2020-8218 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Pulse Connect Secure Code Injection Vulnerability (CVE-2020-8218)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/pulse-secure-pulse-connect-secure-cve-2020-8218","vendor":"Pulse Secure"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2019-11581"],"exploited":"in-the-wild","identifiers":["CVE-2019-11581"],"json":"https://helix.ml/threat-watch/i/atlassian-jira-server-and-data-center-cve-2019-11581.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2019-11581 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"Jira Server and Data Center","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-jira-server-and-data-center-cve-2019-11581","stacks":["devtools","java"],"startedAt":"2022-03-07","status":"closed","summary":"Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution. CISA added CVE-2019-11581 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-74"],"title":"Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability (CVE-2019-11581)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/atlassian-jira-server-and-data-center-cve-2019-11581","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2017-6077"],"exploited":"in-the-wild","identifiers":["CVE-2017-6077"],"json":"https://helix.ml/threat-watch/i/netgear-wireless-router-dgn2200-cve-2017-6077.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2017-6077 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"Wireless Router DGN2200","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-wireless-router-dgn2200-cve-2017-6077","stacks":["network"],"startedAt":"2022-03-07","status":"closed","summary":"NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution. CISA added CVE-2017-6077 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"NETGEAR DGN2200 Remote Code Execution Vulnerability (CVE-2017-6077)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/netgear-wireless-router-dgn2200-cve-2017-6077","vendor":"NETGEAR"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2016-6277"],"exploited":"in-the-wild","identifiers":["CVE-2016-6277"],"json":"https://helix.ml/threat-watch/i/netgear-multiple-routers-cve-2016-6277.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2016-6277 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"Multiple Routers","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-multiple-routers-cve-2016-6277","stacks":["network"],"startedAt":"2022-03-07","status":"closed","summary":"NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution. CISA added CVE-2016-6277 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-352"],"title":"NETGEAR Multiple Routers Remote Code Execution Vulnerability (CVE-2016-6277)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/netgear-multiple-routers-cve-2016-6277","vendor":"NETGEAR"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2013-0631"],"exploited":"in-the-wild","identifiers":["CVE-2013-0631"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0631.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2013-0631 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"ColdFusion","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2013-0631","stacks":[],"startedAt":"2022-03-07","status":"closed","summary":"Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server. CISA added CVE-2013-0631 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-200"],"title":"Adobe ColdFusion Information Disclosure Vulnerability (CVE-2013-0631)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0631","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2013-0629"],"exploited":"in-the-wild","identifiers":["CVE-2013-0629"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0629.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2013-0629 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"ColdFusion","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2013-0629","stacks":[],"startedAt":"2022-03-07","status":"closed","summary":"Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories. CISA added CVE-2013-0629 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-264"],"title":"Adobe ColdFusion Directory Traversal Vulnerability (CVE-2013-0629)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0629","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2013-0625"],"exploited":"in-the-wild","identifiers":["CVE-2013-0625"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0625.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2013-0625 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2013-0625","stacks":[],"startedAt":"2022-03-07","status":"closed","summary":"Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access. CISA added CVE-2013-0625 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-255"],"title":"Adobe ColdFusion Authentication Bypass Vulnerability (CVE-2013-0625)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0625","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-21","cveIds":["CVE-2009-3960"],"exploited":"in-the-wild","identifiers":["CVE-2009-3960"],"json":"https://helix.ml/threat-watch/i/adobe-blazeds-cve-2009-3960.json","latestUpdate":{"date":"2022-03-07","title":"CISA added CVE-2009-3960 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 7, 2022)"},"patchStatus":"patched","product":"BlazeDS","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-blazeds-cve-2009-3960","stacks":[],"startedAt":"2022-03-07","status":"closed","summary":"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure. CISA added CVE-2009-3960 to its Known Exploited Vulnerabilities catalog on Mar 7, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Adobe BlazeDS Information Disclosure Vulnerability (CVE-2009-3960)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-blazeds-cve-2009-3960","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2022-20708"],"exploited":"in-the-wild","identifiers":["CVE-2022-20708"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20708.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2022-20708 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20708","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). CISA added CVE-2022-20708 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","memory-corruption","cwe-121"],"title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (CVE-2022-20708)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20708","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2022-20703"],"exploited":"in-the-wild","identifiers":["CVE-2022-20703"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20703.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2022-20703 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20703","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). CISA added CVE-2022-20703 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","memory-corruption","cwe-347"],"title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (CVE-2022-20703)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20703","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2022-20701"],"exploited":"in-the-wild","identifiers":["CVE-2022-20701"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20701.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2022-20701 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20701","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). CISA added CVE-2022-20701 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","memory-corruption","cwe-121"],"title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (CVE-2022-20701)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20701","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2022-20700"],"exploited":"in-the-wild","identifiers":["CVE-2022-20700"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20700.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2022-20700 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20700","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). CISA added CVE-2022-20700 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","memory-corruption","cwe-121"],"title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (CVE-2022-20700)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20700","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2022-20699"],"exploited":"in-the-wild","identifiers":["CVE-2022-20699"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20699.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2022-20699 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Small Business RV160, RV260, RV340, and RV345 Series Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20699","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). CISA added CVE-2022-20699 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","memory-corruption","cwe-785"],"title":"Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (CVE-2022-20699)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv160-rv260-rv340-and-rv345-series-routers-cve-2022-20699","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2021-41379"],"exploited":"in-the-wild","identifiers":["CVE-2021-41379"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-41379.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2021-41379 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-41379","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-41379 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-1386"],"title":"Microsoft Windows Installer Privilege Escalation Vulnerability (CVE-2021-41379)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-41379","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2020-1938"],"exploited":"in-the-wild","identifiers":["CVE-2020-1938"],"json":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2020-1938.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2020-1938 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Tomcat","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-tomcat-cve-2020-1938","stacks":["java"],"startedAt":"2022-03-03","status":"closed","summary":"Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited. CISA added CVE-2020-1938 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apache Tomcat Improper Privilege Management Vulnerability (CVE-2020-1938)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-tomcat-cve-2020-1938","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2020-11899"],"exploited":"in-the-wild","identifiers":["CVE-2020-11899"],"json":"https://helix.ml/threat-watch/i/treck-tcp-ip-stack-ipv6-cve-2020-11899.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2020-11899 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IPv6","severity":"medium","severityNote":"CVSS 5.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"treck-tcp-ip-stack-ipv6-cve-2020-11899","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability. CISA added CVE-2020-11899 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-125"],"title":"Treck TCP/IP stack Out-of-Bounds Read Vulnerability (CVE-2020-11899)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/treck-tcp-ip-stack-ipv6-cve-2020-11899","vendor":"Treck TCP/IP stack"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2019-16928"],"exploited":"in-the-wild","identifiers":["CVE-2019-16928"],"json":"https://helix.ml/threat-watch/i/exim-exim-internet-mailer-cve-2019-16928.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2019-16928 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Exim Internet Mailer","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"exim-exim-internet-mailer-cve-2019-16928","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Exim contains an out-of-bounds write vulnerability which can allow for remote code execution. CISA added CVE-2019-16928 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Exim Out-of-bounds Write Vulnerability (CVE-2019-16928)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/exim-exim-internet-mailer-cve-2019-16928","vendor":"Exim"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2019-1652"],"exploited":"in-the-wild","identifiers":["CVE-2019-1652"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv320-and-rv325-dual-gigabit-wan-vpn-routers-cve-2019-1652.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2019-1652 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv320-and-rv325-dual-gigabit-wan-vpn-routers-cve-2019-1652","stacks":["network","vpn"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. CISA added CVE-2019-1652 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco Small Business Routers Improper Input Validation Vulnerability (CVE-2019-1652)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv320-and-rv325-dual-gigabit-wan-vpn-routers-cve-2019-1652","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2019-1297"],"exploited":"in-the-wild","identifiers":["CVE-2019-1297"],"json":"https://helix.ml/threat-watch/i/microsoft-excel-cve-2019-1297.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2019-1297 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Excel","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-excel-cve-2019-1297","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory. CISA added CVE-2019-1297 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Excel Remote Code Execution Vulnerability (CVE-2019-1297)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-excel-cve-2019-1297","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-8581"],"exploited":"in-the-wild","identifiers":["CVE-2018-8581"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2018-8581.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-8581 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 7.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2018-8581","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server. CISA added CVE-2018-8581 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Exchange Server Privilege Escalation Vulnerability (CVE-2018-8581)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2018-8581","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-8298"],"exploited":"in-the-wild","identifiers":["CVE-2018-8298"],"json":"https://helix.ml/threat-watch/i/chakracore-chakracore-scripting-engine-cve-2018-8298.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-8298 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"ChakraCore scripting engine","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"chakracore-chakracore-scripting-engine-cve-2018-8298","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution. CISA added CVE-2018-8298 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-843"],"title":"ChakraCore Scripting Engine Type Confusion Vulnerability (CVE-2018-8298)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/chakracore-chakracore-scripting-engine-cve-2018-8298","vendor":"ChakraCore"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0180"],"exploited":"in-the-wild","identifiers":["CVE-2018-0180"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0180.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0180 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS Software","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2018-0180","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. CISA added CVE-2018-0180 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software Denial-of-Service Vulnerability (CVE-2018-0180)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0180","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0179"],"exploited":"in-the-wild","identifiers":["CVE-2018-0179"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0179.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0179 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS Software","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2018-0179","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. CISA added CVE-2018-0179 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software Denial-of-Service Vulnerability (CVE-2018-0179)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0179","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0175"],"exploited":"in-the-wild","identifiers":["CVE-2018-0175"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-and-xe-software-cve-2018-0175.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0175 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS, XR, and XE Software","severity":"high","severityNote":"CVSS 8.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-and-xe-software-cve-2018-0175","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. CISA added CVE-2018-0175 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability (CVE-2018-0175)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-and-xe-software-cve-2018-0175","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0174"],"exploited":"in-the-wild","identifiers":["CVE-2018-0174"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xe-software-cve-2018-0174.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0174 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS XE Software","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xe-software-cve-2018-0174","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS). CISA added CVE-2018-0174 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability (CVE-2018-0174)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xe-software-cve-2018-0174","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0173"],"exploited":"in-the-wild","identifiers":["CVE-2018-0173"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2018-0173.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0173 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2018-0173","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS). CISA added CVE-2018-0173 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS and IOS XE Software Improper Input Validation Vulnerability (CVE-2018-0173)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2018-0173","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0172"],"exploited":"in-the-wild","identifiers":["CVE-2018-0172"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2018-0172.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0172 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2018-0172","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS). CISA added CVE-2018-0172 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS and IOS XE Software Improper Input Validation Vulnerability (CVE-2018-0172)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2018-0172","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0167"],"exploited":"in-the-wild","identifiers":["CVE-2018-0167"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-and-xe-software-cve-2018-0167.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0167 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS, XR, and XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-and-xe-software-cve-2018-0167","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code. CISA added CVE-2018-0167 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability (CVE-2018-0167)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-and-xe-software-cve-2018-0167","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0161"],"exploited":"in-the-wild","identifiers":["CVE-2018-0161"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0161.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0161 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS Software","severity":"medium","severityNote":"CVSS 6.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2018-0161","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition. CISA added CVE-2018-0161 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software Resource Management Errors Vulnerability (CVE-2018-0161)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0161","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0159"],"exploited":"in-the-wild","identifiers":["CVE-2018-0159"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0159.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0159 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS Software and Cisco IOS XE Software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0159","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition. CISA added CVE-2018-0159 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability (CVE-2018-0159)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0159","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0158"],"exploited":"in-the-wild","identifiers":["CVE-2018-0158"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0158.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0158 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS Software and Cisco IOS XE Software","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0158","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition. CISA added CVE-2018-0158 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability (CVE-2018-0158)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0158","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0156"],"exploited":"in-the-wild","identifiers":["CVE-2018-0156"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0156.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0156 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS Software and Cisco IOS XE Software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0156","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition. CISA added CVE-2018-0156 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability (CVE-2018-0156)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-and-cisco-ios-xe-software-cve-2018-0156","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0155"],"exploited":"in-the-wild","identifiers":["CVE-2018-0155"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-4500-series-switches-and-cisco-catalyst-4500-x-series-switches-cve-2018-0155.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0155 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-4500-series-switches-and-cisco-catalyst-4500-x-series-switches-cve-2018-0155","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition. CISA added CVE-2018-0155 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-388"],"title":"Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability (CVE-2018-0155)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-4500-series-switches-and-cisco-catalyst-4500-x-series-switches-cve-2018-0155","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0154"],"exploited":"in-the-wild","identifiers":["CVE-2018-0154"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0154.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0154 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS Software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2018-0154","stacks":["ios","network","vpn"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition. CISA added CVE-2018-0154 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability (CVE-2018-0154)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2018-0154","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2018-0151"],"exploited":"in-the-wild","identifiers":["CVE-2018-0151"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2018-0151.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2018-0151 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 17, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2018-0151","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. CISA added CVE-2018-0151 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability (CVE-2018-0151)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2018-0151","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-8540"],"exploited":"in-the-wild","identifiers":["CVE-2017-8540"],"json":"https://helix.ml/threat-watch/i/microsoft-malware-protection-engine-cve-2017-8540.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-8540 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Malware Protection Engine","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-malware-protection-engine-cve-2017-8540","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability\". CISA added CVE-2017-8540 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability (CVE-2017-8540)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-malware-protection-engine-cve-2017-8540","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6744"],"exploited":"in-the-wild","identifiers":["CVE-2017-6744"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-6744.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6744 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2017-6744","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. CISA added CVE-2017-6744 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS Software SNMP Remote Code Execution Vulnerability (CVE-2017-6744)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-6744","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6743"],"exploited":"in-the-wild","identifiers":["CVE-2017-6743"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6743.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6743 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6743","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. CISA added CVE-2017-6743 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (CVE-2017-6743)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6743","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6740"],"exploited":"in-the-wild","identifiers":["CVE-2017-6740"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6740.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6740 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6740","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. CISA added CVE-2017-6740 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (CVE-2017-6740)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6740","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6739"],"exploited":"in-the-wild","identifiers":["CVE-2017-6739"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6739.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6739 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6739","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. CISA added CVE-2017-6739 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (CVE-2017-6739)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6739","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6738"],"exploited":"in-the-wild","identifiers":["CVE-2017-6738"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6738.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6738 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6738","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. CISA added CVE-2017-6738 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (CVE-2017-6738)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6738","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6737"],"exploited":"in-the-wild","identifiers":["CVE-2017-6737"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6737.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6737 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6737","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. CISA added CVE-2017-6737 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (CVE-2017-6737)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6737","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6736"],"exploited":"in-the-wild","identifiers":["CVE-2017-6736"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6736.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6736 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6736","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. CISA added CVE-2017-6736 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (CVE-2017-6736)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6736","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6663"],"exploited":"in-the-wild","identifiers":["CVE-2017-6663"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6663.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6663 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6663","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS). CISA added CVE-2017-6663 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability (CVE-2017-6663)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6663","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-6627"],"exploited":"in-the-wild","identifiers":["CVE-2017-6627"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6627.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-6627 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-6627","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service. CISA added CVE-2017-6627 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability (CVE-2017-6627)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-6627","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12319"],"exploited":"in-the-wild","identifiers":["CVE-2017-12319"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xe-software-cve-2017-12319.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12319 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS XE Software","severity":"medium","severityNote":"CVSS 5.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xe-software-cve-2017-12319","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. CISA added CVE-2017-12319 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability (CVE-2017-12319)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xe-software-cve-2017-12319","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12240"],"exploited":"in-the-wild","identifiers":["CVE-2017-12240"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-12240.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12240 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-12240","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. CISA added CVE-2017-12240 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability (CVE-2017-12240)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-12240","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12238"],"exploited":"in-the-wild","identifiers":["CVE-2017-12238"],"json":"https://helix.ml/threat-watch/i/cisco-catalyst-6800-series-switches-cve-2017-12238.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12238 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Catalyst 6800 Series Switches","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-catalyst-6800-series-switches-cve-2017-12238","stacks":["network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service. CISA added CVE-2017-12238 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability (CVE-2017-12238)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-catalyst-6800-series-switches-cve-2017-12238","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12237"],"exploited":"in-the-wild","identifiers":["CVE-2017-12237"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-12237.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12237 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE Software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-software-cve-2017-12237","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service. CISA added CVE-2017-12237 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability (CVE-2017-12237)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-software-cve-2017-12237","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12235"],"exploited":"in-the-wild","identifiers":["CVE-2017-12235"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12235.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12235 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2017-12235","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. CISA added CVE-2017-12235 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability (CVE-2017-12235)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12235","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12234"],"exploited":"in-the-wild","identifiers":["CVE-2017-12234"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12234.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12234 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2017-12234","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. CISA added CVE-2017-12234 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability (CVE-2017-12234)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12234","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12233"],"exploited":"in-the-wild","identifiers":["CVE-2017-12233"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12233.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12233 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2017-12233","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. CISA added CVE-2017-12233 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability (CVE-2017-12233)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12233","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12232"],"exploited":"in-the-wild","identifiers":["CVE-2017-12232"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12232.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12232 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS software","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2017-12232","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service. CISA added CVE-2017-12232 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability (CVE-2017-12232)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12232","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-12231"],"exploited":"in-the-wild","identifiers":["CVE-2017-12231"],"json":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12231.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-12231 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"IOS software","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-software-cve-2017-12231","stacks":["ios","network"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service. CISA added CVE-2017-12231 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-399"],"title":"Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability (CVE-2017-12231)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/cisco-ios-software-cve-2017-12231","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-11826"],"exploited":"in-the-wild","identifiers":["CVE-2017-11826"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-11826.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-11826 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2017-11826","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. CISA added CVE-2017-11826 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Microsoft Office Remote Code Execution Vulnerability (CVE-2017-11826)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-11826","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-11292"],"exploited":"in-the-wild","identifiers":["CVE-2017-11292"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2017-11292.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-11292 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2017-11292","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution. CISA added CVE-2017-11292 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-843"],"title":"Adobe Flash Player Type Confusion Vulnerability (CVE-2017-11292)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2017-11292","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-0261"],"exploited":"in-the-wild","identifiers":["CVE-2017-0261"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-0261.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-0261 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2017-0261","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution. CISA added CVE-2017-0261 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Microsoft Office Use-After-Free Vulnerability (CVE-2017-0261)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-0261","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2017-0001"],"exploited":"in-the-wild","identifiers":["CVE-2017-0001"],"json":"https://helix.ml/threat-watch/i/microsoft-graphics-device-interface-gdi-cve-2017-0001.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2017-0001 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Graphics Device Interface (GDI)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-graphics-device-interface-gdi-cve-2017-0001","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges. CISA added CVE-2017-0001 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability (CVE-2017-0001)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-graphics-device-interface-gdi-cve-2017-0001","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-8562"],"exploited":"in-the-wild","identifiers":["CVE-2016-8562"],"json":"https://helix.ml/threat-watch/i/siemens-simatic-cp-cve-2016-8562.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-8562 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"SIMATIC CP","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"siemens-simatic-cp-cve-2016-8562","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. CISA added CVE-2016-8562 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability (CVE-2016-8562)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/siemens-simatic-cp-cve-2016-8562","vendor":"Siemens"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-7855"],"exploited":"in-the-wild","identifiers":["CVE-2016-7855"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-7855.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-7855 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2016-7855","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code. CISA added CVE-2016-7855 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2016-7855)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-7855","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-7262"],"exploited":"in-the-wild","identifiers":["CVE-2016-7262"],"json":"https://helix.ml/threat-watch/i/microsoft-excel-cve-2016-7262.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-7262 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Excel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-excel-cve-2016-7262","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands. CISA added CVE-2016-7262 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Microsoft Office Security Feature Bypass Vulnerability (CVE-2016-7262)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-excel-cve-2016-7262","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-7193"],"exploited":"in-the-wild","identifiers":["CVE-2016-7193"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2016-7193.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-7193 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2016-7193","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution. CISA added CVE-2016-7193 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft Office Memory Corruption Vulnerability (CVE-2016-7193)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2016-7193","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-5195"],"exploited":"in-the-wild","identifiers":["CVE-2016-5195"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2016-5195.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-5195 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2016-5195","stacks":["linux"],"startedAt":"2022-03-03","status":"closed","summary":"Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges. CISA added CVE-2016-5195 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-362"],"title":"Linux Kernel Race Condition Vulnerability (CVE-2016-5195)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2016-5195","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-4117"],"exploited":"in-the-wild","identifiers":["CVE-2016-4117"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-4117.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-4117 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2016-4117","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution. CISA added CVE-2016-4117 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2016-4117)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-4117","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-1019"],"exploited":"in-the-wild","identifiers":["CVE-2016-1019"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-1019.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-1019 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2016-1019","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code. CISA added CVE-2016-1019 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2016-1019)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2016-1019","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2016-0099"],"exploited":"in-the-wild","identifiers":["CVE-2016-0099"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-0099.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2016-0099 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2016-0099","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator. CISA added CVE-2016-0099 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","privilege-escalation","cwe-264"],"title":"Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability (CVE-2016-0099)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-0099","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-7645"],"exploited":"in-the-wild","identifiers":["CVE-2015-7645"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-7645.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-7645 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-7645","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file. CISA added CVE-2015-7645 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2015-7645)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-7645","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-5119"],"exploited":"in-the-wild","identifiers":["CVE-2015-5119"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-5119.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-5119 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-5119","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution. CISA added CVE-2015-5119 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-5119)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-5119","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-4902"],"exploited":"in-the-wild","identifiers":["CVE-2015-4902"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2015-4902.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-4902 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Java SE","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-cve-2015-4902","stacks":["java"],"startedAt":"2022-03-03","status":"closed","summary":"Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment. CISA added CVE-2015-4902 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle Java SE Integrity Check Vulnerability (CVE-2015-4902)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2015-4902","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-3043"],"exploited":"in-the-wild","identifiers":["CVE-2015-3043"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-3043.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-3043 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2015-3043","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution. CISA added CVE-2015-3043 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Adobe Flash Player Memory Corruption Vulnerability (CVE-2015-3043)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2015-3043","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-2590"],"exploited":"in-the-wild","identifiers":["CVE-2015-2590"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2015-2590.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-2590 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Java SE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-cve-2015-2590","stacks":["java"],"startedAt":"2022-03-03","status":"closed","summary":"An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution. CISA added CVE-2015-2590 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability (CVE-2015-2590)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2015-2590","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-2545"],"exploited":"in-the-wild","identifiers":["CVE-2015-2545"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-2545.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-2545 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2015-2545","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image. CISA added CVE-2015-2545 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Office Malformed EPS File Vulnerability (CVE-2015-2545)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-2545","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-2424"],"exploited":"in-the-wild","identifiers":["CVE-2015-2424"],"json":"https://helix.ml/threat-watch/i/microsoft-powerpoint-cve-2015-2424.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-2424 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"PowerPoint","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-powerpoint-cve-2015-2424","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document. CISA added CVE-2015-2424 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft PowerPoint Memory Corruption Vulnerability (CVE-2015-2424)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-powerpoint-cve-2015-2424","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-2387"],"exploited":"in-the-wild","identifiers":["CVE-2015-2387"],"json":"https://helix.ml/threat-watch/i/microsoft-atm-font-driver-cve-2015-2387.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-2387 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"ATM Font Driver","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-atm-font-driver-cve-2015-2387","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application. CISA added CVE-2015-2387 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"Microsoft ATM Font Driver Privilege Escalation Vulnerability (CVE-2015-2387)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-atm-font-driver-cve-2015-2387","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-1701"],"exploited":"in-the-wild","identifiers":["CVE-2015-1701"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2015-1701.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-1701 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2015-1701","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges. CISA added CVE-2015-1701 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","privilege-escalation","cwe-264"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2015-1701)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2015-1701","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2015-1642"],"exploited":"in-the-wild","identifiers":["CVE-2015-1642"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-1642.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2015-1642 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2015-1642","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document. CISA added CVE-2015-1642 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft Office Memory Corruption Vulnerability (CVE-2015-1642)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-1642","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2014-4114"],"exploited":"in-the-wild","identifiers":["CVE-2014-4114"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-4114.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2014-4114 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2014-4114","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"A vulnerability exists in Windows Object Linking \u0026 Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object. CISA added CVE-2014-4114 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Windows Object Linking \u0026 Embedding (OLE) Remote Code Execution Vulnerability (CVE-2014-4114)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-4114","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2014-0496"],"exploited":"in-the-wild","identifiers":["CVE-2014-0496"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2014-0496.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2014-0496 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2014-0496","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution. CISA added CVE-2014-0496 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-399"],"title":"Adobe Reader and Acrobat Use-After-Free Vulnerability (CVE-2014-0496)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2014-0496","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-5065"],"exploited":"in-the-wild","identifiers":["CVE-2013-5065"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2013-5065.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-5065 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2013-5065","stacks":["linux","windows"],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges. CISA added CVE-2013-5065 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-20"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2013-5065)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2013-5065","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-3897"],"exploited":"in-the-wild","identifiers":["CVE-2013-3897"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-3897.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-3897 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2013-3897","stacks":["browser","windows"],"startedAt":"2022-03-03","status":"closed","summary":"A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code. CISA added CVE-2013-3897 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-399"],"title":"Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2013-3897)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-3897","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-3346"],"exploited":"in-the-wild","identifiers":["CVE-2013-3346"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2013-3346.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-3346 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2013-3346","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service. CISA added CVE-2013-3346 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Adobe Reader and Acrobat Memory Corruption Vulnerability (CVE-2013-3346)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2013-3346","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-1675"],"exploited":"in-the-wild","identifiers":["CVE-2013-1675"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2013-1675.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-1675 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Firefox","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-cve-2013-1675","stacks":["browser"],"startedAt":"2022-03-03","status":"closed","summary":"Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. CISA added CVE-2013-1675 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Mozilla Firefox Information Disclosure Vulnerability (CVE-2013-1675)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-cve-2013-1675","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-1347"],"exploited":"in-the-wild","identifiers":["CVE-2013-1347"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-1347.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-1347 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2013-1347","stacks":["browser","windows"],"startedAt":"2022-03-03","status":"closed","summary":"This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. CISA added CVE-2013-1347 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2013-1347)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2013-1347","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-0641"],"exploited":"in-the-wild","identifiers":["CVE-2013-0641"],"json":"https://helix.ml/threat-watch/i/adobe-reader-cve-2013-0641.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-0641 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Reader","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-cve-2013-0641","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution. CISA added CVE-2013-0641 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-120"],"title":"Adobe Reader Buffer Overflow Vulnerability (CVE-2013-0641)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-reader-cve-2013-0641","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-0640"],"exploited":"in-the-wild","identifiers":["CVE-2013-0640"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2013-0640.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-0640 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2013-0640","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution. CISA added CVE-2013-0640 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Adobe Reader and Acrobat Memory Corruption Vulnerability (CVE-2013-0640)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2013-0640","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2013-0632"],"exploited":"in-the-wild","identifiers":["CVE-2013-0632"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0632.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2013-0632 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2013-0632","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access. CISA added CVE-2013-0632 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-200"],"title":"Adobe ColdFusion Authentication Bypass Vulnerability (CVE-2013-0632)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2013-0632","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2012-4681"],"exploited":"in-the-wild","identifiers":["CVE-2012-4681"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-4681.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2012-4681 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Java SE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-cve-2012-4681","stacks":["java"],"startedAt":"2022-03-03","status":"closed","summary":"The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution. CISA added CVE-2012-4681 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (CVE-2012-4681)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-4681","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2012-1856"],"exploited":"in-the-wild","identifiers":["CVE-2012-1856"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2012-1856.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2012-1856 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2012-1856","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption. CISA added CVE-2012-1856 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability (CVE-2012-1856)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2012-1856","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2012-1723"],"exploited":"in-the-wild","identifiers":["CVE-2012-1723"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-1723.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2012-1723 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Java SE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-cve-2012-1723","stacks":["java"],"startedAt":"2022-03-03","status":"closed","summary":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot. CISA added CVE-2012-1723 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (CVE-2012-1723)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-1723","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2012-1535"],"exploited":"in-the-wild","identifiers":["CVE-2012-1535"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-1535.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2012-1535 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2012-1535","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content. CISA added CVE-2012-1535 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2012-1535)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2012-1535","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2012-0507"],"exploited":"in-the-wild","identifiers":["CVE-2012-0507"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-0507.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2012-0507 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Java SE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-cve-2012-0507","stacks":["java"],"startedAt":"2022-03-03","status":"closed","summary":"An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. CISA added CVE-2012-0507 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (CVE-2012-0507)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-cve-2012-0507","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2011-3544"],"exploited":"in-the-wild","identifiers":["CVE-2011-3544"],"json":"https://helix.ml/threat-watch/i/oracle-java-se-jdk-and-jre-cve-2011-3544.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2011-3544 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Java SE JDK and JRE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-java-se-jdk-and-jre-cve-2011-3544","stacks":["java"],"startedAt":"2022-03-03","status":"closed","summary":"An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. CISA added CVE-2011-3544 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (CVE-2011-3544)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-java-se-jdk-and-jre-cve-2011-3544","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2011-1889"],"exploited":"in-the-wild","identifiers":["CVE-2011-1889"],"json":"https://helix.ml/threat-watch/i/microsoft-forefront-threat-management-gateway-tmg-cve-2011-1889.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2011-1889 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Forefront Threat Management Gateway (TMG)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-forefront-threat-management-gateway-tmg-cve-2011-1889","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application. CISA added CVE-2011-1889 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Microsoft Forefront TMG Remote Code Execution Vulnerability (CVE-2011-1889)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-forefront-threat-management-gateway-tmg-cve-2011-1889","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2011-0611"],"exploited":"in-the-wild","identifiers":["CVE-2011-0611"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2011-0611.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2011-0611 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2011-0611","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content. CISA added CVE-2011-0611 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-843"],"title":"Adobe Flash Player Remote Code Execution Vulnerability (CVE-2011-0611)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2011-0611","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2010-3333"],"exploited":"in-the-wild","identifiers":["CVE-2010-3333"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2010-3333.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2010-3333 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2010-3333","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution. CISA added CVE-2010-3333 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft Office Stack-based Buffer Overflow Vulnerability (CVE-2010-3333)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2010-3333","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2010-0232"],"exploited":"in-the-wild","identifiers":["CVE-2010-0232"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2010-0232.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2010-0232 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2010-0232","stacks":["linux","windows"],"startedAt":"2022-03-03","status":"closed","summary":"The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges. CISA added CVE-2010-0232 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-264"],"title":"Microsoft Windows Kernel Exception Handler Vulnerability (CVE-2010-0232)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2010-0232","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2010-0188"],"exploited":"in-the-wild","identifiers":["CVE-2010-0188"],"json":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2010-0188.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2010-0188 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Reader and Acrobat","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-reader-and-acrobat-cve-2010-0188","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code. CISA added CVE-2010-0188 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability (CVE-2010-0188)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-reader-and-acrobat-cve-2010-0188","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2009-3129"],"exploited":"in-the-wild","identifiers":["CVE-2009-3129"],"json":"https://helix.ml/threat-watch/i/microsoft-excel-cve-2009-3129.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2009-3129 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Excel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-excel-cve-2009-3129","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset. CISA added CVE-2009-3129 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-94"],"title":"Microsoft Excel Featheader Record Memory Corruption Vulnerability (CVE-2009-3129)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-excel-cve-2009-3129","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2009-1123"],"exploited":"in-the-wild","identifiers":["CVE-2009-1123"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2009-1123.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2009-1123 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2009-1123","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application. CISA added CVE-2009-1123 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Microsoft Windows Improper Input Validation Vulnerability (CVE-2009-1123)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2009-1123","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2008-3431"],"exploited":"in-the-wild","identifiers":["CVE-2008-3431"],"json":"https://helix.ml/threat-watch/i/oracle-virtualbox-cve-2008-3431.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2008-3431 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"VirtualBox","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-virtualbox-cve-2008-3431","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code. CISA added CVE-2008-3431 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-264"],"title":"Oracle VirtualBox Insufficient Input Validation Vulnerability (CVE-2008-3431)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-virtualbox-cve-2008-3431","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2008-2992"],"exploited":"in-the-wild","identifiers":["CVE-2008-2992"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2008-2992.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2008-2992 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2008-2992","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution. CISA added CVE-2008-2992 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-119"],"title":"Adobe Reader and Acrobat Input Validation Vulnerability (CVE-2008-2992)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2008-2992","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2004-0210"],"exploited":"in-the-wild","identifiers":["CVE-2004-0210"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2004-0210.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2004-0210 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2004-0210","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system. CISA added CVE-2004-0210 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-120"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2004-0210)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2004-0210","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-17","cveIds":["CVE-2002-0367"],"exploited":"in-the-wild","identifiers":["CVE-2002-0367"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2002-0367.json","latestUpdate":{"date":"2022-03-03","title":"CISA added CVE-2002-0367 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2002-0367","stacks":["windows"],"startedAt":"2022-03-03","status":"closed","summary":"smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges. CISA added CVE-2002-0367 to its Known Exploited Vulnerabilities catalog on Mar 3, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2002-0367)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2002-0367","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2022-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MACGENERATION"],"json":"https://helix.ml/threat-watch/i/macgeneration-data-breach.json","latestUpdate":{"date":"2022-03-03","title":"Have I Been Pwned loaded 101K breached MacGeneration accounts"},"patchStatus":"no-fix-needed","product":"macg.co","severity":"high","severityNote":"101K accounts · passwords exposed","slug":"macgeneration-data-breach","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"In January 2022, the French Apple news website MacGeneration suffered a data breach. The incident exposed over 100k usernames, email addresses and passwords stored as salted SHA-512 hashes. After discovering the incident, MacGeneration self-submitted data to HIBP. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 29, 2022; Have I Been Pwned loaded it on Mar 3, 2022.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"MacGeneration data breach: 101K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/macgeneration-data-breach","vendor":"MacGeneration"},{"auto":true,"category":"breach","closedAt":"2022-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROBINHOOD"],"json":"https://helix.ml/threat-watch/i/robinhood-data-breach.json","latestUpdate":{"date":"2022-03-03","title":"Have I Been Pwned loaded 5.0M breached Robinhood accounts"},"patchStatus":"no-fix-needed","product":"robinhood.com","severity":"medium","severityNote":"5.0M accounts","slug":"robinhood-data-breach","stacks":[],"startedAt":"2022-03-03","status":"closed","summary":"In November 2021, the online trading platform Robinhood suffered a data breach after a customer service representative was socially engineered. The incident exposed over 5M customer email addresses and 2M customer names. Exposed data: email addresses. The breach dates from Nov 3, 2021; Have I Been Pwned loaded it on Mar 3, 2022.","tags":["data-breach","hibp","email-addresses"],"title":"Robinhood data breach: 5.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/robinhood-data-breach","vendor":"Robinhood"},{"auto":true,"category":"breach","closedAt":"2022-03-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NVIDIA"],"json":"https://helix.ml/threat-watch/i/nvidia-data-breach.json","latestUpdate":{"date":"2022-03-02","title":"Have I Been Pwned loaded 71K breached NVIDIA accounts"},"patchStatus":"no-fix-needed","product":"nvidia.com","severity":"high","severityNote":"71K accounts · passwords exposed","slug":"nvidia-data-breach","stacks":[],"startedAt":"2022-03-02","status":"closed","summary":"In February 2022, microchip company NVIDIA suffered a data breach that exposed employee credentials and proprietary code. Impacted data included over 70k employee email addresses and NTLM password hashes, many of which were subsequently cracked and circulated within the hacking community. Exposed data: email addresses, passwords. The breach dates from Feb 23, 2022; Have I Been Pwned loaded it on Mar 2, 2022.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"NVIDIA data breach: 71K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nvidia-data-breach","vendor":"NVIDIA"},{"auto":true,"category":"patch","closedAt":"2022-03-11","cveIds":["CVE-2022-24682"],"exploited":"in-the-wild","identifiers":["CVE-2022-24682"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaborate-suite-zcs-cve-2022-24682.json","latestUpdate":{"date":"2022-02-25","title":"CISA added CVE-2022-24682 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 11, 2022)"},"patchStatus":"patched","product":"Zimbra Collaborate Suite (ZCS)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaborate-suite-zcs-cve-2022-24682","stacks":[],"startedAt":"2022-02-25","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code. CISA added CVE-2022-24682 to its Known Exploited Vulnerabilities catalog on Feb 25, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","xss","cwe-79","cwe-116"],"title":"Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability (CVE-2022-24682)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaborate-suite-zcs-cve-2022-24682","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2022-03-11","cveIds":["CVE-2017-8570"],"exploited":"in-the-wild","identifiers":["CVE-2017-8570"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-8570.json","latestUpdate":{"date":"2022-02-25","title":"CISA added CVE-2017-8570 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 25, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2017-8570","stacks":["windows"],"startedAt":"2022-02-25","status":"closed","summary":"A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. CISA added CVE-2017-8570 to its Known Exploited Vulnerabilities catalog on Feb 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Office Remote Code Execution Vulnerability (CVE-2017-8570)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-8570","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-11","cveIds":["CVE-2017-0222"],"exploited":"in-the-wild","identifiers":["CVE-2017-0222"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0222.json","latestUpdate":{"date":"2022-02-25","title":"CISA added CVE-2017-0222 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 25, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2017-0222","stacks":["browser","windows"],"startedAt":"2022-02-25","status":"closed","summary":"A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. CISA added CVE-2017-0222 to its Known Exploited Vulnerabilities catalog on Feb 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-119"],"title":"Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2017-0222)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2017-0222","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-11","cveIds":["CVE-2014-6352"],"exploited":"in-the-wild","identifiers":["CVE-2014-6352"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-6352.json","latestUpdate":{"date":"2022-02-25","title":"CISA added CVE-2014-6352 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 25, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2014-6352","stacks":["windows"],"startedAt":"2022-02-25","status":"closed","summary":"Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object. CISA added CVE-2014-6352 to its Known Exploited Vulnerabilities catalog on Feb 25, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Microsoft Windows Code Injection Vulnerability (CVE-2014-6352)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-6352","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-08","cveIds":["CVE-2022-23131"],"exploited":"in-the-wild","identifiers":["CVE-2022-23131"],"json":"https://helix.ml/threat-watch/i/zabbix-frontend-cve-2022-23131.json","latestUpdate":{"date":"2022-02-22","title":"CISA added CVE-2022-23131 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 8, 2022)"},"patchStatus":"patched","product":"Frontend","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zabbix-frontend-cve-2022-23131","stacks":[],"startedAt":"2022-02-22","status":"closed","summary":"Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML. CISA added CVE-2022-23131 to its Known Exploited Vulnerabilities catalog on Feb 22, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-290"],"title":"Zabbix Frontend Authentication Bypass Vulnerability (CVE-2022-23131)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zabbix-frontend-cve-2022-23131","vendor":"Zabbix"},{"auto":true,"category":"patch","closedAt":"2022-03-08","cveIds":["CVE-2022-23134"],"exploited":"in-the-wild","identifiers":["CVE-2022-23134"],"json":"https://helix.ml/threat-watch/i/zabbix-frontend-cve-2022-23134.json","latestUpdate":{"date":"2022-02-22","title":"CISA added CVE-2022-23134 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 8, 2022)"},"patchStatus":"patched","product":"Frontend","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"zabbix-frontend-cve-2022-23134","stacks":[],"startedAt":"2022-02-22","status":"closed","summary":"Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend. CISA added CVE-2022-23134 to its Known Exploited Vulnerabilities catalog on Feb 22, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Zabbix Frontend Improper Access Control Vulnerability (CVE-2022-23134)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zabbix-frontend-cve-2022-23134","vendor":"Zabbix"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2022-24086"],"exploited":"in-the-wild","identifiers":["CVE-2022-24086"],"json":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-open-source-cve-2022-24086.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2022-24086 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 1, 2022)"},"patchStatus":"patched","product":"Commerce and Magento Open Source","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-commerce-and-magento-open-source-cve-2022-24086","stacks":["php"],"startedAt":"2022-02-15","status":"closed","summary":"Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution. CISA added CVE-2022-24086 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability (CVE-2022-24086)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-open-source-cve-2022-24086","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2022-0609"],"exploited":"in-the-wild","identifiers":["CVE-2022-0609"],"json":"https://helix.ml/threat-watch/i/google-chromium-animation-cve-2022-0609.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2022-0609 to the Known Exploited Vulnerabilities catalog (federal remediation due Mar 1, 2022)"},"patchStatus":"patched","product":"Chromium Animation","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-animation-cve-2022-0609","stacks":["browser"],"startedAt":"2022-02-15","status":"closed","summary":"Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2022-0609 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium Animation Use-After-Free Vulnerability (CVE-2022-0609)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-animation-cve-2022-0609","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2019-0752"],"exploited":"in-the-wild","identifiers":["CVE-2019-0752"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-0752.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2019-0752 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2019-0752","stacks":["browser","windows"],"startedAt":"2022-02-15","status":"closed","summary":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. CISA added CVE-2019-0752 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-843"],"title":"Microsoft Internet Explorer Type Confusion Vulnerability (CVE-2019-0752)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-0752","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2018-8174"],"exploited":"in-the-wild","identifiers":["CVE-2018-8174"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8174.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2018-8174 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2018-8174","stacks":["windows"],"startedAt":"2022-02-15","status":"closed","summary":"A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution\". CISA added CVE-2018-8174 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-787"],"title":"Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability (CVE-2018-8174)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2018-8174","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2018-20250"],"exploited":"in-the-wild","identifiers":["CVE-2018-20250"],"json":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2018-20250.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2018-20250 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2022)"},"patchStatus":"patched","product":"WinRAR","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"rarlab-winrar-cve-2018-20250","stacks":[],"startedAt":"2022-02-15","status":"closed","summary":"WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution. CISA added CVE-2018-20250 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-36"],"title":"WinRAR Absolute Path Traversal Vulnerability (CVE-2018-20250)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/rarlab-winrar-cve-2018-20250","vendor":"RARLAB"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2018-15982"],"exploited":"in-the-wild","identifiers":["CVE-2018-15982"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2018-15982.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2018-15982 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2018-15982","stacks":[],"startedAt":"2022-02-15","status":"closed","summary":"Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability. CISA added CVE-2018-15982 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-416"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2018-15982)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2018-15982","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2017-9841"],"exploited":"in-the-wild","identifiers":["CVE-2017-9841"],"json":"https://helix.ml/threat-watch/i/phpunit-phpunit-cve-2017-9841.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2017-9841 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2022)"},"patchStatus":"patched","product":"PHPUnit","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"phpunit-phpunit-cve-2017-9841","stacks":["php"],"startedAt":"2022-02-15","status":"closed","summary":"PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. CISA added CVE-2017-9841 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"PHPUnit Command Injection Vulnerability (CVE-2017-9841)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/phpunit-phpunit-cve-2017-9841","vendor":"PHPUnit"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2014-1761"],"exploited":"in-the-wild","identifiers":["CVE-2014-1761"],"json":"https://helix.ml/threat-watch/i/microsoft-word-cve-2014-1761.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2014-1761 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2022)"},"patchStatus":"patched","product":"Word","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-word-cve-2014-1761","stacks":[],"startedAt":"2022-02-15","status":"closed","summary":"Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution. CISA added CVE-2014-1761 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Microsoft Word Memory Corruption Vulnerability (CVE-2014-1761)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-word-cve-2014-1761","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-03-01","cveIds":["CVE-2013-3906"],"exploited":"in-the-wild","identifiers":["CVE-2013-3906"],"json":"https://helix.ml/threat-watch/i/microsoft-graphics-component-cve-2013-3906.json","latestUpdate":{"date":"2022-02-15","title":"CISA added CVE-2013-3906 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 15, 2022)"},"patchStatus":"patched","product":"Graphics Component","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-graphics-component-cve-2013-3906","stacks":[],"startedAt":"2022-02-15","status":"closed","summary":"Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution. CISA added CVE-2013-3906 to its Known Exploited Vulnerabilities catalog on Feb 15, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-94"],"title":"Microsoft Graphics Component Memory Corruption Vulnerability (CVE-2013-3906)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-graphics-component-cve-2013-3906","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2022-03-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GIVESENDGO"],"json":"https://helix.ml/threat-watch/i/givesendgo-data-breach.json","latestUpdate":{"date":"2022-02-15","title":"Have I Been Pwned loaded 89K breached GiveSendGo accounts"},"patchStatus":"no-fix-needed","product":"givesendgo.com","severity":"medium","severityNote":"89K accounts","slug":"givesendgo-data-breach","stacks":[],"startedAt":"2022-02-15","status":"closed","summary":"In February 2022, the Christian fundraising service GiveSendGo suffered a data breach which exposed the personal data of 90k donors to the Canadian \"Freedom Convoy\" protest against vaccine mandates. The breach exposed names, email addresses, post codes, donation amount and comments left at the time of donation. Exposed data: email addresses, geographic locations, names, purchases. The breach dates from Feb 7, 2022; Have I Been Pwned loaded it on Feb 15, 2022.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","purchases"],"title":"GiveSendGo data breach: 89K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/givesendgo-data-breach","vendor":"GiveSendGo"},{"auto":true,"category":"patch","closedAt":"2022-02-25","cveIds":["CVE-2022-22620"],"exploited":"in-the-wild","identifiers":["CVE-2022-22620"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2022-22620.json","latestUpdate":{"date":"2022-02-11","title":"CISA added CVE-2022-22620 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 25, 2022)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2022-22620","stacks":["browser","ios","macos"],"startedAt":"2022-02-11","status":"closed","summary":"Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2022-22620 to its Known Exploited Vulnerabilities catalog on Feb 11, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability (CVE-2022-22620)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2022-22620","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2021-36934"],"exploited":"in-the-wild","identifiers":["CVE-2021-36934"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36934.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2021-36934 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 24, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-36934","stacks":["windows"],"startedAt":"2022-02-10","status":"closed","summary":"If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level. CISA added CVE-2021-36934 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-1220"],"title":"Microsoft Windows SAM Local Privilege Escalation Vulnerability (CVE-2021-36934)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36934","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2020-0796"],"exploited":"in-the-wild","identifiers":["CVE-2020-0796"],"json":"https://helix.ml/threat-watch/i/microsoft-smbv3-cve-2020-0796.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2020-0796 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"SMBv3","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-smbv3-cve-2020-0796","stacks":[],"startedAt":"2022-02-10","status":"closed","summary":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. CISA added CVE-2020-0796 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-119"],"title":"Microsoft SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-smbv3-cve-2020-0796","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2018-1000861"],"exploited":"in-the-wild","identifiers":["CVE-2018-1000861"],"json":"https://helix.ml/threat-watch/i/jenkins-jenkins-stapler-web-framework-cve-2018-1000861.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2018-1000861 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"Jenkins Stapler Web Framework","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"jenkins-jenkins-stapler-web-framework-cve-2018-1000861","stacks":["devtools","rust"],"startedAt":"2022-02-10","status":"closed","summary":"A code execution vulnerability exists in the Stapler web framework used by Jenkins. CISA added CVE-2018-1000861 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability (CVE-2018-1000861)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/jenkins-jenkins-stapler-web-framework-cve-2018-1000861","vendor":"Jenkins"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2017-9791"],"exploited":"in-the-wild","identifiers":["CVE-2017-9791"],"json":"https://helix.ml/threat-watch/i/apache-struts-1-cve-2017-9791.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2017-9791 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"Struts 1","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-1-cve-2017-9791","stacks":["java"],"startedAt":"2022-02-10","status":"closed","summary":"The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. CISA added CVE-2017-9791 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Apache Struts 1 Improper Input Validation Vulnerability (CVE-2017-9791)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-struts-1-cve-2017-9791","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2017-8464"],"exploited":"in-the-wild","identifiers":["CVE-2017-8464"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-8464.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2017-8464 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2017-8464","stacks":["windows"],"startedAt":"2022-02-10","status":"closed","summary":"Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file. CISA added CVE-2017-8464 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability (CVE-2017-8464)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-8464","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2017-10271"],"exploited":"in-the-wild","identifiers":["CVE-2017-10271"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2017-10271.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2017-10271 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"WebLogic Server","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2017-10271","stacks":["java"],"startedAt":"2022-02-10","status":"closed","summary":"Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution. CISA added CVE-2017-10271 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Oracle Corporation WebLogic Server Remote Code Execution Vulnerability (CVE-2017-10271)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2017-10271","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2017-0263"],"exploited":"in-the-wild","identifiers":["CVE-2017-0263"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2017-0263.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2017-0263 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2017-0263","stacks":["windows"],"startedAt":"2022-02-10","status":"closed","summary":"Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory. CISA added CVE-2017-0263 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2017-0263)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2017-0263","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2017-0262"],"exploited":"in-the-wild","identifiers":["CVE-2017-0262"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-0262.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2017-0262 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2017-0262","stacks":["windows"],"startedAt":"2022-02-10","status":"closed","summary":"A remote code execution vulnerability exists in Microsoft Office. CISA added CVE-2017-0262 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Office Remote Code Execution Vulnerability (CVE-2017-0262)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-0262","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2017-0145"],"exploited":"in-the-wild","identifiers":["CVE-2017-0145"],"json":"https://helix.ml/threat-watch/i/microsoft-smbv1-cve-2017-0145.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2017-0145 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"SMBv1","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-smbv1-cve-2017-0145","stacks":[],"startedAt":"2022-02-10","status":"closed","summary":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. CISA added CVE-2017-0145 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Microsoft SMBv1 Remote Code Execution Vulnerability (CVE-2017-0145)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-smbv1-cve-2017-0145","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2017-0144"],"exploited":"in-the-wild","identifiers":["CVE-2017-0144"],"json":"https://helix.ml/threat-watch/i/microsoft-smbv1-cve-2017-0144.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2017-0144 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"SMBv1","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-smbv1-cve-2017-0144","stacks":[],"startedAt":"2022-02-10","status":"closed","summary":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. CISA added CVE-2017-0144 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Microsoft SMBv1 Remote Code Execution Vulnerability (CVE-2017-0144)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-smbv1-cve-2017-0144","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2016-3088"],"exploited":"in-the-wild","identifiers":["CVE-2016-3088"],"json":"https://helix.ml/threat-watch/i/apache-activemq-cve-2016-3088.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2016-3088 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"ActiveMQ","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-activemq-cve-2016-3088","stacks":[],"startedAt":"2022-02-10","status":"closed","summary":"The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. CISA added CVE-2016-3088 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Apache ActiveMQ Improper Input Validation Vulnerability (CVE-2016-3088)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-activemq-cve-2016-3088","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2015-2051"],"exploited":"in-the-wild","identifiers":["CVE-2015-2051"],"json":"https://helix.ml/threat-watch/i/d-link-dir-645-router-cve-2015-2051.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2015-2051 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"unpatched","product":"DIR-645 Router","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-645-router-cve-2015-2051","stacks":["network"],"startedAt":"2022-02-10","status":"closed","summary":"D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface. CISA added CVE-2015-2051 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"D-Link DIR-645 Router Remote Code Execution Vulnerability (CVE-2015-2051)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/d-link-dir-645-router-cve-2015-2051","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2015-1635"],"exploited":"in-the-wild","identifiers":["CVE-2015-1635"],"json":"https://helix.ml/threat-watch/i/microsoft-http-sys-cve-2015-1635.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2015-1635 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"HTTP.sys","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-http-sys-cve-2015-1635","stacks":[],"startedAt":"2022-02-10","status":"closed","summary":"Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution. CISA added CVE-2015-1635 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Microsoft HTTP.sys Remote Code Execution Vulnerability (CVE-2015-1635)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-http-sys-cve-2015-1635","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2015-1130"],"exploited":"in-the-wild","identifiers":["CVE-2015-1130"],"json":"https://helix.ml/threat-watch/i/apple-os-x-cve-2015-1130.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2015-1130 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"OS X","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-os-x-cve-2015-1130","stacks":[],"startedAt":"2022-02-10","status":"closed","summary":"The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges. CISA added CVE-2015-1130 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-254"],"title":"Apple OS X Authentication Bypass Vulnerability (CVE-2015-1130)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apple-os-x-cve-2015-1130","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-02-24","cveIds":["CVE-2014-4404"],"exploited":"in-the-wild","identifiers":["CVE-2014-4404"],"json":"https://helix.ml/threat-watch/i/apple-os-x-cve-2014-4404.json","latestUpdate":{"date":"2022-02-10","title":"CISA added CVE-2014-4404 to the Known Exploited Vulnerabilities catalog (federal remediation due Aug 10, 2022)"},"patchStatus":"patched","product":"OS X","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-os-x-cve-2014-4404","stacks":[],"startedAt":"2022-02-10","status":"closed","summary":"Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context. CISA added CVE-2014-4404 to its Known Exploited Vulnerabilities catalog on Feb 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"Apple OS X Heap-Based Buffer Overflow Vulnerability (CVE-2014-4404)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apple-os-x-cve-2014-4404","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-02-18","cveIds":["CVE-2022-21882"],"exploited":"in-the-wild","identifiers":["CVE-2022-21882"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2022-21882.json","latestUpdate":{"date":"2022-02-04","title":"CISA added CVE-2022-21882 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 18, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2022-21882","stacks":["windows"],"startedAt":"2022-02-04","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2022-21882 to its Known Exploited Vulnerabilities catalog on Feb 4, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-787"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2022-21882)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2022-21882","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2022-22587"],"exploited":"in-the-wild","identifiers":["CVE-2022-22587"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2022-22587.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2022-22587 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 11, 2022)"},"patchStatus":"patched","product":"iOS and macOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-macos-cve-2022-22587","stacks":["ios","macos"],"startedAt":"2022-01-28","status":"closed","summary":"Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges. CISA added CVE-2022-22587 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-20","cwe-787"],"title":"Apple Memory Corruption Vulnerability (CVE-2022-22587)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2022-22587","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2021-20038"],"exploited":"in-the-wild","identifiers":["CVE-2021-20038"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma-100-appliances-cve-2021-20038.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2021-20038 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 11, 2022)"},"patchStatus":"patched","product":"SMA 100 Appliances","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma-100-appliances-cve-2021-20038","stacks":["vpn"],"startedAt":"2022-01-28","status":"closed","summary":"SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution. CISA added CVE-2021-20038 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-121"],"title":"SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability (CVE-2021-20038)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma-100-appliances-cve-2021-20038","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2020-5722"],"exploited":"in-the-wild","identifiers":["CVE-2020-5722"],"json":"https://helix.ml/threat-watch/i/grandstream-ucm6200-cve-2020-5722.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2020-5722 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2022)"},"patchStatus":"patched","product":"UCM6200","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"grandstream-ucm6200-cve-2020-5722","stacks":[],"startedAt":"2022-01-28","status":"closed","summary":"Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root. CISA added CVE-2020-5722 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Grandstream Networks UCM6200 Series SQL Injection Vulnerability (CVE-2020-5722)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/grandstream-ucm6200-cve-2020-5722","vendor":"Grandstream"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2020-0787"],"exploited":"in-the-wild","identifiers":["CVE-2020-0787"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0787.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2020-0787 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-0787","stacks":["windows"],"startedAt":"2022-01-28","status":"closed","summary":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. CISA added CVE-2020-0787 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-269","cwe-59"],"title":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability (CVE-2020-0787)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0787","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2017-5689"],"exploited":"in-the-wild","identifiers":["CVE-2017-5689"],"json":"https://helix.ml/threat-watch/i/intel-active-management-technology-amt-small-business-technology-sbt-and-standard-manageability-cve-2017-5689.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2017-5689 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2022)"},"patchStatus":"patched","product":"Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"intel-active-management-technology-amt-small-business-technology-sbt-and-standard-manageability-cve-2017-5689","stacks":[],"startedAt":"2022-01-28","status":"closed","summary":"Intel products contain a vulnerability which can allow attackers to perform privilege escalation. CISA added CVE-2017-5689 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability (CVE-2017-5689)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/intel-active-management-technology-amt-small-business-technology-sbt-and-standard-manageability-cve-2017-5689","vendor":"Intel"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2014-1776"],"exploited":"in-the-wild","identifiers":["CVE-2014-1776"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-1776.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2014-1776 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2014-1776","stacks":["browser","windows"],"startedAt":"2022-01-28","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user. CISA added CVE-2014-1776 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-1776)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2014-1776","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2014-6271"],"exploited":"in-the-wild","identifiers":["CVE-2014-6271"],"json":"https://helix.ml/threat-watch/i/gnu-bourne-again-shell-bash-cve-2014-6271.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2014-6271 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2022)"},"patchStatus":"patched","product":"Bourne-Again Shell (Bash)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gnu-bourne-again-shell-bash-cve-2014-6271","stacks":[],"startedAt":"2022-01-28","status":"closed","summary":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. CISA added CVE-2014-6271 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability (CVE-2014-6271)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/gnu-bourne-again-shell-bash-cve-2014-6271","vendor":"GNU"},{"auto":true,"category":"patch","closedAt":"2022-02-11","cveIds":["CVE-2014-7169"],"exploited":"in-the-wild","identifiers":["CVE-2014-7169"],"json":"https://helix.ml/threat-watch/i/gnu-bourne-again-shell-bash-cve-2014-7169.json","latestUpdate":{"date":"2022-01-28","title":"CISA added CVE-2014-7169 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 28, 2022)"},"patchStatus":"patched","product":"Bourne-Again Shell (Bash)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"gnu-bourne-again-shell-bash-cve-2014-7169","stacks":[],"startedAt":"2022-01-28","status":"closed","summary":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271. CISA added CVE-2014-7169 to its Known Exploited Vulnerabilities catalog on Jan 28, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability (CVE-2014-7169)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/gnu-bourne-again-shell-bash-cve-2014-7169","vendor":"GNU"},{"auto":true,"category":"breach","closedAt":"2022-02-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REDDOORZ"],"json":"https://helix.ml/threat-watch/i/reddoorz-data-breach.json","latestUpdate":{"date":"2022-01-28","title":"Have I Been Pwned loaded 5.9M breached RedDoorz accounts"},"patchStatus":"no-fix-needed","product":"reddoorz.com","severity":"high","severityNote":"5.9M accounts · passwords exposed","slug":"reddoorz-data-breach","stacks":[],"startedAt":"2022-01-28","status":"closed","summary":"In September 2020, the hotel management \u0026 booking platform RedDoorz suffered a data breach that exposed over 5.8M user accounts. The breached data included names, email addresses, phone numbers, genders, dates of birth and passwords stored as bcrypt hashes. Exposed data: dates of birth, email addresses, genders, names, occupations, passwords, phone numbers. The breach dates from Sep 4, 2020; Have I Been Pwned loaded it on Jan 28, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","occupations","passwords","phone-numbers"],"title":"RedDoorz data breach: 5.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/reddoorz-data-breach","vendor":"RedDoorz"},{"auto":true,"category":"breach","closedAt":"2022-02-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BTCALPHA"],"json":"https://helix.ml/threat-watch/i/btcalpha-data-breach.json","latestUpdate":{"date":"2022-01-27","title":"Have I Been Pwned loaded 362K breached BTC-Alpha accounts"},"patchStatus":"no-fix-needed","product":"btc-alpha.com","severity":"high","severityNote":"362K accounts · passwords exposed","slug":"btcalpha-data-breach","stacks":[],"startedAt":"2022-01-27","status":"closed","summary":"In November 2021, the crypto exchange platform BTC-Alpha suffered a ransomware attack data breach after which customer data was publicly dumped. The impacted data included 362k email and IP addresses, usernames and passwords stored as PBKDF2 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Nov 2, 2021; Have I Been Pwned loaded it on Jan 27, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"BTC-Alpha data breach: 362K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/btcalpha-data-breach","vendor":"BTC-Alpha"},{"auto":true,"category":"patch","closedAt":"2022-02-04","cveIds":["CVE-2006-1547"],"exploited":"in-the-wild","identifiers":["CVE-2006-1547"],"json":"https://helix.ml/threat-watch/i/apache-struts-1-cve-2006-1547.json","latestUpdate":{"date":"2022-01-21","title":"CISA added CVE-2006-1547 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 21, 2022)"},"patchStatus":"patched","product":"Struts 1","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-1-cve-2006-1547","stacks":["java"],"startedAt":"2022-01-21","status":"closed","summary":"ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). CISA added CVE-2006-1547 to its Known Exploited Vulnerabilities catalog on Jan 21, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apache Struts 1 ActionForm Denial-of-Service Vulnerability (CVE-2006-1547)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-struts-1-cve-2006-1547","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-02-04","cveIds":["CVE-2012-0391"],"exploited":"in-the-wild","identifiers":["CVE-2012-0391"],"json":"https://helix.ml/threat-watch/i/apache-struts-2-cve-2012-0391.json","latestUpdate":{"date":"2022-01-21","title":"CISA added CVE-2012-0391 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 21, 2022)"},"patchStatus":"patched","product":"Struts 2","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-2-cve-2012-0391","stacks":["java"],"startedAt":"2022-01-21","status":"closed","summary":"The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution. CISA added CVE-2012-0391 to its Known Exploited Vulnerabilities catalog on Jan 21, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Apache Struts 2 Improper Input Validation Vulnerability (CVE-2012-0391)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-struts-2-cve-2012-0391","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-02-04","cveIds":["CVE-2018-8453"],"exploited":"in-the-wild","identifiers":["CVE-2018-8453"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2018-8453.json","latestUpdate":{"date":"2022-01-21","title":"CISA added CVE-2018-8453 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 21, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2018-8453","stacks":["windows"],"startedAt":"2022-01-21","status":"closed","summary":"Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges. CISA added CVE-2018-8453 to its Known Exploited Vulnerabilities catalog on Jan 21, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-404"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2018-8453)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2018-8453","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-04","cveIds":["CVE-2021-35247"],"exploited":"in-the-wild","identifiers":["CVE-2021-35247"],"json":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2021-35247.json","latestUpdate":{"date":"2022-01-21","title":"CISA added CVE-2021-35247 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 4, 2022)"},"patchStatus":"patched","product":"Serv-U","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-serv-u-cve-2021-35247","stacks":[],"startedAt":"2022-01-21","status":"closed","summary":"SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization. CISA added CVE-2021-35247 to its Known Exploited Vulnerabilities catalog on Jan 21, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"SolarWinds Serv-U Improper Input Validation Vulnerability (CVE-2021-35247)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2021-35247","vendor":"SolarWinds"},{"auto":true,"category":"breach","closedAt":"2022-02-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHOCKGORE"],"json":"https://helix.ml/threat-watch/i/shockgore-data-breach.json","latestUpdate":{"date":"2022-01-20","title":"Have I Been Pwned loaded 73K breached ShockGore accounts"},"patchStatus":"no-fix-needed","product":"shockgore.com","severity":"high","severityNote":"73K accounts · passwords exposed","slug":"shockgore-data-breach","stacks":[],"startedAt":"2022-01-20","status":"closed","summary":"In August 2020, the website for sharing graphic videos and images of gore and animal cruelty suffered a data breach. The breach exposed 74k unique email addresses alongside usernames, IP addresses, genders and unsalted SHA-1 password hashes. Private messages were also exposed, many containing requests for material of a depraved nature. Exposed data: email addresses, genders, ip addresses, passwords, private messages, usernames. The breach dates from Aug 11, 2020; Have I Been Pwned loaded it on Jan 20, 2022.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","passwords","private-messages","usernames"],"title":"ShockGore data breach: 73K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/shockgore-data-breach","vendor":"ShockGore"},{"auto":true,"category":"breach","closedAt":"2022-02-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UPSTOX"],"json":"https://helix.ml/threat-watch/i/upstox-data-breach.json","latestUpdate":{"date":"2022-01-19","title":"Have I Been Pwned loaded 111K breached Upstox accounts"},"patchStatus":"no-fix-needed","product":"upstox.com","severity":"high","severityNote":"111K accounts · passwords exposed · financial data exposed","slug":"upstox-data-breach","stacks":[],"startedAt":"2022-01-19","status":"closed","summary":"In April 2021, Indian brokerage firm Upstox suffered a data breach. The incident exposed extensive personal information on over 100k customers including names, genders, dates of birth, physical addresses, banking information and passwords stored as bcrypt hashes. Extensive \"know your customer\" information was also exposed including scans of bank statements, cheques and identity documents complete with Aadhaar numbers. Exposed data: bank account numbers, dates of birth, email addresses, family members' names, genders, government issued ids, income levels, marital statuses, nationalities, occupations, passwords, phone numbers, physical addresses. The breach dates from Apr 8, 2021; Have I Been Pwned loaded it on Jan 19, 2022.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","email-addresses","family-members-names","genders","government-issued-ids","income-levels","marital-statuses","nationalities","occupations","passwords","phone-numbers"],"title":"Upstox data breach: 111K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/upstox-data-breach","vendor":"Upstox"},{"auto":true,"category":"breach","closedAt":"2022-02-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OPENSUBTITLES"],"json":"https://helix.ml/threat-watch/i/opensubtitles-data-breach.json","latestUpdate":{"date":"2022-01-19","title":"Have I Been Pwned loaded 6.8M breached Open Subtitles accounts"},"patchStatus":"no-fix-needed","product":"opensubtitles.org","severity":"high","severityNote":"6.8M accounts · passwords exposed","slug":"opensubtitles-data-breach","stacks":[],"startedAt":"2022-01-19","status":"closed","summary":"In August 2021, the subtitling website Open Subtitles suffered a data breach and subsequent ransom demand. The breach exposed almost 7M subscribers' personal data including email and IP addresses, usernames, the country of the user and passwords stored as unsalted MD5 hashes. Exposed data: email addresses, geographic locations, ip addresses, passwords, usernames. The breach dates from Aug 1, 2021; Have I Been Pwned loaded it on Jan 19, 2022.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","passwords","usernames"],"title":"Open Subtitles data breach: 6.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/opensubtitles-data-breach","vendor":"Open Subtitles"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-32648"],"exploited":"in-the-wild","identifiers":["CVE-2021-32648"],"json":"https://helix.ml/threat-watch/i/october-cms-october-cms-cve-2021-32648.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-32648 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"October CMS","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"october-cms-october-cms-cve-2021-32648","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. CISA added CVE-2021-32648 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-287"],"title":"October CMS Improper Authentication (CVE-2021-32648)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/october-cms-october-cms-cve-2021-32648","vendor":"October CMS"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-25296"],"exploited":"in-the-wild","identifiers":["CVE-2021-25296"],"json":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2021-25296.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-25296 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"Nagios XI","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nagios-nagios-xi-cve-2021-25296","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. CISA added CVE-2021-25296 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-138"],"title":"Nagios XI OS Command Injection (CVE-2021-25296)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2021-25296","vendor":"Nagios"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-25297"],"exploited":"in-the-wild","identifiers":["CVE-2021-25297"],"json":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2021-25297.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-25297 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"Nagios XI","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nagios-nagios-xi-cve-2021-25297","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. CISA added CVE-2021-25297 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-138"],"title":"Nagios XI OS Command Injection (CVE-2021-25297)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2021-25297","vendor":"Nagios"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-25298"],"exploited":"in-the-wild","identifiers":["CVE-2021-25298"],"json":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2021-25298.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-25298 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"Nagios XI","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nagios-nagios-xi-cve-2021-25298","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. CISA added CVE-2021-25298 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78","cwe-138"],"title":"Nagios XI OS Command Injection (CVE-2021-25298)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2021-25298","vendor":"Nagios"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-40870"],"exploited":"in-the-wild","identifiers":["CVE-2021-40870"],"json":"https://helix.ml/threat-watch/i/aviatrix-aviatrix-controller-cve-2021-40870.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-40870 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"Aviatrix Controller","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"aviatrix-aviatrix-controller-cve-2021-40870","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. CISA added CVE-2021-40870 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-25","cwe-96"],"title":"Aviatrix Controller Unrestricted Upload of File (CVE-2021-40870)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/aviatrix-aviatrix-controller-cve-2021-40870","vendor":"Aviatrix"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-33766"],"exploited":"in-the-wild","identifiers":["CVE-2021-33766"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-33766.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-33766 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 7.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-33766","stacks":["windows"],"startedAt":"2022-01-18","status":"closed","summary":"Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target. CISA added CVE-2021-33766 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-287"],"title":"Microsoft Exchange Server Information Disclosure (CVE-2021-33766)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-33766","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-21975"],"exploited":"in-the-wild","identifiers":["CVE-2021-21975"],"json":"https://helix.ml/threat-watch/i/vmware-vrealize-operations-manager-api-cve-2021-21975.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-21975 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"vRealize Operations Manager API","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vrealize-operations-manager-api-cve-2021-21975","stacks":["cloud"],"startedAt":"2022-01-18","status":"closed","summary":"Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials. CISA added CVE-2021-21975 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","ssrf","cwe-918"],"title":"VMware Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vrealize-operations-manager-api-cve-2021-21975","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-21315"],"exploited":"in-the-wild","identifiers":["CVE-2021-21315"],"json":"https://helix.ml/threat-watch/i/npm-package-system-information-library-for-node-js-cve-2021-21315.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-21315 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"System Information Library for Node.JS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"npm-package-system-information-library-for-node-js-cve-2021-21315","stacks":["node","npm"],"startedAt":"2022-01-18","status":"closed","summary":"In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote. CISA added CVE-2021-21315 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"System Information Library for Node.JS Command Injection (CVE-2021-21315)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/npm-package-system-information-library-for-node-js-cve-2021-21315","vendor":"Npm package"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2021-22991"],"exploited":"in-the-wild","identifiers":["CVE-2021-22991"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-traffic-management-microkernel-cve-2021-22991.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2021-22991 to the Known Exploited Vulnerabilities catalog (federal remediation due Feb 1, 2022)"},"patchStatus":"patched","product":"BIG-IP Traffic Management Microkernel","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-traffic-management-microkernel-cve-2021-22991","stacks":["linux","network"],"startedAt":"2022-01-18","status":"closed","summary":"The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. CISA added CVE-2021-22991 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"F5 BIG-IP Traffic Management Microkernel Buffer Overflow (CVE-2021-22991)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-traffic-management-microkernel-cve-2021-22991","vendor":"F5"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2020-14864"],"exploited":"in-the-wild","identifiers":["CVE-2020-14864"],"json":"https://helix.ml/threat-watch/i/oracle-intelligence-enterprise-edition-cve-2020-14864.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2020-14864 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Intelligence Enterprise Edition","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-intelligence-enterprise-edition-cve-2020-14864","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file. CISA added CVE-2020-14864 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"Oracle Business Intelligence Enterprise Edition Path Transversal (CVE-2020-14864)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-intelligence-enterprise-edition-cve-2020-14864","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2020-13671"],"exploited":"in-the-wild","identifiers":["CVE-2020-13671"],"json":"https://helix.ml/threat-watch/i/drupal-drupal-core-cve-2020-13671.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2020-13671 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Drupal core","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"drupal-drupal-core-cve-2020-13671","stacks":["php"],"startedAt":"2022-01-18","status":"closed","summary":"Improper sanitization in the extension file names is present in Drupal core. CISA added CVE-2020-13671 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"Drupal core Un-restricted Upload of File (CVE-2020-13671)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/drupal-drupal-core-cve-2020-13671","vendor":"Drupal"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2020-11978"],"exploited":"in-the-wild","identifiers":["CVE-2020-11978"],"json":"https://helix.ml/threat-watch/i/apache-airflow-cve-2020-11978.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2020-11978 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Airflow","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-airflow-cve-2020-11978","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. CISA added CVE-2020-11978 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Apache Airflow Command Injection (CVE-2020-11978)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-airflow-cve-2020-11978","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2022-02-01","cveIds":["CVE-2020-13927"],"exploited":"in-the-wild","identifiers":["CVE-2020-13927"],"json":"https://helix.ml/threat-watch/i/apache-airflow-s-experimental-api-cve-2020-13927.json","latestUpdate":{"date":"2022-01-18","title":"CISA added CVE-2020-13927 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 18, 2022)"},"patchStatus":"patched","product":"Airflow's Experimental API","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-airflow-s-experimental-api-cve-2020-13927","stacks":[],"startedAt":"2022-01-18","status":"closed","summary":"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. CISA added CVE-2020-13927 to its Known Exploited Vulnerabilities catalog on Jan 18, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-1188","cwe-306"],"title":"Apache Airflow's Experimental API Authentication Bypass (CVE-2020-13927)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-airflow-s-experimental-api-cve-2020-13927","vendor":"Apache"},{"auto":true,"category":"breach","closedAt":"2022-01-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CARDINGMAFIADEC2021"],"json":"https://helix.ml/threat-watch/i/cardingmafiadec2021-data-breach.json","latestUpdate":{"date":"2022-01-16","title":"Have I Been Pwned loaded 303K breached Carding Mafia (December 2021) accounts"},"patchStatus":"no-fix-needed","product":"cardmafia.cc","severity":"high","severityNote":"303K accounts · passwords exposed","slug":"cardingmafiadec2021-data-breach","stacks":[],"startedAt":"2022-01-16","status":"closed","summary":"In December 2021, the Carding Mafia forum suffered a data breach that exposed over 300k members' email addresses. Dedicated to the theft and trading of stolen credit cards, the forum breach also exposed usernames, IP addresses and passwords stored as salted MD5 hashes. This breach came only 9 months after another breach of the forum in March 2021. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 28, 2021; Have I Been Pwned loaded it on Jan 16, 2022.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Carding Mafia (December 2021) data breach: 303K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cardingmafiadec2021-data-breach","vendor":"Carding Mafia (December 2021)"},{"auto":true,"category":"breach","closedAt":"2022-01-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ABFRL"],"json":"https://helix.ml/threat-watch/i/abfrl-data-breach.json","latestUpdate":{"date":"2022-01-15","title":"Have I Been Pwned loaded 5.5M breached Aditya Birla Fashion and Retail accounts"},"patchStatus":"no-fix-needed","product":"abfrl.com","severity":"high","severityNote":"5.5M accounts · passwords exposed","slug":"abfrl-data-breach","stacks":[],"startedAt":"2022-01-15","status":"closed","summary":"In December 2021, Indian retailer Aditya Birla Fashion and Retail Ltd was breached and ransomed. The ransom demand was allegedly rejected and data containing 5.4M unique email addresses was subsequently dumped publicly on a popular hacking forum the next month. The data contained extensive personal customer information including names, phone numbers, physical addresses, DoBs, order histories and passwords stored as MD5 hashes. Employee data was also dumped publicly and included salary grades, marital statuses and religions. Exposed data: email addresses, genders, income levels, job titles, marital statuses, names, passwords, phone numbers, physical addresses, purchases, religions, salutations. The breach dates from Dec 1, 2021; Have I Been Pwned loaded it on Jan 15, 2022.","tags":["data-breach","hibp","email-addresses","genders","income-levels","job-titles","marital-statuses","names","passwords","phone-numbers","physical-addresses","purchases","religions","salutations"],"title":"Aditya Birla Fashion and Retail data breach: 5.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/abfrl-data-breach","vendor":"Aditya Birla Fashion and Retail"},{"auto":true,"category":"breach","closedAt":"2022-01-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GUNSDOTCOM"],"json":"https://helix.ml/threat-watch/i/gunsdotcom-data-breach.json","latestUpdate":{"date":"2022-01-13","title":"Have I Been Pwned loaded 375K breached Guns.com accounts"},"patchStatus":"no-fix-needed","product":"guns.com","severity":"high","severityNote":"375K accounts · passwords exposed · financial data exposed","slug":"gunsdotcom-data-breach","stacks":[],"startedAt":"2022-01-13","status":"closed","summary":"In January 2021, the firearms website guns.com suffered a data breach. The breach exposed 376k unique email addresses along with names, phone numbers, physical addresses, gun purchases, partial credit card data, dates of birth and passwords stored as bcrypt hashes. Exposed data: dates of birth, email addresses, names, partial credit card data, passwords, phone numbers, physical addresses, purchases. The breach dates from Jan 12, 2021; Have I Been Pwned loaded it on Jan 13, 2022.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","partial-credit-card-data","passwords","phone-numbers","physical-addresses","purchases"],"title":"Guns.com data breach: 375K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gunsdotcom-data-breach","vendor":"Guns.com"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2021-22017"],"exploited":"in-the-wild","identifiers":["CVE-2021-22017"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-22017.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2021-22017 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 24, 2022)"},"patchStatus":"patched","product":"vCenter Server","severity":"medium","severityNote":"CVSS 5.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2021-22017","stacks":["cloud"],"startedAt":"2022-01-10","status":"closed","summary":"Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. CISA added CVE-2021-22017 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-23"],"title":"VMware vCenter Server Improper Access Control (CVE-2021-22017)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-22017","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2021-36260"],"exploited":"in-the-wild","identifiers":["CVE-2021-36260"],"json":"https://helix.ml/threat-watch/i/hikvision-security-cameras-web-server-cve-2021-36260.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2021-36260 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 24, 2022)"},"patchStatus":"patched","product":"Security cameras web server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"hikvision-security-cameras-web-server-cve-2021-36260","stacks":[],"startedAt":"2022-01-10","status":"closed","summary":"A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. CISA added CVE-2021-36260 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Hikvision Improper Input Validation (CVE-2021-36260)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/hikvision-security-cameras-web-server-cve-2021-36260","vendor":"Hikvision"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2020-6572"],"exploited":"in-the-wild","identifiers":["CVE-2020-6572"],"json":"https://helix.ml/threat-watch/i/google-chrome-media-cve-2020-6572.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2020-6572 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"Chrome Media","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chrome-media-cve-2020-6572","stacks":["browser"],"startedAt":"2022-01-10","status":"closed","summary":"Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page. CISA added CVE-2020-6572 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chrome Media Use-After-Free Vulnerability (CVE-2020-6572)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chrome-media-cve-2020-6572","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2019-1458"],"exploited":"in-the-wild","identifiers":["CVE-2019-1458"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-1458.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2019-1458 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2019-1458","stacks":["windows"],"startedAt":"2022-01-10","status":"closed","summary":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP. CISA added CVE-2019-1458 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-1458)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-1458","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2013-3900"],"exploited":"in-the-wild","identifiers":["CVE-2013-3900"],"json":"https://helix.ml/threat-watch/i/microsoft-winverifytrust-function-cve-2013-3900.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2013-3900 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"WinVerifyTrust function","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-winverifytrust-function-cve-2013-3900","stacks":["rust"],"startedAt":"2022-01-10","status":"closed","summary":"A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files. CISA added CVE-2013-3900 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft WinVerifyTrust function Remote Code Execution (CVE-2013-3900)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-winverifytrust-function-cve-2013-3900","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2019-2725"],"exploited":"in-the-wild","identifiers":["CVE-2019-2725"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2019-2725.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2019-2725 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"WebLogic Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2019-2725","stacks":["java"],"startedAt":"2022-01-10","status":"closed","summary":"Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). CISA added CVE-2019-2725 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-74"],"title":"Oracle WebLogic Server, Injection (CVE-2019-2725)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2019-2725","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2019-9670"],"exploited":"in-the-wild","identifiers":["CVE-2019-9670"],"json":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2019-9670.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2019-9670 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"Zimbra Collaboration Suite (ZCS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"synacor-zimbra-collaboration-suite-zcs-cve-2019-9670","stacks":[],"startedAt":"2022-01-10","status":"closed","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component. CISA added CVE-2019-9670 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-611"],"title":"Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference (CVE-2019-9670)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2019-9670","vendor":"Synacor"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2018-13382"],"exploited":"in-the-wild","identifiers":["CVE-2018-13382"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2018-13382.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2018-13382 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"FortiOS and FortiProxy","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-and-fortiproxy-cve-2018-13382","stacks":["network","vpn"],"startedAt":"2022-01-10","status":"closed","summary":"An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. CISA added CVE-2018-13382 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-285"],"title":"Fortinet FortiOS and FortiProxy Improper Authorization (CVE-2018-13382)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2018-13382","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2018-13383"],"exploited":"in-the-wild","identifiers":["CVE-2018-13383"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2018-13383.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2018-13383 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"FortiOS and FortiProxy","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-and-fortiproxy-cve-2018-13383","stacks":["network","vpn"],"startedAt":"2022-01-10","status":"closed","summary":"A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. CISA added CVE-2018-13383 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-787"],"title":"Fortinet FortiOS and FortiProxy Out-of-bounds Write (CVE-2018-13383)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-and-fortiproxy-cve-2018-13383","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2019-1579"],"exploited":"in-the-wild","identifiers":["CVE-2019-1579"],"json":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2019-1579.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2019-1579 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"PAN-OS","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"palo-alto-networks-pan-os-cve-2019-1579","stacks":["network"],"startedAt":"2022-01-10","status":"closed","summary":"Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. CISA added CVE-2019-1579 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-134"],"title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability (CVE-2019-1579)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2019-1579","vendor":"Palo Alto Networks"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2019-10149"],"exploited":"in-the-wild","identifiers":["CVE-2019-10149"],"json":"https://helix.ml/threat-watch/i/exim-mail-transfer-agent-mta-cve-2019-10149.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2019-10149 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"Mail Transfer Agent (MTA)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"exim-mail-transfer-agent-mta-cve-2019-10149","stacks":[],"startedAt":"2022-01-10","status":"closed","summary":"Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. CISA added CVE-2019-10149 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-78"],"title":"Exim Mail Transfer Agent (MTA) Improper Input Validation (CVE-2019-10149)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/exim-mail-transfer-agent-mta-cve-2019-10149","vendor":"Exim"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2015-7450"],"exploited":"in-the-wild","identifiers":["CVE-2015-7450"],"json":"https://helix.ml/threat-watch/i/ibm-websphere-application-server-and-server-hypervisor-edition-cve-2015-7450.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2015-7450 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"WebSphere Application Server and Server Hypervisor Edition","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-websphere-application-server-and-server-hypervisor-edition-cve-2015-7450","stacks":[],"startedAt":"2022-01-10","status":"closed","summary":"Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands. CISA added CVE-2015-7450 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. (CVE-2015-7450)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ibm-websphere-application-server-and-server-hypervisor-edition-cve-2015-7450","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2017-1000486"],"exploited":"in-the-wild","identifiers":["CVE-2017-1000486"],"json":"https://helix.ml/threat-watch/i/primetek-primefaces-application-cve-2017-1000486.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2017-1000486 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"Primefaces Application","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"primetek-primefaces-application-cve-2017-1000486","stacks":[],"startedAt":"2022-01-10","status":"closed","summary":"Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution. CISA added CVE-2017-1000486 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-326"],"title":"Primetek Primefaces Remote Code Execution Vulnerability (CVE-2017-1000486)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/primetek-primefaces-application-cve-2017-1000486","vendor":"Primetek"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2019-7609"],"exploited":"in-the-wild","identifiers":["CVE-2019-7609"],"json":"https://helix.ml/threat-watch/i/elastic-kibana-cve-2019-7609.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2019-7609 to the Known Exploited Vulnerabilities catalog (federal remediation due Jul 10, 2022)"},"patchStatus":"patched","product":"Kibana","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"elastic-kibana-cve-2019-7609","stacks":[],"startedAt":"2022-01-10","status":"closed","summary":"Kibana contain an arbitrary code execution flaw in the Timelion visualizer. CISA added CVE-2019-7609 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Kibana Arbitrary Code Execution (CVE-2019-7609)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/elastic-kibana-cve-2019-7609","vendor":"Elastic"},{"auto":true,"category":"patch","closedAt":"2022-01-24","cveIds":["CVE-2021-27860"],"exploited":"in-the-wild","identifiers":["CVE-2021-27860"],"json":"https://helix.ml/threat-watch/i/fatpipe-warp-ipvpn-and-mpvpn-software-cve-2021-27860.json","latestUpdate":{"date":"2022-01-10","title":"CISA added CVE-2021-27860 to the Known Exploited Vulnerabilities catalog (federal remediation due Jan 24, 2022)"},"patchStatus":"patched","product":"WARP, IPVPN, and MPVPN software","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fatpipe-warp-ipvpn-and-mpvpn-software-cve-2021-27860","stacks":["vpn"],"startedAt":"2022-01-10","status":"closed","summary":"A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. CISA added CVE-2021-27860 to its Known Exploited Vulnerabilities catalog on Jan 10, 2022, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit (CVE-2021-27860)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/fatpipe-warp-ipvpn-and-mpvpn-software-cve-2021-27860","vendor":"FatPipe"},{"auto":true,"category":"breach","closedAt":"2022-01-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOXBIN"],"json":"https://helix.ml/threat-watch/i/doxbin-data-breach.json","latestUpdate":{"date":"2022-01-08","title":"Have I Been Pwned loaded 370K breached Doxbin accounts"},"patchStatus":"no-fix-needed","product":"doxbin.com","severity":"high","severityNote":"370K accounts · passwords exposed","slug":"doxbin-data-breach","stacks":[],"startedAt":"2022-01-08","status":"closed","summary":"In January 2022, the \"doxing\" website designed to disclose the personal information of targeted individuals (\"doxes\") Doxbin suffered a data breach. The breach was subsequently leaked online and included over 370k unique email addresses across user accounts and doxes. User accounts also included usernames, password hashes and browser user agents. The personal information disclosed in the doxes was often extensive including names, physical addresses, phone numbers and more. Exposed data: browser user agent details, email addresses, passwords, usernames. The breach dates from Jan 5, 2022; Have I Been Pwned loaded it on Jan 8, 2022.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","passwords","usernames"],"title":"Doxbin data breach: 370K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/doxbin-data-breach","vendor":"Doxbin"},{"auto":true,"category":"breach","closedAt":"2022-01-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLEXBOOKER"],"json":"https://helix.ml/threat-watch/i/flexbooker-data-breach.json","latestUpdate":{"date":"2022-01-06","title":"Have I Been Pwned loaded 3.8M breached FlexBooker accounts"},"patchStatus":"no-fix-needed","product":"flexbooker.com","severity":"high","severityNote":"3.8M accounts · passwords exposed · financial data exposed","slug":"flexbooker-data-breach","stacks":[],"startedAt":"2022-01-06","status":"closed","summary":"In December 2021, the online booking service FlexBooker suffered a data breach that exposed 3.7 million accounts. The data included email addresses, names, phone numbers and for a small number of accounts, password hashes and partial credit card data. FlexBooker has identified the breach as originating from a compromised account within their AWS infrastructure. The data was found being actively traded on a popular hacking forum. Exposed data: email addresses, names, partial credit card data, passwords, phone numbers. The breach dates from Dec 23, 2021; Have I Been Pwned loaded it on Jan 6, 2022.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","passwords","phone-numbers"],"title":"FlexBooker data breach: 3.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/flexbooker-data-breach","vendor":"FlexBooker"},{"auto":true,"category":"breach","closedAt":"2022-01-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DATPIFF"],"json":"https://helix.ml/threat-watch/i/datpiff-data-breach.json","latestUpdate":{"date":"2022-01-04","title":"Have I Been Pwned loaded 7.5M breached DatPiff accounts"},"patchStatus":"no-fix-needed","product":"datpiff.com","severity":"high","severityNote":"7.5M accounts · passwords exposed","slug":"datpiff-data-breach","stacks":[],"startedAt":"2022-01-04","status":"closed","summary":"In late 2021, email address and plain text password pairs from the rap mixtape website DatPiff appeared for sale on a popular hacking forum. The data allegedly dated back to an earlier breach and in total, contained almost 7.5M email addresses and cracked password pairs. The original data source allegedly contained usernames, security questions and answers and passwords stored as MD5 hashes with a static salt. Exposed data: email addresses, passwords, security questions and answers, usernames. The breach dates from Aug 25, 2021; Have I Been Pwned loaded it on Jan 4, 2022.","tags":["data-breach","hibp","email-addresses","passwords","security-questions-and-answers","usernames"],"title":"DatPiff data breach: 7.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/datpiff-data-breach","vendor":"DatPiff"},{"auto":true,"category":"breach","closedAt":"2022-01-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REDLINESTEALER"],"json":"https://helix.ml/threat-watch/i/redlinestealer-data-breach.json","latestUpdate":{"date":"2021-12-30","title":"Have I Been Pwned loaded 441K breached RedLine Stealer accounts"},"patchStatus":"no-fix-needed","product":"RedLine Stealer","severity":"high","severityNote":"441K accounts · passwords exposed","slug":"redlinestealer-data-breach","stacks":[],"startedAt":"2021-12-30","status":"closed","summary":"In December 2021, logs from the RedLine Stealer malware were left publicly exposed and were then obtained by security researcher Bob Diachenko. The data included 441 thousand unique email addresses, usernames and plain text passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 5, 2021; Have I Been Pwned loaded it on Dec 30, 2021.","tags":["data-breach","hibp","malware","email-addresses","passwords","usernames"],"title":"RedLine Stealer data breach: 441K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/redlinestealer-data-breach","vendor":"RedLine Stealer"},{"auto":true,"category":"breach","closedAt":"2022-01-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROTEMPS"],"json":"https://helix.ml/threat-watch/i/protemps-data-breach.json","latestUpdate":{"date":"2021-12-20","title":"Have I Been Pwned loaded 49K breached Protemps accounts"},"patchStatus":"no-fix-needed","product":"protemps.com.sg","severity":"high","severityNote":"49K accounts · passwords exposed","slug":"protemps-data-breach","stacks":[],"startedAt":"2021-12-20","status":"closed","summary":"In October 2021, the Singaporean recruitment website Protemps suffered a data breach that exposed almost 50,000 unique email addresses. The impacted data includes names, email and physical addresses, phone numbers, passport numbers and passwords stored as unsalted MD5 hashes, among troves of other jobseeker data. Exposed data: email addresses, genders, job applications, marital statuses, names, nationalities, passport numbers, passwords, phone numbers, physical addresses, religions, salutations. The breach dates from Oct 4, 2021; Have I Been Pwned loaded it on Dec 20, 2021.","tags":["data-breach","hibp","email-addresses","genders","job-applications","marital-statuses","names","nationalities","passport-numbers","passwords","phone-numbers","physical-addresses","religions","salutations"],"title":"Protemps data breach: 49K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/protemps-data-breach","vendor":"Protemps"},{"auto":true,"category":"patch","closedAt":"2021-12-29","cveIds":["CVE-2021-43890"],"exploited":"in-the-wild","identifiers":["CVE-2021-43890"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-43890.json","latestUpdate":{"date":"2021-12-15","title":"CISA added CVE-2021-43890 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 29, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-43890","stacks":["windows"],"startedAt":"2021-12-15","status":"closed","summary":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. CISA added CVE-2021-43890 to its Known Exploited Vulnerabilities catalog on Dec 15, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware"],"title":"Microsoft Windows AppX Installer Spoofing Vulnerability (CVE-2021-43890)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-43890","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-12-29","cveIds":["CVE-2021-4102"],"exploited":"in-the-wild","identifiers":["CVE-2021-4102"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-4102.json","latestUpdate":{"date":"2021-12-15","title":"CISA added CVE-2021-4102 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 29, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-4102","stacks":["browser"],"startedAt":"2021-12-15","status":"closed","summary":"Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-4102 to its Known Exploited Vulnerabilities catalog on Dec 15, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium V8 Use-After-Free Vulnerability (CVE-2021-4102)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-4102","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2021-44515"],"exploited":"in-the-wild","identifiers":["CVE-2021-44515"],"json":"https://helix.ml/threat-watch/i/zoho-desktop-central-cve-2021-44515.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2021-44515 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2021)"},"patchStatus":"patched","product":"Desktop Central","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-desktop-central-cve-2021-44515","stacks":[],"startedAt":"2021-12-10","status":"closed","summary":"Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. CISA added CVE-2021-44515 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass"],"title":"Zoho Desktop Central Authentication Bypass Vulnerability (CVE-2021-44515)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zoho-desktop-central-cve-2021-44515","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2019-13272"],"exploited":"in-the-wild","identifiers":["CVE-2019-13272"],"json":"https://helix.ml/threat-watch/i/linux-kernel-cve-2019-13272.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2019-13272 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"linux-kernel-cve-2019-13272","stacks":["linux"],"startedAt":"2021-12-10","status":"closed","summary":"Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access. CISA added CVE-2019-13272 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-269"],"title":"Linux Kernel Improper Privilege Management Vulnerability (CVE-2019-13272)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2019-13272","vendor":"Linux"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2021-35394"],"exploited":"in-the-wild","identifiers":["CVE-2021-35394"],"json":"https://helix.ml/threat-watch/i/realtek-jungle-software-development-kit-sdk-cve-2021-35394.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2021-35394 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2021)"},"patchStatus":"patched","product":"Jungle Software Development Kit (SDK)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"realtek-jungle-software-development-kit-sdk-cve-2021-35394","stacks":[],"startedAt":"2021-12-10","status":"closed","summary":"RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution. CISA added CVE-2021-35394 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-78","cwe-138"],"title":"Realtek Jungle SDK Remote Code Execution Vulnerability (CVE-2021-35394)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/realtek-jungle-software-development-kit-sdk-cve-2021-35394","vendor":"Realtek"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2019-7238"],"exploited":"in-the-wild","identifiers":["CVE-2019-7238"],"json":"https://helix.ml/threat-watch/i/sonatype-nexus-repository-manager-cve-2019-7238.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2019-7238 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"Nexus Repository Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonatype-nexus-repository-manager-cve-2019-7238","stacks":[],"startedAt":"2021-12-10","status":"closed","summary":"Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution. CISA added CVE-2019-7238 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability (CVE-2019-7238)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonatype-nexus-repository-manager-cve-2019-7238","vendor":"Sonatype"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2019-0193"],"exploited":"in-the-wild","identifiers":["CVE-2019-0193"],"json":"https://helix.ml/threat-watch/i/apache-solr-cve-2019-0193.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2019-0193 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"Solr","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-solr-cve-2019-0193","stacks":[],"startedAt":"2021-12-10","status":"closed","summary":"The optional Apache Solr module DataImportHandler contains a code injection vulnerability. CISA added CVE-2019-0193 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"Apache Solr DataImportHandler Code Injection Vulnerability (CVE-2019-0193)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-solr-cve-2019-0193","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2021-44168"],"exploited":"in-the-wild","identifiers":["CVE-2021-44168"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2021-44168.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2021-44168 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2021)"},"patchStatus":"patched","product":"FortiOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2021-44168","stacks":["network","vpn"],"startedAt":"2021-12-10","status":"closed","summary":"Fortinet FortiOS \"execute restore src-vis\" downloads code without integrity checking, allowing an attacker to arbitrarily download files. CISA added CVE-2021-44168 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-494"],"title":"Fortinet FortiOS Arbitrary File Download (CVE-2021-44168)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2021-44168","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2017-17562"],"exploited":"in-the-wild","identifiers":["CVE-2017-17562"],"json":"https://helix.ml/threat-watch/i/embedthis-goahead-cve-2017-17562.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2017-17562 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"GoAhead","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"embedthis-goahead-cve-2017-17562","stacks":[],"startedAt":"2021-12-10","status":"closed","summary":"Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. CISA added CVE-2017-17562 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Embedthis GoAhead Remote Code Execution Vulnerability (CVE-2017-17562)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/embedthis-goahead-cve-2017-17562","vendor":"Embedthis"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2017-12149"],"exploited":"in-the-wild","identifiers":["CVE-2017-12149"],"json":"https://helix.ml/threat-watch/i/red-hat-jboss-application-server-cve-2017-12149.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2017-12149 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"JBoss Application Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-jboss-application-server-cve-2017-12149","stacks":["java","linux"],"startedAt":"2021-12-10","status":"closed","summary":"The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data. CISA added CVE-2017-12149 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-502"],"title":"Red Hat JBoss Application Server Remote Code Execution Vulnerability (CVE-2017-12149)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/red-hat-jboss-application-server-cve-2017-12149","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2010-1871"],"exploited":"in-the-wild","identifiers":["CVE-2010-1871"],"json":"https://helix.ml/threat-watch/i/red-hat-jboss-seam-2-cve-2010-1871.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2010-1871 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"JBoss Seam 2","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"red-hat-jboss-seam-2-cve-2010-1871","stacks":["java","linux"],"startedAt":"2021-12-10","status":"closed","summary":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured. CISA added CVE-2010-1871 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability (CVE-2010-1871)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/red-hat-jboss-seam-2-cve-2010-1871","vendor":"Red Hat"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2020-17463"],"exploited":"in-the-wild","identifiers":["CVE-2020-17463"],"json":"https://helix.ml/threat-watch/i/fuel-cms-fuel-cms-cve-2020-17463.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2020-17463 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"Fuel CMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fuel-cms-fuel-cms-cve-2020-17463","stacks":[],"startedAt":"2021-12-10","status":"closed","summary":"FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. CISA added CVE-2020-17463 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","sql-injection","cwe-89"],"title":"Fuel CMS SQL Injection Vulnerability (CVE-2020-17463)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/fuel-cms-fuel-cms-cve-2020-17463","vendor":"Fuel CMS"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2020-8816"],"exploited":"in-the-wild","identifiers":["CVE-2020-8816"],"json":"https://helix.ml/threat-watch/i/pi-hole-adminlte-cve-2020-8816.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2020-8816 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"AdminLTE","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"pi-hole-adminlte-cve-2020-8816","stacks":[],"startedAt":"2021-12-10","status":"closed","summary":"Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. CISA added CVE-2020-8816 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Pi-Hole AdminLTE Remote Code Execution Vulnerability (CVE-2020-8816)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/pi-hole-adminlte-cve-2020-8816","vendor":"Pi-hole"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2019-10758"],"exploited":"in-the-wild","identifiers":["CVE-2019-10758"],"json":"https://helix.ml/threat-watch/i/mongodb-mongo-express-cve-2019-10758.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2019-10758 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 10, 2022)"},"patchStatus":"patched","product":"mongo-express","severity":"critical","severityNote":"CVSS 9.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"mongodb-mongo-express-cve-2019-10758","stacks":["database","node"],"startedAt":"2021-12-10","status":"closed","summary":"mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. CISA added CVE-2019-10758 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"MongoDB mongo-express Remote Code Execution Vulnerability (CVE-2019-10758)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mongodb-mongo-express-cve-2019-10758","vendor":"MongoDB"},{"auto":true,"category":"patch","closedAt":"2021-12-24","cveIds":["CVE-2021-44228"],"exploited":"in-the-wild","identifiers":["CVE-2021-44228"],"json":"https://helix.ml/threat-watch/i/apache-log4j2-cve-2021-44228.json","latestUpdate":{"date":"2021-12-10","title":"CISA added CVE-2021-44228 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 24, 2021)"},"patchStatus":"patched","product":"Log4j2","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-log4j2-cve-2021-44228","stacks":["java"],"startedAt":"2021-12-10","status":"closed","summary":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. CISA added CVE-2021-44228 to its Known Exploited Vulnerabilities catalog on Dec 10, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-400","cwe-502"],"title":"Apache Log4j2 Remote Code Execution Vulnerability (CVE-2021-44228)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-log4j2-cve-2021-44228","vendor":"Apache"},{"auto":true,"category":"breach","closedAt":"2021-12-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GRAVATAR"],"json":"https://helix.ml/threat-watch/i/gravatar-data-breach.json","latestUpdate":{"date":"2021-12-05","title":"Have I Been Pwned loaded 114.0M breached Gravatar accounts"},"patchStatus":"no-fix-needed","product":"gravatar.com","severity":"high","severityNote":"114.0M accounts","slug":"gravatar-data-breach","stacks":[],"startedAt":"2021-12-05","status":"closed","summary":"In October 2020, a security researcher published a technique for scraping large volumes of data from Gravatar, the service for providing globally unique avatars. 167 million names, usernames and MD5 hashes of email addresses used to reference users' avatars were subsequently scraped and distributed within the hacking community. 114 million of the MD5 hashes were cracked and distributed alongside the source hash, thus disclosing the original email address and accompanying data. Following the impacted email addresses being searchable in HIBP, Gravatar release an FAQ detailing the incident. Exposed data: email addresses, names, usernames. The breach dates from Oct 3, 2020; Have I Been Pwned loaded it on Dec 5, 2021.","tags":["data-breach","hibp","email-addresses","names","usernames"],"title":"Gravatar data breach: 114.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gravatar-data-breach","vendor":"Gravatar"},{"auto":true,"category":"patch","closedAt":"2021-12-15","cveIds":["CVE-2020-11261"],"exploited":"in-the-wild","identifiers":["CVE-2020-11261"],"json":"https://helix.ml/threat-watch/i/qualcomm-snapdragon-auto-snapdragon-compute-snapdragon-connectivity-snapdragon-consumer-iot-snapdragon-industrial-iot-sn.json","latestUpdate":{"date":"2021-12-01","title":"CISA added CVE-2020-11261 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 1, 2022)"},"patchStatus":"patched","product":"Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-snapdragon-auto-snapdragon-compute-snapdragon-connectivity-snapdragon-consumer-iot-snapdragon-industrial-iot-sn","stacks":[],"startedAt":"2021-12-01","status":"closed","summary":"Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables. CISA added CVE-2020-11261 to its Known Exploited Vulnerabilities catalog on Dec 1, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-20"],"title":"Qualcomm Multiple Chipsets Improper Input Validation Vulnerability (CVE-2020-11261)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/qualcomm-snapdragon-auto-snapdragon-compute-snapdragon-connectivity-snapdragon-consumer-iot-snapdragon-industrial-iot-sn","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2021-12-15","cveIds":["CVE-2018-14847"],"exploited":"in-the-wild","identifiers":["CVE-2018-14847"],"json":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2018-14847.json","latestUpdate":{"date":"2021-12-01","title":"CISA added CVE-2018-14847 to the Known Exploited Vulnerabilities catalog (federal remediation due Jun 1, 2022)"},"patchStatus":"patched","product":"RouterOS","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"mikrotik-routeros-cve-2018-14847","stacks":["network"],"startedAt":"2021-12-01","status":"closed","summary":"MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. CISA added CVE-2018-14847 to its Known Exploited Vulnerabilities catalog on Dec 1, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"MikroTik Router OS Directory Traversal Vulnerability (CVE-2018-14847)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2018-14847","vendor":"MikroTik"},{"auto":true,"category":"patch","closedAt":"2021-12-15","cveIds":["CVE-2021-37415"],"exploited":"in-the-wild","identifiers":["CVE-2021-37415"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-servicedesk-plus-sdp-cve-2021-37415.json","latestUpdate":{"date":"2021-12-01","title":"CISA added CVE-2021-37415 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 15, 2021)"},"patchStatus":"patched","product":"ManageEngine ServiceDesk Plus (SDP)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-servicedesk-plus-sdp-cve-2021-37415","stacks":[],"startedAt":"2021-12-01","status":"closed","summary":"Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. CISA added CVE-2021-37415 to its Known Exploited Vulnerabilities catalog on Dec 1, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability (CVE-2021-37415)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-servicedesk-plus-sdp-cve-2021-37415","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2021-12-15","cveIds":["CVE-2021-40438"],"exploited":"in-the-wild","identifiers":["CVE-2021-40438"],"json":"https://helix.ml/threat-watch/i/apache-apache-cve-2021-40438.json","latestUpdate":{"date":"2021-12-01","title":"CISA added CVE-2021-40438 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 15, 2021)"},"patchStatus":"patched","product":"Apache","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-apache-cve-2021-40438","stacks":[],"startedAt":"2021-12-01","status":"closed","summary":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. CISA added CVE-2021-40438 to its Known Exploited Vulnerabilities catalog on Dec 1, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","ssrf","cwe-918"],"title":"Apache HTTP Server-Side Request Forgery (SSRF) (CVE-2021-40438)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/apache-apache-cve-2021-40438","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-12-15","cveIds":["CVE-2021-44077"],"exploited":"in-the-wild","identifiers":["CVE-2021-44077"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-servicedesk-plus-sdp-supportcenter-plus-cve-2021-44077.json","latestUpdate":{"date":"2021-12-01","title":"CISA added CVE-2021-44077 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 15, 2021)"},"patchStatus":"patched","product":"ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-servicedesk-plus-sdp-supportcenter-plus-cve-2021-44077","stacks":[],"startedAt":"2021-12-01","status":"closed","summary":"Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. CISA added CVE-2021-44077 to its Known Exploited Vulnerabilities catalog on Dec 1, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-306"],"title":"Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-44077)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-servicedesk-plus-sdp-supportcenter-plus-cve-2021-44077","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2021-12-01","cveIds":["CVE-2021-22204"],"exploited":"in-the-wild","identifiers":["CVE-2021-22204"],"json":"https://helix.ml/threat-watch/i/perl-exiftool-cve-2021-22204.json","latestUpdate":{"date":"2021-11-17","title":"CISA added CVE-2021-22204 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 1, 2021)"},"patchStatus":"patched","product":"Exiftool","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"perl-exiftool-cve-2021-22204","stacks":[],"startedAt":"2021-11-17","status":"closed","summary":"Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image. CISA added CVE-2021-22204 to its Known Exploited Vulnerabilities catalog on Nov 17, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-95"],"title":"ExifTool Remote Code Execution Vulnerability (CVE-2021-22204)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/perl-exiftool-cve-2021-22204","vendor":"Perl"},{"auto":true,"category":"patch","closedAt":"2021-12-01","cveIds":["CVE-2021-40449"],"exploited":"in-the-wild","identifiers":["CVE-2021-40449"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-40449.json","latestUpdate":{"date":"2021-11-17","title":"CISA added CVE-2021-40449 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 1, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-40449","stacks":["windows"],"startedAt":"2021-11-17","status":"closed","summary":"Unspecified vulnerability allows for an authenticated user to escalate privileges. CISA added CVE-2021-40449 to its Known Exploited Vulnerabilities catalog on Nov 17, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-416"],"title":"Microsoft Windows Win32k Privilege Escalation Vulnerability (CVE-2021-40449)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-40449","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-12-01","cveIds":["CVE-2021-42321"],"exploited":"in-the-wild","identifiers":["CVE-2021-42321"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-cve-2021-42321.json","latestUpdate":{"date":"2021-11-17","title":"CISA added CVE-2021-42321 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 1, 2021)"},"patchStatus":"patched","product":"Exchange","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-cve-2021-42321","stacks":["windows"],"startedAt":"2021-11-17","status":"closed","summary":"An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution. CISA added CVE-2021-42321 to its Known Exploited Vulnerabilities catalog on Nov 17, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-184","cwe-502"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-42321)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-cve-2021-42321","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-12-01","cveIds":["CVE-2021-42292"],"exploited":"in-the-wild","identifiers":["CVE-2021-42292"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2021-42292.json","latestUpdate":{"date":"2021-11-17","title":"CISA added CVE-2021-42292 to the Known Exploited Vulnerabilities catalog (federal remediation due Dec 1, 2021)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2021-42292","stacks":["windows"],"startedAt":"2021-11-17","status":"closed","summary":"A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. CISA added CVE-2021-42292 to its Known Exploited Vulnerabilities catalog on Nov 17, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-357"],"title":"Microsoft Excel Security Feature Bypass (CVE-2021-42292)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2021-42292","vendor":"Microsoft"},{"auto":true,"category":"breach","closedAt":"2021-12-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IDCGAMES"],"json":"https://helix.ml/threat-watch/i/idcgames-data-breach.json","latestUpdate":{"date":"2021-11-17","title":"Have I Been Pwned loaded 4.0M breached IDC Games accounts"},"patchStatus":"no-fix-needed","product":"idcgames.com","severity":"high","severityNote":"4.0M accounts · passwords exposed","slug":"idcgames-data-breach","stacks":[],"startedAt":"2021-11-17","status":"closed","summary":"In March 2021, 4 million records sourced from IDC Games were shared on a public hacking forum. The data included usernames, email addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Mar 15, 2021; Have I Been Pwned loaded it on Nov 17, 2021.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"IDC Games data breach: 4.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/idcgames-data-breach","vendor":"IDC Games"},{"auto":true,"category":"breach","closedAt":"2021-11-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DUCKSUNLIMITED"],"json":"https://helix.ml/threat-watch/i/ducksunlimited-data-breach.json","latestUpdate":{"date":"2021-11-16","title":"Have I Been Pwned loaded 1.3M breached Ducks Unlimited accounts"},"patchStatus":"no-fix-needed","product":"ducks.org","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"ducksunlimited-data-breach","stacks":[],"startedAt":"2021-11-16","status":"closed","summary":"In mid-2021, Risk Based Security reported on a database sourced from Ducks Unlimited being traded online. The data dated back to January 2021 and contained 1.3M unique email addresses across both a membership list and a list of website users. Impacted data included names, phones numbers, physical addresses, dates of birth and passwords stored as unsalted MD5 hashes. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jan 29, 2021; Have I Been Pwned loaded it on Nov 16, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Ducks Unlimited data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ducksunlimited-data-breach","vendor":"Ducks Unlimited"},{"auto":true,"category":"breach","closedAt":"2021-11-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CYBERSERVE"],"json":"https://helix.ml/threat-watch/i/cyberserve-data-breach.json","latestUpdate":{"date":"2021-11-04","title":"Have I Been Pwned loaded 1.1M breached CyberServe accounts"},"patchStatus":"no-fix-needed","product":"cyberserve.co.il","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"cyberserve-data-breach","stacks":[],"startedAt":"2021-11-04","status":"closed","summary":"In October 2021, the Israeli hosting provider CyberServe was breached and ransomed before having a substantial amount of their customer data leaked publicly by a group known as \"Black Shadow\". Amongst the data was the LGBTQ dating site Atraf and the Machon Mor medical institute. Due to multiple different sites being compromised, the impacted data is broad and ranges from relationship information to medical data to email addresses and passwords stored in plain text. The data was made available to HIBP with support from May Brooks-Kempler, founder of the Think Safe Cyber community in Israel. Exposed data: dates of birth, drinking habits, email addresses, family structure, genders, geographic locations, hiv statuses, ip addresses, names, passwords, personal health data, phone numbers, physical attributes, private messages, profile photos, religions, sexual orientations, smoking habits, usernames. The breach dates from Oct 29, 2021; Have I Been Pwned loaded it on Nov 4, 2021.","tags":["data-breach","hibp","dates-of-birth","drinking-habits","email-addresses","family-structure","genders","geographic-locations","hiv-statuses","ip-addresses","names","passwords","personal-health-data","phone-numbers"],"title":"CyberServe data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cyberserve-data-breach","vendor":"CyberServe"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-16017"],"exploited":"in-the-wild","identifiers":["CVE-2020-16017"],"json":"https://helix.ml/threat-watch/i/google-chrome-cve-2020-16017.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-16017 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Chrome","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chrome-cve-2020-16017","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. CISA added CVE-2020-16017 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chrome Use-After-Free Vulnerability (CVE-2020-16017)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chrome-cve-2020-16017","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-37976"],"exploited":"in-the-wild","identifiers":["CVE-2021-37976"],"json":"https://helix.ml/threat-watch/i/google-chromium-cve-2021-37976.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-37976 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-cve-2021-37976","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-37976 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-862"],"title":"Google Chromium Information Disclosure Vulnerability (CVE-2021-37976)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-cve-2021-37976","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-16009"],"exploited":"in-the-wild","identifiers":["CVE-2020-16009"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2020-16009.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-16009 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2020-16009","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2020-16009 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2020-16009)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2020-16009","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30632"],"exploited":"in-the-wild","identifiers":["CVE-2021-30632"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-30632.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30632 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-30632","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-30632 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"Google Chromium V8 Out-of-Bounds Write Vulnerability (CVE-2021-30632)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-30632","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-16013"],"exploited":"in-the-wild","identifiers":["CVE-2020-16013"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2020-16013.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-16013 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2020-16013","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2020-16013 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-787"],"title":"Google Chromium V8 Incorrect Implementation Vulnerabililty (CVE-2020-16013)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2020-16013","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30633"],"exploited":"in-the-wild","identifiers":["CVE-2021-30633"],"json":"https://helix.ml/threat-watch/i/google-chromium-indexed-db-api-cve-2021-30633.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30633 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium Indexed DB API","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-indexed-db-api-cve-2021-30633","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-30633 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium Indexed DB API Use-After-Free Vulnerability (CVE-2021-30633)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-indexed-db-api-cve-2021-30633","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21148"],"exploited":"in-the-wild","identifiers":["CVE-2021-21148"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-21148.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21148 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-21148","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-21148 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"Google Chromium V8 Heap Buffer Overflow Vulnerability (CVE-2021-21148)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-21148","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-37973"],"exploited":"in-the-wild","identifiers":["CVE-2021-37973"],"json":"https://helix.ml/threat-watch/i/google-chromium-portals-cve-2021-37973.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-37973 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium Portals","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-portals-cve-2021-37973","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. CISA added CVE-2021-37973 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium Portals Use-After-Free Vulnerability (CVE-2021-37973)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-portals-cve-2021-37973","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30551"],"exploited":"in-the-wild","identifiers":["CVE-2021-30551"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-30551.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30551 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-30551","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-30551 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2021-30551)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-30551","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-37975"],"exploited":"in-the-wild","identifiers":["CVE-2021-37975"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-37975.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-37975 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-37975","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-37975 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium V8 Use-After-Free Vulnerability (CVE-2021-37975)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-37975","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-6418"],"exploited":"in-the-wild","identifiers":["CVE-2020-6418"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2020-6418.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-6418 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2020-6418","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2020-6418 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2020-6418)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2020-6418","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30554"],"exploited":"in-the-wild","identifiers":["CVE-2021-30554"],"json":"https://helix.ml/threat-watch/i/google-chromium-webgl-cve-2021-30554.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30554 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium WebGL","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-webgl-cve-2021-30554","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-30554 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium WebGL Use-After-Free Vulnerability (CVE-2021-30554)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-webgl-cve-2021-30554","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21206"],"exploited":"in-the-wild","identifiers":["CVE-2021-21206"],"json":"https://helix.ml/threat-watch/i/google-chromium-blink-cve-2021-21206.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21206 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium Blink","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-blink-cve-2021-21206","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-21206 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium Blink Use-After-Free Vulnerability (CVE-2021-21206)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-blink-cve-2021-21206","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-38000"],"exploited":"in-the-wild","identifiers":["CVE-2021-38000"],"json":"https://helix.ml/threat-watch/i/google-chromium-intents-cve-2021-38000.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-38000 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium Intents","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-intents-cve-2021-38000","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-38000 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Google Chromium Intents Improper Input Validation Vulnerability (CVE-2021-38000)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-intents-cve-2021-38000","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-38003"],"exploited":"in-the-wild","identifiers":["CVE-2021-38003"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-38003.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-38003 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-38003","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-38003 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122","cwe-755"],"title":"Google Chromium V8 Memory Corruption Vulnerability (CVE-2021-38003)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-38003","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21224"],"exploited":"in-the-wild","identifiers":["CVE-2021-21224"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-21224.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21224 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-21224","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-21224 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2021-21224)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-21224","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21193"],"exploited":"in-the-wild","identifiers":["CVE-2021-21193"],"json":"https://helix.ml/threat-watch/i/google-chromium-blink-cve-2021-21193.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21193 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium Blink","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-blink-cve-2021-21193","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-21193 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Google Chromium Blink Use-After-Free Vulnerability (CVE-2021-21193)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-blink-cve-2021-21193","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21220"],"exploited":"in-the-wild","identifiers":["CVE-2021-21220"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-21220.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21220 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-21220","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-21220 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20","cwe-122"],"title":"Google Chromium V8 Improper Input Validation Vulnerability (CVE-2021-21220)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-21220","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30563"],"exploited":"in-the-wild","identifiers":["CVE-2021-30563"],"json":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-30563.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30563 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium V8","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-v8-cve-2021-30563","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-30563 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122","cwe-843"],"title":"Google Chromium V8 Type Confusion Vulnerability (CVE-2021-30563)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/google-chromium-v8-cve-2021-30563","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-4430"],"exploited":"in-the-wild","identifiers":["CVE-2020-4430"],"json":"https://helix.ml/threat-watch/i/ibm-data-risk-manager-cve-2020-4430.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-4430 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Data Risk Manager","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-data-risk-manager-cve-2020-4430","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system. CISA added CVE-2020-4430 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"IBM Data Risk Manager Directory Traversal Vulnerability (CVE-2020-4430)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ibm-data-risk-manager-cve-2020-4430","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-4427"],"exploited":"in-the-wild","identifiers":["CVE-2020-4427"],"json":"https://helix.ml/threat-watch/i/ibm-data-risk-manager-cve-2020-4427.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-4427 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Data Risk Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-data-risk-manager-cve-2020-4427","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. CISA added CVE-2020-4427 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"IBM Data Risk Manager Security Bypass Vulnerability (CVE-2020-4427)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ibm-data-risk-manager-cve-2020-4427","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-4428"],"exploited":"in-the-wild","identifiers":["CVE-2020-4428"],"json":"https://helix.ml/threat-watch/i/ibm-data-risk-manager-cve-2020-4428.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-4428 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Data Risk Manager","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-data-risk-manager-cve-2020-4428","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�. CISA added CVE-2020-4428 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"IBM Data Risk Manager Remote Code Execution Vulnerability (CVE-2020-4428)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ibm-data-risk-manager-cve-2020-4428","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-4716"],"exploited":"in-the-wild","identifiers":["CVE-2019-4716"],"json":"https://helix.ml/threat-watch/i/ibm-planning-analytics-cve-2019-4716.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-4716 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Planning Analytics","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ibm-planning-analytics-cve-2019-4716","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as \"admin\", and then execute code as root or SYSTEM via TM1 scripting. CISA added CVE-2019-4716 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"IBM Planning Analytics Remote Code Execution Vulnerability (CVE-2019-4716)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ibm-planning-analytics-cve-2019-4716","vendor":"IBM"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-3715"],"exploited":"in-the-wild","identifiers":["CVE-2016-3715"],"json":"https://helix.ml/threat-watch/i/imagemagick-imagemagick-cve-2016-3715.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-3715 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ImageMagick","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"imagemagick-imagemagick-cve-2016-3715","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading. CISA added CVE-2016-3715 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"ImageMagick Arbitrary File Deletion Vulnerability (CVE-2016-3715)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/imagemagick-imagemagick-cve-2016-3715","vendor":"ImageMagick"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-3718"],"exploited":"in-the-wild","identifiers":["CVE-2016-3718"],"json":"https://helix.ml/threat-watch/i/imagemagick-imagemagick-cve-2016-3718.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-3718 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ImageMagick","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"imagemagick-imagemagick-cve-2016-3718","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image. CISA added CVE-2016-3718 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","ssrf","cwe-20"],"title":"ImageMagick Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-3718)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/imagemagick-imagemagick-cve-2016-3718","vendor":"ImageMagick"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-15505"],"exploited":"in-the-wild","identifiers":["CVE-2020-15505"],"json":"https://helix.ml/threat-watch/i/ivanti-mobileiron-multiple-products-cve-2020-15505.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-15505 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"MobileIron Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-mobileiron-multiple-products-cve-2020-15505","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti MobileIron's Core \u0026 Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution. CISA added CVE-2020-15505 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-706"],"title":"Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability (CVE-2020-15505)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-mobileiron-multiple-products-cve-2020-15505","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30116"],"exploited":"in-the-wild","identifiers":["CVE-2021-30116"],"json":"https://helix.ml/threat-watch/i/kaseya-virtual-system-server-administrator-vsa-cve-2021-30116.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30116 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Virtual System/Server Administrator (VSA)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"kaseya-virtual-system-server-administrator-vsa-cve-2021-30116","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system. CISA added CVE-2021-30116 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-522"],"title":"Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability (CVE-2021-30116)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/kaseya-virtual-system-server-administrator-vsa-cve-2021-30116","vendor":"Kaseya"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-7961"],"exploited":"in-the-wild","identifiers":["CVE-2020-7961"],"json":"https://helix.ml/threat-watch/i/liferay-liferay-portal-cve-2020-7961.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-7961 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Liferay Portal","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"liferay-liferay-portal-cve-2020-7961","stacks":["rust"],"startedAt":"2021-11-03","status":"closed","summary":"Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services. CISA added CVE-2020-7961 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Liferay Portal Deserialization of Untrusted Data Vulnerability (CVE-2020-7961)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/liferay-liferay-portal-cve-2020-7961","vendor":"Liferay"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-23874"],"exploited":"in-the-wild","identifiers":["CVE-2021-23874"],"json":"https://helix.ml/threat-watch/i/mcafee-mcafee-total-protection-mtp-cve-2021-23874.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-23874 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"McAfee Total Protection (MTP)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mcafee-mcafee-total-protection-mtp-cve-2021-23874","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense. CISA added CVE-2021-23874 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"McAfee Total Protection (MTP) Improper Privilege Management Vulnerability (CVE-2021-23874)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mcafee-mcafee-total-protection-mtp-cve-2021-23874","vendor":"McAfee"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22506"],"exploited":"in-the-wild","identifiers":["CVE-2021-22506"],"json":"https://helix.ml/threat-watch/i/micro-focus-micro-focus-access-manager-cve-2021-22506.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22506 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Micro Focus Access Manager","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"micro-focus-micro-focus-access-manager-cve-2021-22506","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used. CISA added CVE-2021-22506 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Micro Focus Access Manager Information Leakage Vulnerability (CVE-2021-22506)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/micro-focus-micro-focus-access-manager-cve-2021-22506","vendor":"Micro Focus"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22502"],"exploited":"in-the-wild","identifiers":["CVE-2021-22502"],"json":"https://helix.ml/threat-watch/i/micro-focus-operation-bridge-reporter-obr-cve-2021-22502.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22502 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Operation Bridge Reporter (OBR)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"micro-focus-operation-bridge-reporter-obr-cve-2021-22502","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-22502 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20","cwe-78"],"title":"Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability (CVE-2021-22502)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/micro-focus-operation-bridge-reporter-obr-cve-2021-22502","vendor":"Micro Focus"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2014-1812"],"exploited":"in-the-wild","identifiers":["CVE-2014-1812"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-1812.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2014-1812 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2014-1812","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain. CISA added CVE-2014-1812 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-255"],"title":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability (CVE-2014-1812)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2014-1812","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-38647"],"exploited":"in-the-wild","identifiers":["CVE-2021-38647"],"json":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38647.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-38647 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Open Management Infrastructure (OMI)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-open-management-infrastructure-omi-cve-2021-38647","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution. CISA added CVE-2021-38647 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-1390"],"title":"Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability (CVE-2021-38647)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38647","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-0167"],"exploited":"in-the-wild","identifiers":["CVE-2016-0167"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2016-0167.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-0167 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2016-0167","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application. CISA added CVE-2016-0167 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-264"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2016-0167)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2016-0167","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0878"],"exploited":"in-the-wild","identifiers":["CVE-2020-0878"],"json":"https://helix.ml/threat-watch/i/microsoft-edge-and-internet-explorer-cve-2020-0878.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0878 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Edge and Internet Explorer","severity":"medium","severityNote":"CVSS 4.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-edge-and-internet-explorer-cve-2020-0878","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user. CISA added CVE-2020-0878 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-787"],"title":"Microsoft Edge and Internet Explorer Memory Corruption Vulnerability (CVE-2020-0878)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-edge-and-internet-explorer-cve-2020-0878","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-31955"],"exploited":"in-the-wild","identifiers":["CVE-2021-31955"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-31955.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-31955 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-31955","stacks":["linux","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process. CISA added CVE-2021-31955 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-497"],"title":"Microsoft Windows Kernel Information Disclosure Vulnerability (CVE-2021-31955)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-31955","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1647"],"exploited":"in-the-wild","identifiers":["CVE-2021-1647"],"json":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2021-1647.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1647 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Defender","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-defender-cve-2021-1647","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Defender contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-1647 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-122","cwe-1285"],"title":"Microsoft Defender Remote Code Execution Vulnerability (CVE-2021-1647)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-defender-cve-2021-1647","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-33739"],"exploited":"in-the-wild","identifiers":["CVE-2021-33739"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-33739.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-33739 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-33739","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-33739 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability (CVE-2021-33739)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-33739","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-0185"],"exploited":"in-the-wild","identifiers":["CVE-2016-0185"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-0185.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-0185 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2016-0185","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. CISA added CVE-2016-0185 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Windows Media Center Remote Code Execution Vulnerability (CVE-2016-0185)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2016-0185","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0683"],"exploited":"in-the-wild","identifiers":["CVE-2020-0683"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0683.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0683 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-0683","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. CISA added CVE-2020-0683 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Installer Privilege Escalation Vulnerability (CVE-2020-0683)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0683","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-17087"],"exploited":"in-the-wild","identifiers":["CVE-2020-17087"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-17087.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-17087 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-17087","stacks":["linux","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2020-17087 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-131"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2020-17087)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-17087","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-33742"],"exploited":"in-the-wild","identifiers":["CVE-2021-33742"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-33742.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-33742 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-33742","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-33742 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-787","cwe-823"],"title":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-33742","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-31199"],"exploited":"in-the-wild","identifiers":["CVE-2021-31199"],"json":"https://helix.ml/threat-watch/i/microsoft-enhanced-cryptographic-provider-cve-2021-31199.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-31199 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Enhanced Cryptographic Provider","severity":"medium","severityNote":"CVSS 5.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-enhanced-cryptographic-provider-cve-2021-31199","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-31199 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (CVE-2021-31199)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-enhanced-cryptographic-provider-cve-2021-31199","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-33771"],"exploited":"in-the-wild","identifiers":["CVE-2021-33771"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-33771.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-33771 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-33771","stacks":["linux","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-33771 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-119"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2021-33771)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-33771","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-31956"],"exploited":"in-the-wild","identifiers":["CVE-2021-31956"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-31956.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-31956 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-31956","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. CISA added CVE-2021-31956 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-191","cwe-787"],"title":"Microsoft Windows NTFS Privilege Escalation Vulnerability (CVE-2021-31956)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-31956","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-31201"],"exploited":"in-the-wild","identifiers":["CVE-2021-31201"],"json":"https://helix.ml/threat-watch/i/microsoft-enhanced-cryptographic-provider-cve-2021-31201.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-31201 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Enhanced Cryptographic Provider","severity":"medium","severityNote":"CVSS 5.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-enhanced-cryptographic-provider-cve-2021-31201","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-31201 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (CVE-2021-31201)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-enhanced-cryptographic-provider-cve-2021-31201","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-31979"],"exploited":"in-the-wild","identifiers":["CVE-2021-31979"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-31979.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-31979 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-31979","stacks":["linux","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-31979 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-119"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2021-31979)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-31979","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0938"],"exploited":"in-the-wild","identifiers":["CVE-2020-0938"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0938.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0938 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-0938","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA added CVE-2020-0938 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-787"],"title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability (CVE-2020-0938)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0938","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-17144"],"exploited":"in-the-wild","identifiers":["CVE-2020-17144"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2020-17144.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-17144 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 8.4 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2020-17144","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution. CISA added CVE-2020-17144 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-502"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2020-17144)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2020-17144","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0986"],"exploited":"in-the-wild","identifiers":["CVE-2020-0986"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0986.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0986 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-0986","stacks":["linux","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. CISA added CVE-2020-0986 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-787"],"title":"Microsoft Windows Kernel Privilege Escalation Vulnerability (CVE-2020-0986)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0986","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1020"],"exploited":"in-the-wild","identifiers":["CVE-2020-1020"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1020.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1020 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-1020","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA added CVE-2020-1020 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-787"],"title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability (CVE-2020-1020)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1020","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-38645"],"exploited":"in-the-wild","identifiers":["CVE-2021-38645"],"json":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38645.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-38645 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Open Management Infrastructure (OMI)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-open-management-infrastructure-omi-cve-2021-38645","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-38645 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (CVE-2021-38645)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38645","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-34523"],"exploited":"in-the-wild","identifiers":["CVE-2021-34523"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-34523.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-34523 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Exchange Server","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-34523","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-34523 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-287"],"title":"Microsoft Exchange Server Privilege Escalation Vulnerability (CVE-2021-34523)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-34523","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-7269"],"exploited":"in-the-wild","identifiers":["CVE-2017-7269"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-information-services-iis-cve-2017-7269.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-7269 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Internet Information Services (IIS)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-information-services-iis-cve-2017-7269","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with \"If: \u003chttp://\" in a PROPFIND request. CISA added CVE-2017-7269 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Microsoft Windows Server Buffer Overflow Vulnerability (CVE-2017-7269)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-information-services-iis-cve-2017-7269","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-36948"],"exploited":"in-the-wild","identifiers":["CVE-2021-36948"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36948.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-36948 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-36948","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-36948 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability (CVE-2021-36948)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36948","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-38649"],"exploited":"in-the-wild","identifiers":["CVE-2021-38649"],"json":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38649.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-38649 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Open Management Infrastructure (OMI)","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-open-management-infrastructure-omi-cve-2021-38649","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation. CISA added CVE-2021-38649 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (CVE-2021-38649)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38649","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0688"],"exploited":"in-the-wild","identifiers":["CVE-2020-0688"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2020-0688.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0688 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2020-0688","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution. CISA added CVE-2020-0688 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-287"],"title":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability (CVE-2020-0688)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2020-0688","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-0143"],"exploited":"in-the-wild","identifiers":["CVE-2017-0143"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0143.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-0143 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2017-0143","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2017-0143 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability (CVE-2017-0143)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2017-0143","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-7255"],"exploited":"in-the-wild","identifiers":["CVE-2016-7255"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2016-7255.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-7255 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2016-7255","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. CISA added CVE-2016-7255 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-264"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2016-7255)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2016-7255","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0708"],"exploited":"in-the-wild","identifiers":["CVE-2019-0708"],"json":"https://helix.ml/threat-watch/i/microsoft-remote-desktop-services-cve-2019-0708.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0708 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Remote Desktop Services","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-remote-desktop-services-cve-2019-0708","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep. CISA added CVE-2019-0708 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-416"],"title":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0708)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-remote-desktop-services-cve-2019-0708","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-34473"],"exploited":"in-the-wild","identifiers":["CVE-2021-34473"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-34473.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-34473 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Exchange Server","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-34473","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-34473 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-918"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-34473","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1464"],"exploited":"in-the-wild","identifiers":["CVE-2020-1464"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1464.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1464 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-1464","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. CISA added CVE-2020-1464 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-347"],"title":"Microsoft Windows Spoofing Vulnerability (CVE-2020-1464)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1464","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1732"],"exploited":"in-the-wild","identifiers":["CVE-2021-1732"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-1732.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1732 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2021-1732","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-1732 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-787"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2021-1732)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-1732","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-34527"],"exploited":"in-the-wild","identifiers":["CVE-2021-34527"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34527.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-34527 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-34527","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare. CISA added CVE-2021-34527 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-269"],"title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability (CVE-2021-34527)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34527","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-31207"],"exploited":"in-the-wild","identifiers":["CVE-2021-31207"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-31207.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-31207 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Exchange Server","severity":"medium","severityNote":"CVSS 6.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-31207","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass. CISA added CVE-2021-31207 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-20","cwe-434"],"title":"Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-31207","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0803"],"exploited":"in-the-wild","identifiers":["CVE-2019-0803"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0803.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0803 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2019-0803","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. CISA added CVE-2019-0803 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-0803)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0803","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1040"],"exploited":"in-the-wild","identifiers":["CVE-2020-1040"],"json":"https://helix.ml/threat-watch/i/microsoft-hyper-v-remotefx-cve-2020-1040.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1040 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Hyper-V RemoteFX","severity":"critical","severityNote":"CVSS 9.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-hyper-v-remotefx-cve-2020-1040","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system. CISA added CVE-2020-1040 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability (CVE-2020-1040)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-hyper-v-remotefx-cve-2020-1040","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-28310"],"exploited":"in-the-wild","identifiers":["CVE-2021-28310"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-28310.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-28310 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2021-28310","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-28310 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-787"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2021-28310)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2021-28310","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1350"],"exploited":"in-the-wild","identifiers":["CVE-2020-1350"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1350.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1350 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-1350","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. CISA added CVE-2020-1350 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability (CVE-2020-1350)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-1350","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-26411"],"exploited":"in-the-wild","identifiers":["CVE-2021-26411"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2021-26411.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-26411 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2021-26411","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption. CISA added CVE-2021-26411 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-416"],"title":"Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2021-26411)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2021-26411","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0859"],"exploited":"in-the-wild","identifiers":["CVE-2019-0859"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0859.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0859 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2019-0859","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. CISA added CVE-2019-0859 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-0859)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0859","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-40444"],"exploited":"in-the-wild","identifiers":["CVE-2021-40444"],"json":"https://helix.ml/threat-watch/i/microsoft-mshtml-cve-2021-40444.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-40444 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"MSHTML","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-mshtml-cve-2021-40444","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-40444 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-22"],"title":"Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-mshtml-cve-2021-40444","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-8759"],"exploited":"in-the-wild","identifiers":["CVE-2017-8759"],"json":"https://helix.ml/threat-watch/i/microsoft-net-framework-cve-2017-8759.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-8759 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":".NET Framework","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-net-framework-cve-2017-8759","stacks":["dotnet"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system. CISA added CVE-2017-8759 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Microsoft .NET Framework Remote Code Execution Vulnerability (CVE-2017-8759)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-net-framework-cve-2017-8759","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-8653"],"exploited":"in-the-wild","identifiers":["CVE-2018-8653"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2018-8653.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-8653 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2018-8653","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution. CISA added CVE-2018-8653 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8653)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2018-8653","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0797"],"exploited":"in-the-wild","identifiers":["CVE-2019-0797"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0797.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0797 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2019-0797","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode. CISA added CVE-2019-0797 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-0797)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0797","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-36942"],"exploited":"in-the-wild","identifiers":["CVE-2021-36942"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36942.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-36942 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-36942","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM. CISA added CVE-2021-36942 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-749"],"title":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability (CVE-2021-36942)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36942","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-1215"],"exploited":"in-the-wild","identifiers":["CVE-2019-1215"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1215.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-1215 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1215","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges. CISA added CVE-2019-1215 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Windows Privilege Escalation Vulnerability (CVE-2019-1215)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1215","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-0798"],"exploited":"in-the-wild","identifiers":["CVE-2018-0798"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2018-0798.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-0798 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2018-0798","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802. CISA added CVE-2018-0798 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Microsoft Office Memory Corruption Vulnerability (CVE-2018-0798)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2018-0798","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-0802"],"exploited":"in-the-wild","identifiers":["CVE-2018-0802"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2018-0802.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-0802 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2018-0802","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798. CISA added CVE-2018-0802 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-787"],"title":"Microsoft Office Memory Corruption Vulnerability (CVE-2018-0802)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2018-0802","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2012-0158"],"exploited":"in-the-wild","identifiers":["CVE-2012-0158"],"json":"https://helix.ml/threat-watch/i/microsoft-mscomctl-ocx-cve-2012-0158.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2012-0158 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"MSCOMCTL.OCX","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-mscomctl-ocx-cve-2012-0158","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user. CISA added CVE-2012-0158 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-94"],"title":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability (CVE-2012-0158)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-mscomctl-ocx-cve-2012-0158","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2015-1641"],"exploited":"in-the-wild","identifiers":["CVE-2015-1641"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-1641.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2015-1641 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2015-1641","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user. CISA added CVE-2015-1641 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-399"],"title":"Microsoft Office Memory Corruption Vulnerability (CVE-2015-1641)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2015-1641","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27085"],"exploited":"in-the-wild","identifiers":["CVE-2021-27085"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2021-27085.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27085 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2021-27085","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-27085 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2021-27085)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2021-27085","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0541"],"exploited":"in-the-wild","identifiers":["CVE-2019-0541"],"json":"https://helix.ml/threat-watch/i/microsoft-mshtml-cve-2019-0541.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0541 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"MSHTML","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-mshtml-cve-2019-0541","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability. CISA added CVE-2019-0541 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2019-0541)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-mshtml-cve-2019-0541","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-11882"],"exploited":"in-the-wild","identifiers":["CVE-2017-11882"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-11882.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-11882 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2017-11882","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user. CISA added CVE-2017-11882 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-119"],"title":"Microsoft Office Memory Corruption Vulnerability (CVE-2017-11882)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-11882","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0674"],"exploited":"in-the-wild","identifiers":["CVE-2020-0674"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2020-0674.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0674 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2020-0674","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user. CISA added CVE-2020-0674 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416"],"title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0674)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2020-0674","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27059"],"exploited":"in-the-wild","identifiers":["CVE-2021-27059"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2021-27059.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27059 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2021-27059","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-27059 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Microsoft Office Remote Code Execution Vulnerability (CVE-2021-27059)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2021-27059","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-1367"],"exploited":"in-the-wild","identifiers":["CVE-2019-1367"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-1367.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-1367 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2019-1367","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user. CISA added CVE-2019-1367 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-787"],"title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-1367","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-0199"],"exploited":"in-the-wild","identifiers":["CVE-2017-0199"],"json":"https://helix.ml/threat-watch/i/microsoft-office-and-wordpad-cve-2017-0199.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-0199 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Office and WordPad","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-and-wordpad-cve-2017-0199","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution. CISA added CVE-2017-0199 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Microsoft Office and WordPad Remote Code Execution Vulnerability (CVE-2017-0199)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-and-wordpad-cve-2017-0199","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1380"],"exploited":"in-the-wild","identifiers":["CVE-2020-1380"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2020-1380.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1380 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2020-1380","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. CISA added CVE-2020-1380 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-787"],"title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-1380)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2020-1380","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-1429"],"exploited":"in-the-wild","identifiers":["CVE-2019-1429"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-1429.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-1429 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2019-1429","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. CISA added CVE-2019-1429 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-416","cwe-787"],"title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1429)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2019-1429","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-11774"],"exploited":"in-the-wild","identifiers":["CVE-2017-11774"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-11774.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-11774 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2017-11774","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands. CISA added CVE-2017-11774 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-119"],"title":"Microsoft Office Outlook Security Feature Bypass Vulnerability (CVE-2017-11774)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2017-11774","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0968"],"exploited":"in-the-wild","identifiers":["CVE-2020-0968"],"json":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2020-0968.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0968 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Internet Explorer","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-internet-explorer-cve-2020-0968","stacks":["browser","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution. CISA added CVE-2020-0968 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-787"],"title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0968)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-internet-explorer-cve-2020-0968","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1472"],"exploited":"in-the-wild","identifiers":["CVE-2020-1472"],"json":"https://helix.ml/threat-watch/i/microsoft-netlogon-cve-2020-1472.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1472 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Netlogon","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-netlogon-cve-2020-1472","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon. CISA added CVE-2020-1472 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-330"],"title":"Microsoft Netlogon Privilege Escalation Vulnerability (CVE-2020-1472)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-netlogon-cve-2020-1472","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-26855"],"exploited":"in-the-wild","identifiers":["CVE-2021-26855"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-26855.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-26855 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-26855","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. CISA added CVE-2021-26855 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-918"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-26855","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-26858"],"exploited":"in-the-wild","identifiers":["CVE-2021-26858"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-26858.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-26858 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-26858","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. CISA added CVE-2021-26858 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26858)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-26858","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27065"],"exploited":"in-the-wild","identifiers":["CVE-2021-27065"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-27065.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27065 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-27065","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. CISA added CVE-2021-27065 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-39"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-27065","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1054"],"exploited":"in-the-wild","identifiers":["CVE-2020-1054"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2020-1054.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1054 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2020-1054","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode. CISA added CVE-2020-1054 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-787"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2020-1054)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2020-1054","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1675"],"exploited":"in-the-wild","identifiers":["CVE-2021-1675"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-1675.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1675 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-1675","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2021-1675 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-285"],"title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability (CVE-2021-1675)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-1675","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-34448"],"exploited":"in-the-wild","identifiers":["CVE-2021-34448"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34448.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-34448 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"medium","severityNote":"CVSS 6.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-34448","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. CISA added CVE-2021-34448 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability (CVE-2021-34448)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-34448","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0601"],"exploited":"in-the-wild","identifiers":["CVE-2020-0601"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0601.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0601 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2020-0601","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. CISA added CVE-2020-0601 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-295"],"title":"Microsoft Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2020-0601","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0604"],"exploited":"in-the-wild","identifiers":["CVE-2019-0604"],"json":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2019-0604.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0604 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"SharePoint","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-sharepoint-cve-2019-0604","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account. CISA added CVE-2019-0604 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2019-0604)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2019-0604","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0646"],"exploited":"in-the-wild","identifiers":["CVE-2020-0646"],"json":"https://helix.ml/threat-watch/i/microsoft-net-framework-cve-2020-0646.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0646 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":".NET Framework","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-net-framework-cve-2020-0646","stacks":["dotnet"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution. CISA added CVE-2020-0646 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-91"],"title":"Microsoft .NET Framework Remote Code Execution Vulnerability (CVE-2020-0646)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-net-framework-cve-2020-0646","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0808"],"exploited":"in-the-wild","identifiers":["CVE-2019-0808"],"json":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0808.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0808 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Win32k","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-win32k-cve-2019-0808","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode. CISA added CVE-2019-0808 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Win32k Privilege Escalation Vulnerability (CVE-2019-0808)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-win32k-cve-2019-0808","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-26857"],"exploited":"in-the-wild","identifiers":["CVE-2021-26857"],"json":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-26857.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-26857 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Exchange Server","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-exchange-server-cve-2021-26857","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. CISA added CVE-2021-26857 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-502"],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26857)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-exchange-server-cve-2021-26857","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-1147"],"exploited":"in-the-wild","identifiers":["CVE-2020-1147"],"json":"https://helix.ml/threat-watch/i/microsoft-net-framework-sharepoint-visual-studio-cve-2020-1147.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-1147 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":".NET Framework, SharePoint, Visual Studio","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-net-framework-sharepoint-visual-studio-cve-2020-1147","stacks":["devtools","dotnet","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content. CISA added CVE-2020-1147 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization"],"title":"Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability (CVE-2020-1147)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-net-framework-sharepoint-visual-studio-cve-2020-1147","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-1214"],"exploited":"in-the-wild","identifiers":["CVE-2019-1214"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1214.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-1214 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-1214","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation. CISA added CVE-2019-1214 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability (CVE-2019-1214)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-1214","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-3235"],"exploited":"in-the-wild","identifiers":["CVE-2016-3235"],"json":"https://helix.ml/threat-watch/i/microsoft-office-cve-2016-3235.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-3235 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Office","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-office-cve-2016-3235","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Office Object Linking \u0026 Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution. CISA added CVE-2016-3235 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-264"],"title":"Microsoft Office OLE DLL Side Loading Vulnerability (CVE-2016-3235)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-office-cve-2016-3235","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0863"],"exploited":"in-the-wild","identifiers":["CVE-2019-0863"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0863.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0863 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2019-0863","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode. CISA added CVE-2019-0863 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability (CVE-2019-0863)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2019-0863","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-36955"],"exploited":"in-the-wild","identifiers":["CVE-2021-36955"],"json":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36955.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-36955 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Windows","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-windows-cve-2021-36955","stacks":["windows"],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA added CVE-2021-36955 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation"],"title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (CVE-2021-36955)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2021-36955","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-38648"],"exploited":"in-the-wild","identifiers":["CVE-2021-38648"],"json":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38648.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-38648 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Open Management Infrastructure (OMI)","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"microsoft-open-management-infrastructure-omi-cve-2021-38648","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation. CISA added CVE-2021-38648 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-1390"],"title":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (CVE-2021-38648)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/microsoft-open-management-infrastructure-omi-cve-2021-38648","vendor":"Microsoft"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-6819"],"exploited":"in-the-wild","identifiers":["CVE-2020-6819"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2020-6819.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-6819 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Firefox and Thunderbird","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-and-thunderbird-cve-2020-6819","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts. CISA added CVE-2020-6819 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-362","cwe-416"],"title":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (CVE-2020-6819)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2020-6819","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-6820"],"exploited":"in-the-wild","identifiers":["CVE-2020-6820"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2020-6820.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-6820 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Firefox and Thunderbird","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-and-thunderbird-cve-2020-6820","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts. CISA added CVE-2020-6820 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-362"],"title":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (CVE-2020-6820)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2020-6820","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-17026"],"exploited":"in-the-wild","identifiers":["CVE-2019-17026"],"json":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2019-17026.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-17026 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Firefox and Thunderbird","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mozilla-firefox-and-thunderbird-cve-2019-17026","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. CISA added CVE-2019-17026 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Mozilla Firefox And Thunderbird Type Confusion Vulnerability (CVE-2019-17026)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/mozilla-firefox-and-thunderbird-cve-2019-17026","vendor":"Mozilla"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-15949"],"exploited":"in-the-wild","identifiers":["CVE-2019-15949"],"json":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2019-15949.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-15949 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Nagios XI","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"nagios-nagios-xi-cve-2019-15949","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root. CISA added CVE-2019-15949 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Nagios XI Remote Code Execution Vulnerability (CVE-2019-15949)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/nagios-nagios-xi-cve-2019-15949","vendor":"Nagios"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-26919"],"exploited":"in-the-wild","identifiers":["CVE-2020-26919"],"json":"https://helix.ml/threat-watch/i/netgear-jgs516pe-devices-cve-2020-26919.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-26919 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"JGS516PE Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"netgear-jgs516pe-devices-cve-2020-26919","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Netgear JGS516PE devices contain a missing function level access control vulnerability. CISA added CVE-2020-26919 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability (CVE-2020-26919)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/netgear-jgs516pe-devices-cve-2020-26919","vendor":"NETGEAR"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-19356"],"exploited":"in-the-wild","identifiers":["CVE-2019-19356"],"json":"https://helix.ml/threat-watch/i/netis-wf2419-devices-cve-2019-19356.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-19356 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"WF2419 Devices","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"netis-wf2419-devices-cve-2019-19356","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page. CISA added CVE-2019-19356 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Netis WF2419 Devices Remote Code Execution Vulnerability (CVE-2019-19356)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/netis-wf2419-devices-cve-2019-19356","vendor":"Netis"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-2555"],"exploited":"in-the-wild","identifiers":["CVE-2020-2555"],"json":"https://helix.ml/threat-watch/i/oracle-multiple-products-cve-2020-2555.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-2555 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-multiple-products-cve-2020-2555","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR). CISA added CVE-2020-2555 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-502"],"title":"Oracle Multiple Products Remote Code Execution Vulnerability (CVE-2020-2555)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-multiple-products-cve-2020-2555","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2012-3152"],"exploited":"in-the-wild","identifiers":["CVE-2012-3152"],"json":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2012-3152.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2012-3152 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Fusion Middleware","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-fusion-middleware-cve-2012-3152","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems. CISA added CVE-2012-3152 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle Fusion Middleware Unspecified Vulnerability (CVE-2012-3152)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-fusion-middleware-cve-2012-3152","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-14871"],"exploited":"in-the-wild","identifiers":["CVE-2020-14871"],"json":"https://helix.ml/threat-watch/i/oracle-solaris-and-zettabyte-file-system-zfs-cve-2020-14871.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-14871 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Solaris and Zettabyte File System (ZFS)","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-solaris-and-zettabyte-file-system-zfs-cve-2020-14871","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems. CISA added CVE-2020-14871 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-787"],"title":"Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability (CVE-2020-14871)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-solaris-and-zettabyte-file-system-zfs-cve-2020-14871","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2015-4852"],"exploited":"in-the-wild","identifiers":["CVE-2015-4852"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2015-4852.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2015-4852 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"WebLogic Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2015-4852","stacks":["java","rust"],"startedAt":"2021-11-03","status":"closed","summary":"Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution. CISA added CVE-2015-4852 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability (CVE-2015-4852)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2015-4852","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-14750"],"exploited":"in-the-wild","identifiers":["CVE-2020-14750"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14750.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-14750 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"WebLogic Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2020-14750","stacks":["java"],"startedAt":"2021-11-03","status":"closed","summary":"Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882. CISA added CVE-2020-14750 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14750)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14750","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-14882"],"exploited":"in-the-wild","identifiers":["CVE-2020-14882"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14882.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-14882 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"WebLogic Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2020-14882","stacks":["java"],"startedAt":"2021-11-03","status":"closed","summary":"Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750. CISA added CVE-2020-14882 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2020-14882)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14882","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-14883"],"exploited":"in-the-wild","identifiers":["CVE-2020-14883"],"json":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14883.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-14883 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"WebLogic Server","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"oracle-weblogic-server-cve-2020-14883","stacks":["java"],"startedAt":"2021-11-03","status":"closed","summary":"Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability. CISA added CVE-2020-14883 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Oracle WebLogic Server Unspecified Vulnerability (CVE-2020-14883)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/oracle-weblogic-server-cve-2020-14883","vendor":"Oracle"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8644"],"exploited":"in-the-wild","identifiers":["CVE-2020-8644"],"json":"https://helix.ml/threat-watch/i/playsms-playsms-cve-2020-8644.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8644 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"PlaySMS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"playsms-playsms-cve-2020-8644","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"PlaySMS contains a server-side template injection vulnerability that allows for remote code execution. CISA added CVE-2020-8644 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"PlaySMS Server-Side Template Injection Vulnerability (CVE-2020-8644)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/playsms-playsms-cve-2020-8644","vendor":"PlaySMS"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-18935"],"exploited":"in-the-wild","identifiers":["CVE-2019-18935"],"json":"https://helix.ml/threat-watch/i/progress-telerik-ui-for-asp-net-ajax-cve-2019-18935.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-18935 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Telerik UI for ASP.NET AJAX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-telerik-ui-for-asp-net-ajax-cve-2019-18935","stacks":["dotnet","rust"],"startedAt":"2021-11-03","status":"closed","summary":"Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process. CISA added CVE-2019-18935 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","deserialization","cwe-502"],"title":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability (CVE-2019-18935)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/progress-telerik-ui-for-asp-net-ajax-cve-2019-18935","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22893"],"exploited":"in-the-wild","identifiers":["CVE-2021-22893"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22893.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22893 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-cve-2021-22893","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services. CISA added CVE-2021-22893 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-287"],"title":"Ivanti Pulse Connect Secure Use-After-Free Vulnerability (CVE-2021-22893)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22893","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8243"],"exploited":"in-the-wild","identifiers":["CVE-2020-8243"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2020-8243.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8243 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-cve-2020-8243","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution. CISA added CVE-2020-8243 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-94"],"title":"Ivanti Pulse Connect Secure Code Execution Vulnerability (CVE-2020-8243)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2020-8243","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22900"],"exploited":"in-the-wild","identifiers":["CVE-2021-22900"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22900.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22900 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-cve-2021-22900","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. CISA added CVE-2021-22900 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-94"],"title":"Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability (CVE-2021-22900)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22900","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22894"],"exploited":"in-the-wild","identifiers":["CVE-2021-22894"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22894.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22894 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-cve-2021-22894","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room. CISA added CVE-2021-22894 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-94"],"title":"Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability (CVE-2021-22894)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22894","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8260"],"exploited":"in-the-wild","identifiers":["CVE-2020-8260"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2020-8260.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8260 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-cve-2020-8260","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction. CISA added CVE-2020-8260 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"Ivanti Pulse Connect Secure Code Execution Vulnerability (CVE-2020-8260)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2020-8260","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22899"],"exploited":"in-the-wild","identifiers":["CVE-2021-22899"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22899.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22899 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-cve-2021-22899","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles. CISA added CVE-2021-22899 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-77"],"title":"Ivanti Pulse Connect Secure Command Injection Vulnerability (CVE-2021-22899)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2021-22899","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-11510"],"exploited":"in-the-wild","identifiers":["CVE-2019-11510"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2019-11510.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-11510 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-cve-2019-11510","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI. CISA added CVE-2019-11510 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-22"],"title":"Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability (CVE-2019-11510)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-cve-2019-11510","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-11539"],"exploited":"in-the-wild","identifiers":["CVE-2019-11539"],"json":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-and-pulse-policy-secure-cve-2019-11539.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-11539 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Pulse Connect Secure and Pulse Policy Secure","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"ivanti-pulse-connect-secure-and-pulse-policy-secure-cve-2019-11539","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands. CISA added CVE-2019-11539 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-78"],"title":"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability (CVE-2019-11539)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/ivanti-pulse-connect-secure-and-pulse-policy-secure-cve-2019-11539","vendor":"Ivanti"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1906"],"exploited":"in-the-wild","identifiers":["CVE-2021-1906"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2021-1906.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1906 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2021-1906","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure. CISA added CVE-2021-1906 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-390"],"title":"Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability (CVE-2021-1906)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2021-1906","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1905"],"exploited":"in-the-wild","identifiers":["CVE-2021-1905"],"json":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2021-1905.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1905 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"qualcomm-multiple-chipsets-cve-2021-1905","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously. CISA added CVE-2021-1905 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2021-1905)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/qualcomm-multiple-chipsets-cve-2021-1905","vendor":"Qualcomm"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-10221"],"exploited":"in-the-wild","identifiers":["CVE-2020-10221"],"json":"https://helix.ml/threat-watch/i/rconfig-rconfig-cve-2020-10221.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-10221 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"rConfig","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"rconfig-rconfig-cve-2020-10221","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter. CISA added CVE-2020-10221 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"rConfig OS Command Injection Vulnerability (CVE-2020-10221)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/rconfig-rconfig-cve-2020-10221","vendor":"rConfig"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-35395"],"exploited":"in-the-wild","identifiers":["CVE-2021-35395"],"json":"https://helix.ml/threat-watch/i/realtek-ap-router-sdk-cve-2021-35395.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-35395 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"AP-Router SDK","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"realtek-ap-router-sdk-cve-2021-35395","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS). CISA added CVE-2021-35395 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-20","cwe-122"],"title":"Realtek AP-Router SDK Buffer Overflow Vulnerability (CVE-2021-35395)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/realtek-ap-router-sdk-cve-2021-35395","vendor":"Realtek"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-16651"],"exploited":"in-the-wild","identifiers":["CVE-2017-16651"],"json":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2017-16651.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-16651 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Roundcube Webmail","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"roundcube-roundcube-webmail-cve-2017-16651","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. CISA added CVE-2017-16651 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-552"],"title":"Roundcube Webmail File Disclosure Vulnerability (CVE-2017-16651)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/roundcube-roundcube-webmail-cve-2017-16651","vendor":"Roundcube"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-11652"],"exploited":"in-the-wild","identifiers":["CVE-2020-11652"],"json":"https://helix.ml/threat-watch/i/saltstack-salt-cve-2020-11652.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-11652 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Salt","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"saltstack-salt-cve-2020-11652","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. CISA added CVE-2020-11652 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"SaltStack Salt Path Traversal Vulnerability (CVE-2020-11652)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/saltstack-salt-cve-2020-11652","vendor":"SaltStack"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-11651"],"exploited":"in-the-wild","identifiers":["CVE-2020-11651"],"json":"https://helix.ml/threat-watch/i/saltstack-salt-cve-2020-11651.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-11651 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Salt","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"saltstack-salt-cve-2020-11651","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. CISA added CVE-2020-11651 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass"],"title":"SaltStack Salt Authentication Bypass Vulnerability (CVE-2020-11651)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/saltstack-salt-cve-2020-11651","vendor":"SaltStack"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-16846"],"exploited":"in-the-wild","identifiers":["CVE-2020-16846"],"json":"https://helix.ml/threat-watch/i/saltstack-salt-cve-2020-16846.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-16846 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Salt","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"saltstack-salt-cve-2020-16846","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API. CISA added CVE-2020-16846 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-78"],"title":"SaltStack Salt Shell Injection Vulnerability (CVE-2020-16846)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/saltstack-salt-cve-2020-16846","vendor":"SaltStack"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-2380"],"exploited":"in-the-wild","identifiers":["CVE-2018-2380"],"json":"https://helix.ml/threat-watch/i/sap-customer-relationship-management-crm-cve-2018-2380.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-2380 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Customer Relationship Management (CRM)","severity":"medium","severityNote":"CVSS 6.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-customer-relationship-management-crm-cve-2018-2380","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users. CISA added CVE-2018-2380 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability (CVE-2018-2380)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sap-customer-relationship-management-crm-cve-2018-2380","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2010-5326"],"exploited":"in-the-wild","identifiers":["CVE-2010-5326"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2010-5326.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2010-5326 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"NetWeaver","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2010-5326","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request. CISA added CVE-2010-5326 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"SAP NetWeaver Remote Code Execution Vulnerability (CVE-2010-5326)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2010-5326","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-9563"],"exploited":"in-the-wild","identifiers":["CVE-2016-9563"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-9563.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-9563 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"NetWeaver","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2016-9563","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks. CISA added CVE-2016-9563 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-611"],"title":"SAP NetWeaver XML External Entity (XXE) Vulnerability (CVE-2016-9563)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-9563","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-6287"],"exploited":"in-the-wild","identifiers":["CVE-2020-6287"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2020-6287.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-6287 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"NetWeaver","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2020-6287","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users. CISA added CVE-2020-6287 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability (CVE-2020-6287)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2020-6287","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-6207"],"exploited":"in-the-wild","identifiers":["CVE-2020-6207"],"json":"https://helix.ml/threat-watch/i/sap-solution-manager-cve-2020-6207.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-6207 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Solution Manager","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-solution-manager-cve-2020-6207","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager. CISA added CVE-2020-6207 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-306"],"title":"SAP Solution Manager Missing Authentication for Critical Function Vulnerability (CVE-2020-6207)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sap-solution-manager-cve-2020-6207","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-3976"],"exploited":"in-the-wild","identifiers":["CVE-2016-3976"],"json":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-3976.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-3976 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"NetWeaver","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"sap-netweaver-cve-2016-3976","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files. CISA added CVE-2016-3976 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"SAP NetWeaver Directory Traversal Vulnerability (CVE-2016-3976)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sap-netweaver-cve-2016-3976","vendor":"SAP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-16256"],"exploited":"in-the-wild","identifiers":["CVE-2019-16256"],"json":"https://helix.ml/threat-watch/i/simalliance-toolbox-browser-cve-2019-16256.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-16256 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Toolbox Browser","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"simalliance-toolbox-browser-cve-2019-16256","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message. CISA added CVE-2019-16256 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"SIMalliance Toolbox Browser Command Injection Vulnerability (CVE-2019-16256)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/simalliance-toolbox-browser-cve-2019-16256","vendor":"SIMalliance"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-10148"],"exploited":"in-the-wild","identifiers":["CVE-2020-10148"],"json":"https://helix.ml/threat-watch/i/solarwinds-orion-cve-2020-10148.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-10148 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Orion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-orion-cve-2020-10148","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands. CISA added CVE-2020-10148 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","cwe-288"],"title":"SolarWinds Orion Authentication Bypass Vulnerability (CVE-2020-10148)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/solarwinds-orion-cve-2020-10148","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-35211"],"exploited":"in-the-wild","identifiers":["CVE-2021-35211"],"json":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2021-35211.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-35211 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Serv-U","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-serv-u-cve-2021-35211","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution. CISA added CVE-2021-35211 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-787"],"title":"SolarWinds Serv-U Remote Code Execution Vulnerability (CVE-2021-35211)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/solarwinds-serv-u-cve-2021-35211","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-3643"],"exploited":"in-the-wild","identifiers":["CVE-2016-3643"],"json":"https://helix.ml/threat-watch/i/solarwinds-virtualization-manager-cve-2016-3643.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-3643 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Virtualization Manager","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"solarwinds-virtualization-manager-cve-2016-3643","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo. CISA added CVE-2016-3643 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-264"],"title":"SolarWinds Virtualization Manager Privilege Escalation Vulnerability (CVE-2016-3643)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/solarwinds-virtualization-manager-cve-2016-3643","vendor":"SolarWinds"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-10199"],"exploited":"in-the-wild","identifiers":["CVE-2020-10199"],"json":"https://helix.ml/threat-watch/i/sonatype-nexus-repository-cve-2020-10199.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-10199 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Nexus Repository","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonatype-nexus-repository-cve-2020-10199","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution. CISA added CVE-2020-10199 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-917"],"title":"Sonatype Nexus Repository Remote Code Execution Vulnerability (CVE-2020-10199)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonatype-nexus-repository-cve-2020-10199","vendor":"Sonatype"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-20021"],"exploited":"in-the-wild","identifiers":["CVE-2021-20021"],"json":"https://helix.ml/threat-watch/i/sonicwall-sonicwall-email-security-cve-2021-20021.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-20021 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"SonicWall Email Security","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sonicwall-email-security-cve-2021-20021","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation. CISA added CVE-2021-20021 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-306"],"title":"SonicWall Email Security Improper Privilege Management Vulnerability (CVE-2021-20021)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonicwall-sonicwall-email-security-cve-2021-20021","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-7481"],"exploited":"in-the-wild","identifiers":["CVE-2019-7481"],"json":"https://helix.ml/threat-watch/i/sonicwall-sma100-cve-2019-7481.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-7481 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"SMA100","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sma100-cve-2019-7481","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources. CISA added CVE-2019-7481 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"SonicWall SMA100 SQL Injection Vulnerability (CVE-2019-7481)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonicwall-sma100-cve-2019-7481","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-20022"],"exploited":"in-the-wild","identifiers":["CVE-2021-20022"],"json":"https://helix.ml/threat-watch/i/sonicwall-sonicwall-email-security-cve-2021-20022.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-20022 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"SonicWall Email Security","severity":"high","severityNote":"CVSS 7.2 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sonicwall-email-security-cve-2021-20022","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation. CISA added CVE-2021-20022 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","cwe-434"],"title":"SonicWall Email Security Unrestricted Upload of File Vulnerability (CVE-2021-20022)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonicwall-sonicwall-email-security-cve-2021-20022","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-20023"],"exploited":"in-the-wild","identifiers":["CVE-2021-20023"],"json":"https://helix.ml/threat-watch/i/sonicwall-sonicwall-email-security-cve-2021-20023.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-20023 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"SonicWall Email Security","severity":"medium","severityNote":"CVSS 4.9 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sonicwall-email-security-cve-2021-20023","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation. CISA added CVE-2021-20023 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","privilege-escalation","path-traversal","cwe-22"],"title":"SonicWall Email Security Path Traversal Vulnerability (CVE-2021-20023)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonicwall-sonicwall-email-security-cve-2021-20023","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-20016"],"exploited":"in-the-wild","identifiers":["CVE-2021-20016"],"json":"https://helix.ml/threat-watch/i/sonicwall-sslvpn-sma100-cve-2021-20016.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-20016 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"SSLVPN SMA100","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sonicwall-sslvpn-sma100-cve-2021-20016","stacks":["vpn"],"startedAt":"2021-11-03","status":"closed","summary":"SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker. CISA added CVE-2021-20016 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89"],"title":"SonicWall SSLVPN SMA100 SQL Injection Vulnerability (CVE-2021-20016)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sonicwall-sslvpn-sma100-cve-2021-20016","vendor":"SonicWall"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-12271"],"exploited":"in-the-wild","identifiers":["CVE-2020-12271"],"json":"https://helix.ml/threat-watch/i/sophos-sfos-cve-2020-12271.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-12271 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"SFOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sophos-sfos-cve-2020-12271","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords). CISA added CVE-2020-12271 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","sql-injection","cwe-89"],"title":"Sophos SFOS SQL Injection Vulnerability (CVE-2020-12271)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sophos-sfos-cve-2020-12271","vendor":"Sophos"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-10181"],"exploited":"in-the-wild","identifiers":["CVE-2020-10181"],"json":"https://helix.ml/threat-watch/i/sumavision-enhanced-multimedia-router-emr-cve-2020-10181.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-10181 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Enhanced Multimedia Router (EMR)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"sumavision-enhanced-multimedia-router-emr-cve-2020-10181","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device. CISA added CVE-2020-10181 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-352"],"title":"Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-10181)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/sumavision-enhanced-multimedia-router-emr-cve-2020-10181","vendor":"Sumavision"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-6327"],"exploited":"in-the-wild","identifiers":["CVE-2017-6327"],"json":"https://helix.ml/threat-watch/i/symantec-symantec-messaging-gateway-cve-2017-6327.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-6327 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Symantec Messaging Gateway","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"symantec-symantec-messaging-gateway-cve-2017-6327","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions. CISA added CVE-2017-6327 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6327)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/symantec-symantec-messaging-gateway-cve-2017-6327","vendor":"Symantec"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-18988"],"exploited":"in-the-wild","identifiers":["CVE-2019-18988"],"json":"https://helix.ml/threat-watch/i/teamviewer-desktop-cve-2019-18988.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-18988 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Desktop","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"teamviewer-desktop-cve-2019-18988","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system). CISA added CVE-2019-18988 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-521"],"title":"TeamViewer Desktop Bypass Remote Login Vulnerability (CVE-2019-18988)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/teamviewer-desktop-cve-2019-18988","vendor":"TeamViewer"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-9248"],"exploited":"in-the-wild","identifiers":["CVE-2017-9248"],"json":"https://helix.ml/threat-watch/i/progress-asp-net-ajax-and-sitefinity-cve-2017-9248.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-9248 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ASP.NET AJAX and Sitefinity","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"progress-asp-net-ajax-and-sitefinity-cve-2017-9248","stacks":["dotnet"],"startedAt":"2021-11-03","status":"closed","summary":"Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files. CISA added CVE-2017-9248 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-522"],"title":"Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability (CVE-2017-9248)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/progress-asp-net-ajax-and-sitefinity-cve-2017-9248","vendor":"Progress"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-31755"],"exploited":"in-the-wild","identifiers":["CVE-2021-31755"],"json":"https://helix.ml/threat-watch/i/tenda-ac11-router-cve-2021-31755.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-31755 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"AC11 Router","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"tenda-ac11-router-cve-2021-31755","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request. CISA added CVE-2021-31755 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Tenda AC11 Router Stack Buffer Overflow Vulnerability (CVE-2021-31755)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/tenda-ac11-router-cve-2021-31755","vendor":"Tenda"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-10987"],"exploited":"in-the-wild","identifiers":["CVE-2020-10987"],"json":"https://helix.ml/threat-watch/i/tenda-ac1900-router-ac15-model-cve-2020-10987.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-10987 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"AC1900 Router AC15 Model","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"tenda-ac1900-router-ac15-model-cve-2020-10987","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter. CISA added CVE-2020-10987 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability (CVE-2020-10987)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/tenda-ac1900-router-ac15-model-cve-2020-10987","vendor":"Tenda"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-14558"],"exploited":"in-the-wild","identifiers":["CVE-2018-14558"],"json":"https://helix.ml/threat-watch/i/tenda-ac7-ac9-and-ac10-routers-cve-2018-14558.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-14558 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"AC7, AC9, and AC10 Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"tenda-ac7-ac9-and-ac10-routers-cve-2018-14558","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to  the \"formsetUsbUnload\" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request. CISA added CVE-2018-14558 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability (CVE-2018-14558)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/tenda-ac7-ac9-and-ac10-routers-cve-2018-14558","vendor":"Tenda"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-20062"],"exploited":"in-the-wild","identifiers":["CVE-2018-20062"],"json":"https://helix.ml/threat-watch/i/thinkphp-nonecms-cve-2018-20062.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-20062 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"noneCms","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"thinkphp-nonecms-cve-2018-20062","stacks":["php"],"startedAt":"2021-11-03","status":"closed","summary":"ThinkPHP \"noneCms\" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter. CISA added CVE-2018-20062 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"ThinkPHP \"noneCms\" Remote Code Execution Vulnerability (CVE-2018-20062)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/thinkphp-nonecms-cve-2018-20062","vendor":"ThinkPHP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-9082"],"exploited":"in-the-wild","identifiers":["CVE-2019-9082"],"json":"https://helix.ml/threat-watch/i/thinkphp-thinkphp-cve-2019-9082.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-9082 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ThinkPHP","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"thinkphp-thinkphp-cve-2019-9082","stacks":["php"],"startedAt":"2021-11-03","status":"closed","summary":"ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command. CISA added CVE-2019-9082 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-306","cwe-94"],"title":"ThinkPHP Remote Code Execution Vulnerability (CVE-2019-9082)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/thinkphp-thinkphp-cve-2019-9082","vendor":"ThinkPHP"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-18187"],"exploited":"in-the-wild","identifiers":["CVE-2019-18187"],"json":"https://helix.ml/threat-watch/i/trend-micro-officescan-cve-2019-18187.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-18187 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"OfficeScan","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-officescan-cve-2019-18187","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution. CISA added CVE-2019-18187 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"Trend Micro OfficeScan Directory Traversal Vulnerability (CVE-2019-18187)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/trend-micro-officescan-cve-2019-18187","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8467"],"exploited":"in-the-wild","identifiers":["CVE-2020-8467"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-officescan-cve-2020-8467.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8467 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Apex One and OfficeScan","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-and-officescan-cve-2020-8467","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution. CISA added CVE-2020-8467 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability (CVE-2020-8467)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-officescan-cve-2020-8467","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8468"],"exploited":"in-the-wild","identifiers":["CVE-2020-8468"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-officescan-and-worry-free-business-security-agents-cve-2020-8468.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8468 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Apex One, OfficeScan and Worry-Free Business Security Agents","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-officescan-and-worry-free-business-security-agents-cve-2020-8468","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components. CISA added CVE-2020-8468 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-74"],"title":"Trend Micro Multiple Products Content Validation Escape Vulnerability (CVE-2020-8468)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-officescan-and-worry-free-business-security-agents-cve-2020-8468","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-24557"],"exploited":"in-the-wild","identifiers":["CVE-2020-24557"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-officescan-and-worry-free-business-security-cve-2020-24557.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-24557 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Apex One, OfficeScan, and Worry-Free Business Security","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-officescan-and-worry-free-business-security-cve-2020-24557","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation. CISA added CVE-2020-24557 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation"],"title":"Trend Micro Multiple Products Improper Access Control Vulnerability (CVE-2020-24557)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-officescan-and-worry-free-business-security-cve-2020-24557","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8599"],"exploited":"in-the-wild","identifiers":["CVE-2020-8599"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-officescan-cve-2020-8599.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8599 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Apex One and OfficeScan","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-and-officescan-cve-2020-8599","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login. CISA added CVE-2020-8599 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass"],"title":"Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability (CVE-2020-8599)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-and-officescan-cve-2020-8599","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-36742"],"exploited":"in-the-wild","identifiers":["CVE-2021-36742"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-apex-one-as-a-service-and-worry-free-business-security-cve-2021-36742.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-36742 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Apex One, Apex One as a Service, and Worry-Free Business Security","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-apex-one-as-a-service-and-worry-free-business-security-cve-2021-36742","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation. CISA added CVE-2021-36742 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-20"],"title":"Trend Micro Multiple Products Improper Input Validation Vulnerability (CVE-2021-36742)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-apex-one-as-a-service-and-worry-free-business-security-cve-2021-36742","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-36741"],"exploited":"in-the-wild","identifiers":["CVE-2021-36741"],"json":"https://helix.ml/threat-watch/i/trend-micro-apex-one-apex-one-as-a-service-and-worry-free-business-security-cve-2021-36741.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-36741 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Apex One, Apex One as a Service, and Worry-Free Business Security","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"trend-micro-apex-one-apex-one-as-a-service-and-worry-free-business-security-cve-2021-36741","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files. CISA added CVE-2021-36741 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-22"],"title":"Trend Micro Multiple Products Improper Input Validation Vulnerability (CVE-2021-36741)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/trend-micro-apex-one-apex-one-as-a-service-and-worry-free-business-security-cve-2021-36741","vendor":"Trend Micro"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-20085"],"exploited":"in-the-wild","identifiers":["CVE-2019-20085"],"json":"https://helix.ml/threat-watch/i/tvt-nvms-1000-cve-2019-20085.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-20085 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"NVMS-1000","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"tvt-nvms-1000-cve-2019-20085","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests. CISA added CVE-2019-20085 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-22"],"title":"TVT NVMS-1000 Directory Traversal Vulnerability (CVE-2019-20085)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/tvt-nvms-1000-cve-2019-20085","vendor":"TVT"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-5849"],"exploited":"in-the-wild","identifiers":["CVE-2020-5849"],"json":"https://helix.ml/threat-watch/i/unraid-unraid-cve-2020-5849.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-5849 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Unraid","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"unraid-unraid-cve-2020-5849","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution. CISA added CVE-2020-5849 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","auth-bypass","cwe-287","cwe-697"],"title":"Unraid Authentication Bypass Vulnerability (CVE-2020-5849)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/unraid-unraid-cve-2020-5849","vendor":"Unraid"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-5847"],"exploited":"in-the-wild","identifiers":["CVE-2020-5847"],"json":"https://helix.ml/threat-watch/i/unraid-unraid-cve-2020-5847.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-5847 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Unraid","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"unraid-unraid-cve-2020-5847","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access. CISA added CVE-2020-5847 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce"],"title":"Unraid Remote Code Execution Vulnerability (CVE-2020-5847)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/unraid-unraid-cve-2020-5847","vendor":"Unraid"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-16759"],"exploited":"in-the-wild","identifiers":["CVE-2019-16759"],"json":"https://helix.ml/threat-watch/i/vbulletin-vbulletin-cve-2019-16759.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-16759 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"vBulletin","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vbulletin-vbulletin-cve-2019-16759","stacks":["php"],"startedAt":"2021-11-03","status":"closed","summary":"The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. CISA added CVE-2019-16759 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-94"],"title":"vBulletin PHP Module Remote Code Execution Vulnerability (CVE-2019-16759)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vbulletin-vbulletin-cve-2019-16759","vendor":"vBulletin"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-17496"],"exploited":"in-the-wild","identifiers":["CVE-2020-17496"],"json":"https://helix.ml/threat-watch/i/vbulletin-vbulletin-cve-2020-17496.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-17496 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"vBulletin","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vbulletin-vbulletin-cve-2020-17496","stacks":["php"],"startedAt":"2021-11-03","status":"closed","summary":"The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759. CISA added CVE-2020-17496 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-74"],"title":"vBulletin PHP Module Remote Code Execution Vulnerability (CVE-2020-17496)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vbulletin-vbulletin-cve-2020-17496","vendor":"vBulletin"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-5544"],"exploited":"in-the-wild","identifiers":["CVE-2019-5544"],"json":"https://helix.ml/threat-watch/i/vmware-vmware-esxi-and-horizon-daas-cve-2019-5544.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-5544 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"VMware ESXi and Horizon DaaS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vmware-esxi-and-horizon-daas-cve-2019-5544","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution. CISA added CVE-2019-5544 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-787"],"title":"VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability (CVE-2019-5544)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vmware-esxi-and-horizon-daas-cve-2019-5544","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3992"],"exploited":"in-the-wild","identifiers":["CVE-2020-3992"],"json":"https://helix.ml/threat-watch/i/vmware-esxi-cve-2020-3992.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3992 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ESXi","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-esxi-cve-2020-3992","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution. CISA added CVE-2020-3992 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-416"],"title":"VMware ESXi OpenSLP Use-After-Free Vulnerability (CVE-2020-3992)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-esxi-cve-2020-3992","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3950"],"exploited":"in-the-wild","identifiers":["CVE-2020-3950"],"json":"https://helix.ml/threat-watch/i/vmware-multiple-products-cve-2020-3950.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3950 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-multiple-products-cve-2020-3950","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root. CISA added CVE-2020-3950 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-269"],"title":"VMware Multiple Products Privilege Escalation Vulnerability (CVE-2020-3950)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-multiple-products-cve-2020-3950","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22005"],"exploited":"in-the-wild","identifiers":["CVE-2021-22005"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-22005.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22005 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2021-22005","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code. CISA added CVE-2021-22005 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-23"],"title":"VMware vCenter Server File Upload Vulnerability (CVE-2021-22005)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-22005","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3952"],"exploited":"in-the-wild","identifiers":["CVE-2020-3952"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2020-3952.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3952 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2020-3952","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information. CISA added CVE-2020-3952 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-306"],"title":"VMware vCenter Server Information Disclosure Vulnerability (CVE-2020-3952)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2020-3952","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21972"],"exploited":"in-the-wild","identifiers":["CVE-2021-21972"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-21972.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21972 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2021-21972","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system. CISA added CVE-2021-21972 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-23"],"title":"VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21972)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-21972","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21985"],"exploited":"in-the-wild","identifiers":["CVE-2021-21985"],"json":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-21985.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21985 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"vCenter Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-vcenter-server-cve-2021-21985","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution. CISA added CVE-2021-21985 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-470","cwe-918"],"title":"VMware vCenter Server Improper Input Validation Vulnerability (CVE-2021-21985)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-vcenter-server-cve-2021-21985","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-4006"],"exploited":"in-the-wild","identifiers":["CVE-2020-4006"],"json":"https://helix.ml/threat-watch/i/vmware-multiple-products-cve-2020-4006.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-4006 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"vmware-multiple-products-cve-2020-4006","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system. CISA added CVE-2020-4006 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Multiple VMware Products Command Injection Vulnerability (CVE-2020-4006)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/vmware-multiple-products-cve-2020-4006","vendor":"VMware"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-25213"],"exploited":"in-the-wild","identifiers":["CVE-2020-25213"],"json":"https://helix.ml/threat-watch/i/wordpress-file-manager-plugin-cve-2020-25213.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-25213 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"File Manager Plugin","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"wordpress-file-manager-plugin-cve-2020-25213","stacks":["wordpress"],"startedAt":"2021-11-03","status":"closed","summary":"WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site. CISA added CVE-2020-25213 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-434"],"title":"WordPress File Manager Plugin Remote Code Execution Vulnerability (CVE-2020-25213)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/wordpress-file-manager-plugin-cve-2020-25213","vendor":"WordPress"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-11738"],"exploited":"in-the-wild","identifiers":["CVE-2020-11738"],"json":"https://helix.ml/threat-watch/i/wordpress-snap-creek-duplicator-plugin-cve-2020-11738.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-11738 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Snap Creek Duplicator Plugin","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"wordpress-snap-creek-duplicator-plugin-cve-2020-11738","stacks":["wordpress"],"startedAt":"2021-11-03","status":"closed","summary":"WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro. CISA added CVE-2020-11738 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-22"],"title":"WordPress Snap Creek Duplicator Plugin File Download Vulnerability (CVE-2020-11738)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/wordpress-snap-creek-duplicator-plugin-cve-2020-11738","vendor":"WordPress"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-9978"],"exploited":"in-the-wild","identifiers":["CVE-2019-9978"],"json":"https://helix.ml/threat-watch/i/wordpress-social-warfare-plugin-cve-2019-9978.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-9978 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Social Warfare Plugin","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"wordpress-social-warfare-plugin-cve-2019-9978","stacks":["wordpress"],"startedAt":"2021-11-03","status":"closed","summary":"WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro. CISA added CVE-2019-9978 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","xss","cwe-79"],"title":"WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability (CVE-2019-9978)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/wordpress-social-warfare-plugin-cve-2019-9978","vendor":"WordPress"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27561"],"exploited":"in-the-wild","identifiers":["CVE-2021-27561"],"json":"https://helix.ml/threat-watch/i/yealink-device-management-cve-2021-27561.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27561 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Device Management","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"yealink-device-management-cve-2021-27561","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution. CISA added CVE-2021-27561 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","ssrf","cwe-78"],"title":"Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-27561)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/yealink-device-management-cve-2021-27561","vendor":"Yealink"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-40539"],"exploited":"in-the-wild","identifiers":["CVE-2021-40539"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2021-40539.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-40539 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"ManageEngine","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-cve-2021-40539","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution. CISA added CVE-2021-40539 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","auth-bypass","cwe-55"],"title":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2021-40539","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-10189"],"exploited":"in-the-wild","identifiers":["CVE-2020-10189"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2020-10189.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-10189 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ManageEngine","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-cve-2020-10189","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution. CISA added CVE-2020-10189 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-502"],"title":"Zoho ManageEngine Desktop Central File Upload Vulnerability (CVE-2020-10189)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2020-10189","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-8394"],"exploited":"in-the-wild","identifiers":["CVE-2019-8394"],"json":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2019-8394.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-8394 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ManageEngine","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"zoho-manageengine-cve-2019-8394","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization. CISA added CVE-2019-8394 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability (CVE-2019-8394)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zoho-manageengine-cve-2019-8394","vendor":"Zoho"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-29583"],"exploited":"in-the-wild","identifiers":["CVE-2020-29583"],"json":"https://helix.ml/threat-watch/i/zyxel-multiple-products-cve-2020-29583.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-29583 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"zyxel-multiple-products-cve-2020-29583","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account (\"zyfwp\") with an unchangeable password. CISA added CVE-2020-29583 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","hard-coded-credentials","cwe-522"],"title":"Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability (CVE-2020-29583)","updatedAt":"2026-10-25T09:11:38Z","url":"https://helix.ml/threat-watch/i/zyxel-multiple-products-cve-2020-29583","vendor":"Zyxel"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27104"],"exploited":"in-the-wild","identifiers":["CVE-2021-27104"],"json":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27104.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27104 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"FTA","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"accellion-fta-cve-2021-27104","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. CISA added CVE-2021-27104 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-78"],"title":"Accellion FTA OS Command Injection Vulnerability (CVE-2021-27104)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27104","vendor":"Accellion"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27102"],"exploited":"in-the-wild","identifiers":["CVE-2021-27102"],"json":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27102.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27102 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"FTA","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"accellion-fta-cve-2021-27102","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Accellion FTA contains an OS command injection vulnerability exploited via a local web service call. CISA added CVE-2021-27102 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-78"],"title":"Accellion FTA OS Command Injection Vulnerability (CVE-2021-27102)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27102","vendor":"Accellion"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27101"],"exploited":"in-the-wild","identifiers":["CVE-2021-27101"],"json":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27101.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27101 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"FTA","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"accellion-fta-cve-2021-27101","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. CISA added CVE-2021-27101 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","sql-injection","cwe-89","cwe-138"],"title":"Accellion FTA SQL Injection Vulnerability (CVE-2021-27101)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27101","vendor":"Accellion"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27103"],"exploited":"in-the-wild","identifiers":["CVE-2021-27103"],"json":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27103.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27103 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"FTA","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"accellion-fta-cve-2021-27103","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. CISA added CVE-2021-27103 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","ssrf","cwe-918"],"title":"Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-27103)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/accellion-fta-cve-2021-27103","vendor":"Accellion"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21017"],"exploited":"in-the-wild","identifiers":["CVE-2021-21017"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2021-21017.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21017 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2021-21017","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. CISA added CVE-2021-21017 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-122"],"title":"Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability (CVE-2021-21017)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2021-21017","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-28550"],"exploited":"in-the-wild","identifiers":["CVE-2021-28550"],"json":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2021-28550.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-28550 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Acrobat and Reader","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-acrobat-and-reader-cve-2021-28550","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. CISA added CVE-2021-28550 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Adobe Acrobat and Reader Use-After-Free Vulnerability (CVE-2021-28550)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/adobe-acrobat-and-reader-cve-2021-28550","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-4939"],"exploited":"in-the-wild","identifiers":["CVE-2018-4939"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2018-4939.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-4939 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2018-4939","stacks":["rust"],"startedAt":"2021-11-03","status":"closed","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution. CISA added CVE-2018-4939 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","deserialization","cwe-502"],"title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2018-4939)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2018-4939","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-15961"],"exploited":"in-the-wild","identifiers":["CVE-2018-15961"],"json":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2018-15961.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-15961 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"ColdFusion","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-coldfusion-cve-2018-15961","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution. CISA added CVE-2018-15961 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-434"],"title":"Adobe ColdFusion Unrestricted File Upload Vulnerability (CVE-2018-15961)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/adobe-coldfusion-cve-2018-15961","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-4878"],"exploited":"in-the-wild","identifiers":["CVE-2018-4878"],"json":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2018-4878.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-4878 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"unpatched","product":"Flash Player","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"adobe-flash-player-cve-2018-4878","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution. CISA added CVE-2018-4878 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","memory-corruption","cwe-416"],"title":"Adobe Flash Player Use-After-Free Vulnerability (CVE-2018-4878)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/adobe-flash-player-cve-2018-4878","vendor":"Adobe"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-5735"],"exploited":"in-the-wild","identifiers":["CVE-2020-5735"],"json":"https://helix.ml/threat-watch/i/amcrest-cameras-and-network-video-recorder-nvr-cve-2020-5735.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-5735 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Cameras and Network Video Recorder (NVR)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"amcrest-cameras-and-network-video-recorder-nvr-cve-2020-5735","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code. CISA added CVE-2020-5735 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-121"],"title":"Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability (CVE-2020-5735)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/amcrest-cameras-and-network-video-recorder-nvr-cve-2020-5735","vendor":"Amcrest"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-2215"],"exploited":"in-the-wild","identifiers":["CVE-2019-2215"],"json":"https://helix.ml/threat-watch/i/android-android-kernel-cve-2019-2215.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-2215 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Android Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-android-kernel-cve-2019-2215","stacks":["android","linux"],"startedAt":"2021-11-03","status":"closed","summary":"Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain \"AbstractEmu.\". CISA added CVE-2019-2215 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-416"],"title":"Android Kernel Use-After-Free Vulnerability (CVE-2019-2215)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/android-android-kernel-cve-2019-2215","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0041"],"exploited":"in-the-wild","identifiers":["CVE-2020-0041"],"json":"https://helix.ml/threat-watch/i/android-android-kernel-cve-2020-0041.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0041 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Android Kernel","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"android-android-kernel-cve-2020-0041","stacks":["android","linux"],"startedAt":"2021-11-03","status":"closed","summary":"Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain \"AbstractEmu.\". CISA added CVE-2020-0041 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-20"],"title":"Android Kernel Out-of-Bounds Write Vulnerability (CVE-2020-0041)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/android-android-kernel-cve-2020-0041","vendor":"Android"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-0069"],"exploited":"in-the-wild","identifiers":["CVE-2020-0069"],"json":"https://helix.ml/threat-watch/i/mediatek-multiple-chipsets-cve-2020-0069.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-0069 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Chipsets","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"mediatek-multiple-chipsets-cve-2020-0069","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain \"AbstractEmu.\". CISA added CVE-2020-0069 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","memory-corruption","cwe-787"],"title":"Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability (CVE-2020-0069)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/mediatek-multiple-chipsets-cve-2020-0069","vendor":"MediaTek"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-9805"],"exploited":"in-the-wild","identifiers":["CVE-2017-9805"],"json":"https://helix.ml/threat-watch/i/apache-struts-cve-2017-9805.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-9805 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Struts","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-cve-2017-9805","stacks":["java","rust"],"startedAt":"2021-11-03","status":"closed","summary":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. CISA added CVE-2017-9805 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","deserialization","cwe-502"],"title":"Apache Struts Deserialization of Untrusted Data Vulnerability (CVE-2017-9805)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2017-9805","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-42013"],"exploited":"in-the-wild","identifiers":["CVE-2021-42013"],"json":"https://helix.ml/threat-watch/i/apache-http-server-cve-2021-42013.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-42013 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"HTTP Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-http-server-cve-2021-42013","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773. CISA added CVE-2021-42013 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-22"],"title":"Apache HTTP Server Path Traversal Vulnerability (CVE-2021-42013)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-http-server-cve-2021-42013","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-41773"],"exploited":"in-the-wild","identifiers":["CVE-2021-41773"],"json":"https://helix.ml/threat-watch/i/apache-http-server-cve-2021-41773.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-41773 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"HTTP Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-http-server-cve-2021-41773","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013. CISA added CVE-2021-41773 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-22"],"title":"Apache HTTP Server Path Traversal Vulnerability (CVE-2021-41773)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-http-server-cve-2021-41773","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-0211"],"exploited":"in-the-wild","identifiers":["CVE-2019-0211"],"json":"https://helix.ml/threat-watch/i/apache-http-server-cve-2019-0211.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-0211 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"HTTP Server","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-http-server-cve-2019-0211","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard. CISA added CVE-2019-0211 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-416"],"title":"Apache HTTP Server Privilege Escalation Vulnerability (CVE-2019-0211)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-http-server-cve-2019-0211","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2016-4437"],"exploited":"in-the-wild","identifiers":["CVE-2016-4437"],"json":"https://helix.ml/threat-watch/i/apache-shiro-cve-2016-4437.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2016-4437 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Shiro","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-shiro-cve-2016-4437","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature. CISA added CVE-2016-4437 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Apache Shiro Code Execution Vulnerability (CVE-2016-4437)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-shiro-cve-2016-4437","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-17558"],"exploited":"in-the-wild","identifiers":["CVE-2019-17558"],"json":"https://helix.ml/threat-watch/i/apache-solr-cve-2019-17558.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-17558 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Solr","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-solr-cve-2019-17558","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution. CISA added CVE-2019-17558 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-74"],"title":"Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability (CVE-2019-17558)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-solr-cve-2019-17558","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-17530"],"exploited":"in-the-wild","identifiers":["CVE-2020-17530"],"json":"https://helix.ml/threat-watch/i/apache-struts-cve-2020-17530.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-17530 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Struts","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-cve-2020-17530","stacks":["java"],"startedAt":"2021-11-03","status":"closed","summary":"Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution. CISA added CVE-2020-17530 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-917"],"title":"Apache Struts Remote Code Execution Vulnerability (CVE-2020-17530)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2020-17530","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-5638"],"exploited":"in-the-wild","identifiers":["CVE-2017-5638"],"json":"https://helix.ml/threat-watch/i/apache-struts-cve-2017-5638.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-5638 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Struts","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-cve-2017-5638","stacks":["java"],"startedAt":"2021-11-03","status":"closed","summary":"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. CISA added CVE-2017-5638 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Apache Struts Remote Code Execution Vulnerability (CVE-2017-5638)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2017-5638","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-11776"],"exploited":"in-the-wild","identifiers":["CVE-2018-11776"],"json":"https://helix.ml/threat-watch/i/apache-struts-cve-2018-11776.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-11776 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Struts","severity":"high","severityNote":"CVSS 8.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apache-struts-cve-2018-11776","stacks":["java"],"startedAt":"2021-11-03","status":"closed","summary":"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace. CISA added CVE-2018-11776 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Apache Struts Remote Code Execution Vulnerability (CVE-2018-11776)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2018-11776","vendor":"Apache"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30858"],"exploited":"in-the-wild","identifiers":["CVE-2021-30858"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-30858.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30858 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2021-30858","stacks":["ios","macos"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-30858 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple iOS, iPadOS, macOS Use-After-Free Vulnerability (CVE-2021-30858)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-30858","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-6223"],"exploited":"in-the-wild","identifiers":["CVE-2019-6223"],"json":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2019-6223.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-6223 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"iOS and macOS","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-and-macos-cve-2019-6223","stacks":["ios","macos"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction. CISA added CVE-2019-6223 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev"],"title":"Apple iOS and macOS Group Facetime Vulnerability (CVE-2019-6223)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-and-macos-cve-2019-6223","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30860"],"exploited":"in-the-wild","identifiers":["CVE-2021-30860"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30860.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30860 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-30860","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY. CISA added CVE-2021-30860 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20","cwe-190"],"title":"Apple Multiple Products Integer Overflow Vulnerability (CVE-2021-30860)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30860","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-27930"],"exploited":"in-the-wild","identifiers":["CVE-2020-27930"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-27930.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-27930 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2020-27930","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front. CISA added CVE-2020-27930 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2020-27930)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-27930","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30807"],"exploited":"in-the-wild","identifiers":["CVE-2021-30807"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30807.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30807 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-30807","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges. CISA added CVE-2021-30807 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products Memory Corruption Vulnerability (CVE-2021-30807)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30807","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-27950"],"exploited":"in-the-wild","identifiers":["CVE-2020-27950"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-27950.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-27950 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2020-27950","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory. CISA added CVE-2020-27950 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-665"],"title":"Apple Multiple Products Memory Initialization Vulnerability (CVE-2020-27950)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-27950","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-27932"],"exploited":"in-the-wild","identifiers":["CVE-2020-27932"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-27932.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-27932 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2020-27932","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges. CISA added CVE-2020-27932 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Apple Multiple Products Type Confusion Vulnerability (CVE-2020-27932)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-27932","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-9818"],"exploited":"in-the-wild","identifiers":["CVE-2020-9818"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2020-9818.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-9818 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"iOS, iPadOS, and watchOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-watchos-cve-2020-9818","stacks":["ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message. CISA added CVE-2020-9818 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability (CVE-2020-9818)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2020-9818","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-9819"],"exploited":"in-the-wild","identifiers":["CVE-2020-9819"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2020-9819.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-9819 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"iOS, iPadOS, and watchOS","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-watchos-cve-2020-9819","stacks":["ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message. CISA added CVE-2020-9819 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability (CVE-2020-9819)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2020-9819","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30762"],"exploited":"in-the-wild","identifiers":["CVE-2021-30762"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2021-30762.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30762 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2021-30762","stacks":["browser","ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-30762 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple iOS WebKit Use-After-Free Vulnerability (CVE-2021-30762)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2021-30762","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1782"],"exploited":"in-the-wild","identifiers":["CVE-2021-1782"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-1782.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1782 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-1782","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges. CISA added CVE-2021-1782 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-362","cwe-667"],"title":"Apple Multiple Products Race Condition Vulnerability (CVE-2021-1782)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-1782","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1870"],"exploited":"in-the-wild","identifiers":["CVE-2021-1870"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-1870.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1870 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2021-1870","stacks":["browser","ios","macos"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-1870 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-1173"],"title":"Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability (CVE-2021-1870)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-1870","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1871"],"exploited":"in-the-wild","identifiers":["CVE-2021-1871"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-1871.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1871 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2021-1871","stacks":["browser","ios","macos"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-1871 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-1173"],"title":"Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability (CVE-2021-1871)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-1871","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1879"],"exploited":"in-the-wild","identifiers":["CVE-2021-1879"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2021-1879.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1879 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS, iPadOS, and watchOS","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-watchos-cve-2021-1879","stacks":["browser","ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-1879 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","xss","cwe-79"],"title":"Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability (CVE-2021-1879)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-watchos-cve-2021-1879","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30661"],"exploited":"in-the-wild","identifiers":["CVE-2021-30661"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30661.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30661 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-30661","stacks":["browser","ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-30661 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Apple Multiple Products WebKit Storage Use-After-Free Vulnerability (CVE-2021-30661)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30661","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30666"],"exploited":"in-the-wild","identifiers":["CVE-2021-30666"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2021-30666.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30666 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2021-30666","stacks":["browser","ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-30666 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-119"],"title":"Apple iOS WebKit Buffer Overflow Vulnerability (CVE-2021-30666)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2021-30666","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30713"],"exploited":"in-the-wild","identifiers":["CVE-2021-30713"],"json":"https://helix.ml/threat-watch/i/apple-macos-cve-2021-30713.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30713 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-macos-cve-2021-30713","stacks":["macos"],"startedAt":"2021-11-03","status":"closed","summary":"Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences. CISA added CVE-2021-30713 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-862"],"title":"Apple macOS Unspecified Vulnerability (CVE-2021-30713)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-macos-cve-2021-30713","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30657"],"exploited":"in-the-wild","identifiers":["CVE-2021-30657"],"json":"https://helix.ml/threat-watch/i/apple-macos-cve-2021-30657.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30657 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"macOS","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-macos-cve-2021-30657","stacks":["macos"],"startedAt":"2021-11-03","status":"closed","summary":"Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks. CISA added CVE-2021-30657 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-862"],"title":"Apple macOS Unspecified Vulnerability (CVE-2021-30657)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-macos-cve-2021-30657","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30665"],"exploited":"in-the-wild","identifiers":["CVE-2021-30665"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30665.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30665 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-30665","stacks":["browser","ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-30665 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple Multiple Products WebKit Memory Corruption Vulnerability (CVE-2021-30665)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30665","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30663"],"exploited":"in-the-wild","identifiers":["CVE-2021-30663"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30663.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30663 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2021-30663","stacks":["browser","ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-30663 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20","cwe-190"],"title":"Apple Multiple Products WebKit Integer Overflow Vulnerability (CVE-2021-30663)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2021-30663","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30761"],"exploited":"in-the-wild","identifiers":["CVE-2021-30761"],"json":"https://helix.ml/threat-watch/i/apple-ios-cve-2021-30761.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30761 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-cve-2021-30761","stacks":["browser","ios"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. CISA added CVE-2021-30761 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Apple iOS WebKit Memory Corruption Vulnerability (CVE-2021-30761)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-cve-2021-30761","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-30869"],"exploited":"in-the-wild","identifiers":["CVE-2021-30869"],"json":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-30869.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-30869 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"iOS, iPadOS, and macOS","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-ios-ipados-and-macos-cve-2021-30869","stacks":["ios","macos"],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges. CISA added CVE-2021-30869 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-843"],"title":"Apple iOS, iPadOS, and macOS Type Confusion Vulnerability (CVE-2021-30869)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-ios-ipados-and-macos-cve-2021-30869","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-9859"],"exploited":"in-the-wild","identifiers":["CVE-2020-9859"],"json":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-9859.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-9859 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Products","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"apple-multiple-products-cve-2020-9859","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges. CISA added CVE-2020-9859 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-415"],"title":"Apple Multiple Products Code Execution Vulnerability (CVE-2020-9859)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2020-9859","vendor":"Apple"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-20090"],"exploited":"in-the-wild","identifiers":["CVE-2021-20090"],"json":"https://helix.ml/threat-watch/i/arcadyan-buffalo-firmware-cve-2021-20090.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-20090 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Buffalo Firmware","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arcadyan-buffalo-firmware-cve-2021-20090","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors. CISA added CVE-2021-20090 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","auth-bypass","path-traversal","cwe-22"],"title":"Arcadyan Buffalo Firmware Path Traversal Vulnerability (CVE-2021-20090)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/arcadyan-buffalo-firmware-cve-2021-20090","vendor":"Arcadyan"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-27562"],"exploited":"in-the-wild","identifiers":["CVE-2021-27562"],"json":"https://helix.ml/threat-watch/i/arm-trusted-firmware-cve-2021-27562.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-27562 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Trusted Firmware","severity":"medium","severityNote":"CVSS 5.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-trusted-firmware-cve-2021-27562","stacks":["rust"],"startedAt":"2021-11-03","status":"closed","summary":"Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers. CISA added CVE-2021-27562 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Arm Trusted Firmware Out-of-Bounds Write Vulnerability (CVE-2021-27562)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/arm-trusted-firmware-cve-2021-27562","vendor":"Arm"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-28664"],"exploited":"in-the-wild","identifiers":["CVE-2021-28664"],"json":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2021-28664.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-28664 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Mali Graphics Processing Unit (GPU)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-graphics-processing-unit-gpu-cve-2021-28664","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes. CISA added CVE-2021-28664 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-787"],"title":"Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability (CVE-2021-28664)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2021-28664","vendor":"Arm"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-28663"],"exploited":"in-the-wild","identifiers":["CVE-2021-28663"],"json":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2021-28663.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-28663 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Mali Graphics Processing Unit (GPU)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"arm-mali-graphics-processing-unit-gpu-cve-2021-28663","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information. CISA added CVE-2021-28663 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-416"],"title":"Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability (CVE-2021-28663)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/arm-mali-graphics-processing-unit-gpu-cve-2021-28663","vendor":"Arm"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-3398"],"exploited":"in-the-wild","identifiers":["CVE-2019-3398"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-server-and-data-center-cve-2019-3398.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-3398 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Confluence Server and Data Center","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-server-and-data-center-cve-2019-3398","stacks":["devtools","java"],"startedAt":"2021-11-03","status":"closed","summary":"Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution. CISA added CVE-2019-3398 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","path-traversal","cwe-22"],"title":"Atlassian Confluence Server and Data Center Path Traversal Vulnerability (CVE-2019-3398)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-server-and-data-center-cve-2019-3398","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-26084"],"exploited":"in-the-wild","identifiers":["CVE-2021-26084"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-server-and-data-center-cve-2021-26084.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-26084 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Confluence Server and Data Center","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-server-and-data-center-cve-2021-26084","stacks":["devtools","java"],"startedAt":"2021-11-03","status":"closed","summary":"Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. CISA added CVE-2021-26084 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-917"],"title":"Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability (CVE-2021-26084)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-server-and-data-center-cve-2021-26084","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-11580"],"exploited":"in-the-wild","identifiers":["CVE-2019-11580"],"json":"https://helix.ml/threat-watch/i/atlassian-crowd-and-crowd-data-center-cve-2019-11580.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-11580 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Crowd and Crowd Data Center","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-crowd-and-crowd-data-center-cve-2019-11580","stacks":["devtools"],"startedAt":"2021-11-03","status":"closed","summary":"Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds. CISA added CVE-2019-11580 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability (CVE-2019-11580)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/atlassian-crowd-and-crowd-data-center-cve-2019-11580","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-3396"],"exploited":"in-the-wild","identifiers":["CVE-2019-3396"],"json":"https://helix.ml/threat-watch/i/atlassian-confluence-server-and-data-server-cve-2019-3396.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-3396 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Confluence Server and Data Server","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"atlassian-confluence-server-and-data-server-cve-2019-3396","stacks":["devtools","java"],"startedAt":"2021-11-03","status":"closed","summary":"Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution. CISA added CVE-2019-3396 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","path-traversal","cwe-22"],"title":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability (CVE-2019-3396)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/atlassian-confluence-server-and-data-server-cve-2019-3396","vendor":"Atlassian"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-42258"],"exploited":"in-the-wild","identifiers":["CVE-2021-42258"],"json":"https://helix.ml/threat-watch/i/bqe-billquick-web-suite-cve-2021-42258.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-42258 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"BillQuick Web Suite","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"bqe-billquick-web-suite-cve-2021-42258","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution. CISA added CVE-2021-42258 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","sql-injection","cwe-89"],"title":"BQE BillQuick Web Suite SQL Injection Vulnerability (CVE-2021-42258)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/bqe-billquick-web-suite-cve-2021-42258","vendor":"BQE"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3452"],"exploited":"in-the-wild","identifiers":["CVE-2020-3452"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3452.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3452 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3452","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs.  An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. CISA added CVE-2020-3452 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","path-traversal","cwe-20"],"title":"Cisco ASA and FTD Read-Only Path Traversal Vulnerability (CVE-2020-3452)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3452","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3580"],"exploited":"in-the-wild","identifiers":["CVE-2020-3580"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3580.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3580 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","severity":"medium","severityNote":"CVSS 6.1 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3580","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface.  Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information. CISA added CVE-2020-3580 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","xss","cwe-79"],"title":"Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability (CVE-2020-3580)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-and-firepower-threat-defense-ftd-cve-2020-3580","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1497"],"exploited":"in-the-wild","identifiers":["CVE-2021-1497"],"json":"https://helix.ml/threat-watch/i/cisco-hyperflex-hx-cve-2021-1497.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1497 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"HyperFlex HX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-hyperflex-hx-cve-2021-1497","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user. CISA added CVE-2021-1497 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability (CVE-2021-1497)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-hyperflex-hx-cve-2021-1497","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-1498"],"exploited":"in-the-wild","identifiers":["CVE-2021-1498"],"json":"https://helix.ml/threat-watch/i/cisco-hyperflex-hx-cve-2021-1498.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-1498 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"HyperFlex HX","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-hyperflex-hx-cve-2021-1498","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user. CISA added CVE-2021-1498 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Cisco HyperFlex HX Data Platform Command Injection Vulnerability (CVE-2021-1498)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-hyperflex-hx-cve-2021-1498","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-0171"],"exploited":"in-the-wild","identifiers":["CVE-2018-0171"],"json":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2018-0171.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-0171 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"IOS and IOS XE","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-and-ios-xe-cve-2018-0171","stacks":["ios","network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device. CISA added CVE-2018-0171 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (CVE-2018-0171)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-ios-and-ios-xe-cve-2018-0171","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3118"],"exploited":"in-the-wild","identifiers":["CVE-2020-3118"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2020-3118.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3118 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"IOS XR","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-cve-2020-3118","stacks":["ios","network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device. CISA added CVE-2020-3118 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-134"],"title":"Cisco IOS XR Software Discovery Protocol Format String Vulnerability (CVE-2020-3118)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2020-3118","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3566"],"exploited":"in-the-wild","identifiers":["CVE-2020-3566"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2020-3566.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3566 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"IOS XR","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-cve-2020-3566","stacks":["ios","network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash. CISA added CVE-2020-3566 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-400"],"title":"Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability (CVE-2020-3566)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2020-3566","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3569"],"exploited":"in-the-wild","identifiers":["CVE-2020-3569"],"json":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2020-3569.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3569 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"IOS XR","severity":"high","severityNote":"CVSS 8.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-ios-xr-cve-2020-3569","stacks":["ios","network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash. CISA added CVE-2020-3569 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-400"],"title":"Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability (CVE-2020-3569)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-ios-xr-cve-2020-3569","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-3161"],"exploited":"in-the-wild","identifiers":["CVE-2020-3161"],"json":"https://helix.ml/threat-watch/i/cisco-cisco-ip-phones-cve-2020-3161.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-3161 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Cisco IP Phones","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-cisco-ip-phones-cve-2020-3161","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition. CISA added CVE-2020-3161 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-20"],"title":"Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability (CVE-2020-3161)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-cisco-ip-phones-cve-2020-3161","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-1653"],"exploited":"in-the-wild","identifiers":["CVE-2019-1653"],"json":"https://helix.ml/threat-watch/i/cisco-small-business-rv320-and-rv325-routers-cve-2019-1653.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-1653 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Small Business RV320 and RV325 Routers","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-small-business-rv320-and-rv325-routers-cve-2019-1653","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information. CISA added CVE-2019-1653 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability (CVE-2019-1653)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-small-business-rv320-and-rv325-routers-cve-2019-1653","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-0296"],"exploited":"in-the-wild","identifiers":["CVE-2018-0296"],"json":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2018-0296.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-0296 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Adaptive Security Appliance (ASA)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"cisco-adaptive-security-appliance-asa-cve-2018-0296","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure. CISA added CVE-2018-0296 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability (CVE-2018-0296)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/cisco-adaptive-security-appliance-asa-cve-2018-0296","vendor":"Cisco"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-13608"],"exploited":"in-the-wild","identifiers":["CVE-2019-13608"],"json":"https://helix.ml/threat-watch/i/citrix-storefront-server-cve-2019-13608.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-13608 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"StoreFront Server","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-storefront-server-cve-2019-13608","stacks":["cloud"],"startedAt":"2021-11-03","status":"closed","summary":"Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information. CISA added CVE-2019-13608 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-611"],"title":"Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability (CVE-2019-13608)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/citrix-storefront-server-cve-2019-13608","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8193"],"exploited":"in-the-wild","identifiers":["CVE-2020-8193"],"json":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8193.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8193 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8193","stacks":["cloud","vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation. CISA added CVE-2020-8193 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability (CVE-2020-8193)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8193","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8195"],"exploited":"in-the-wild","identifiers":["CVE-2020-8195"],"json":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8195.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8195 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8195","stacks":["cloud","vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. CISA added CVE-2020-8195 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-20"],"title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability (CVE-2020-8195)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8195","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8196"],"exploited":"in-the-wild","identifiers":["CVE-2020-8196"],"json":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8196.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8196 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","severity":"medium","severityNote":"CVSS 4.3 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8196","stacks":["cloud","vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. CISA added CVE-2020-8196 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-284"],"title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability (CVE-2020-8196)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2020-8196","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-19781"],"exploited":"in-the-wild","identifiers":["CVE-2019-19781"],"json":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2019-19781.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-19781 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2019-19781","stacks":["cloud","vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution. CISA added CVE-2019-19781 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-22"],"title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability (CVE-2019-19781)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/citrix-application-delivery-controller-adc-gateway-and-sd-wan-wanop-appliance-cve-2019-19781","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-11634"],"exploited":"in-the-wild","identifiers":["CVE-2019-11634"],"json":"https://helix.ml/threat-watch/i/citrix-workspace-application-and-receiver-for-windows-cve-2019-11634.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-11634 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Workspace Application and Receiver for Windows","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"citrix-workspace-application-and-receiver-for-windows-cve-2019-11634","stacks":["cloud","windows"],"startedAt":"2021-11-03","status":"closed","summary":"Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives. CISA added CVE-2019-11634 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce"],"title":"Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability (CVE-2019-11634)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/citrix-workspace-application-and-receiver-for-windows-cve-2019-11634","vendor":"Citrix"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-29557"],"exploited":"in-the-wild","identifiers":["CVE-2020-29557"],"json":"https://helix.ml/threat-watch/i/d-link-dir-825-r1-devices-cve-2020-29557.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-29557 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"DIR-825 R1 Devices","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dir-825-r1-devices-cve-2020-29557","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution. CISA added CVE-2020-29557 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","memory-corruption","cwe-119"],"title":"D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability (CVE-2020-29557)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/d-link-dir-825-r1-devices-cve-2020-29557","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-25506"],"exploited":"in-the-wild","identifiers":["CVE-2020-25506"],"json":"https://helix.ml/threat-watch/i/d-link-dns-320-device-cve-2020-25506.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-25506 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"DNS-320 Device","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"d-link-dns-320-device-cve-2020-25506","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution. CISA added CVE-2020-25506 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"D-Link DNS-320 Device Command Injection Vulnerability (CVE-2020-25506)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/d-link-dns-320-device-cve-2020-25506","vendor":"D-Link"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-15811"],"exploited":"in-the-wild","identifiers":["CVE-2018-15811"],"json":"https://helix.ml/threat-watch/i/dotnetnuke-dnn-dotnetnuke-dnn-cve-2018-15811.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-15811 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"DotNetNuke (DNN)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"dotnetnuke-dnn-dotnetnuke-dnn-cve-2018-15811","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. CISA added CVE-2018-15811 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-326"],"title":"DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability (CVE-2018-15811)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/dotnetnuke-dnn-dotnetnuke-dnn-cve-2018-15811","vendor":"DotNetNuke (DNN)"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-18325"],"exploited":"in-the-wild","identifiers":["CVE-2018-18325"],"json":"https://helix.ml/threat-watch/i/dotnetnuke-dnn-dotnetnuke-dnn-cve-2018-18325.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-18325 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"DotNetNuke (DNN)","severity":"high","severityNote":"CVSS 7.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"dotnetnuke-dnn-dotnetnuke-dnn-cve-2018-18325","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811. CISA added CVE-2018-18325 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-326"],"title":"DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability (CVE-2018-18325)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/dotnetnuke-dnn-dotnetnuke-dnn-cve-2018-18325","vendor":"DotNetNuke (DNN)"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2017-9822"],"exploited":"in-the-wild","identifiers":["CVE-2017-9822"],"json":"https://helix.ml/threat-watch/i/dotnetnuke-dnn-dotnetnuke-dnn-cve-2017-9822.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2017-9822 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"DotNetNuke (DNN)","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"dotnetnuke-dnn-dotnetnuke-dnn-cve-2017-9822","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization. CISA added CVE-2017-9822 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","deserialization","cwe-20"],"title":"DotNetNuke (DNN) Remote Code Execution Vulnerability (CVE-2017-9822)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/dotnetnuke-dnn-dotnetnuke-dnn-cve-2017-9822","vendor":"DotNetNuke (DNN)"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-15752"],"exploited":"in-the-wild","identifiers":["CVE-2019-15752"],"json":"https://helix.ml/threat-watch/i/docker-desktop-community-edition-cve-2019-15752.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-15752 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Desktop Community Edition","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"docker-desktop-community-edition-cve-2019-15752","stacks":["docker"],"startedAt":"2021-11-03","status":"closed","summary":"Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\\DockerDesktop\\version-bin\\. CISA added CVE-2019-15752 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","privilege-escalation","cwe-732"],"title":"Docker Desktop Community Edition Privilege Escalation Vulnerability (CVE-2019-15752)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/docker-desktop-community-edition-cve-2019-15752","vendor":"Docker"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8515"],"exploited":"in-the-wild","identifiers":["CVE-2020-8515"],"json":"https://helix.ml/threat-watch/i/draytek-multiple-vigor-routers-cve-2020-8515.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8515 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Multiple Vigor Routers","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"draytek-multiple-vigor-routers-cve-2020-8515","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution. CISA added CVE-2020-8515 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","rce","cwe-78"],"title":"Multiple DrayTek Vigor Routers Web Management Page Vulnerability (CVE-2020-8515)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/draytek-multiple-vigor-routers-cve-2020-8515","vendor":"DrayTek"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-7600"],"exploited":"in-the-wild","identifiers":["CVE-2018-7600"],"json":"https://helix.ml/threat-watch/i/drupal-drupal-core-cve-2018-7600.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-7600 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Drupal Core","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"drupal-drupal-core-cve-2018-7600","stacks":["php"],"startedAt":"2021-11-03","status":"closed","summary":"Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise. CISA added CVE-2018-7600 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20"],"title":"Drupal Core Remote Code Execution Vulnerability (CVE-2018-7600)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/drupal-drupal-core-cve-2018-7600","vendor":"Drupal"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22205"],"exploited":"in-the-wild","identifiers":["CVE-2021-22205"],"json":"https://helix.ml/threat-watch/i/gitlab-community-and-enterprise-editions-cve-2021-22205.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22205 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Community and Enterprise Editions","severity":"critical","severityNote":"CVSS 10.0 (v3.1) · exploited in the wild (CISA KEV)","slug":"gitlab-community-and-enterprise-editions-cve-2021-22205","stacks":["devtools"],"startedAt":"2021-11-03","status":"closed","summary":"GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. CISA added CVE-2021-22205 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-20","cwe-95"],"title":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability (CVE-2021-22205)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/gitlab-community-and-enterprise-editions-cve-2021-22205","vendor":"GitLab"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-6789"],"exploited":"in-the-wild","identifiers":["CVE-2018-6789"],"json":"https://helix.ml/threat-watch/i/exim-exim-cve-2018-6789.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-6789 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Exim","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"exim-exim-cve-2018-6789","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution. CISA added CVE-2018-6789 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","memory-corruption","cwe-119"],"title":"Exim Buffer Overflow Vulnerability (CVE-2018-6789)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/exim-exim-cve-2018-6789","vendor":"Exim"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8657"],"exploited":"in-the-wild","identifiers":["CVE-2020-8657"],"json":"https://helix.ml/threat-watch/i/eyesofnetwork-eyesofnetwork-cve-2020-8657.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8657 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"EyesOfNetwork","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"eyesofnetwork-eyesofnetwork-cve-2020-8657","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token. CISA added CVE-2020-8657 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","hard-coded-credentials","cwe-798"],"title":"EyesOfNetwork Use of Hard-Coded Credentials Vulnerability (CVE-2020-8657)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/eyesofnetwork-eyesofnetwork-cve-2020-8657","vendor":"EyesOfNetwork"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-8655"],"exploited":"in-the-wild","identifiers":["CVE-2020-8655"],"json":"https://helix.ml/threat-watch/i/eyesofnetwork-eyesofnetwork-cve-2020-8655.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-8655 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"EyesOfNetwork","severity":"high","severityNote":"CVSS 7.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"eyesofnetwork-eyesofnetwork-cve-2020-8655","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7. CISA added CVE-2020-8655 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-269"],"title":"EyesOfNetwork Improper Privilege Management Vulnerability (CVE-2020-8655)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/eyesofnetwork-eyesofnetwork-cve-2020-8655","vendor":"EyesOfNetwork"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-5902"],"exploited":"in-the-wild","identifiers":["CVE-2020-5902"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-cve-2020-5902.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-5902 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"BIG-IP","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-cve-2020-5902","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages. CISA added CVE-2020-5902 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-22"],"title":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability (CVE-2020-5902)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-cve-2020-5902","vendor":"F5"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-22986"],"exploited":"in-the-wild","identifiers":["CVE-2021-22986"],"json":"https://helix.ml/threat-watch/i/f5-big-ip-and-big-iq-centralized-management-cve-2021-22986.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-22986 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"BIG-IP and BIG-IQ Centralized Management","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"f5-big-ip-and-big-iq-centralized-management-cve-2021-22986","stacks":["network"],"startedAt":"2021-11-03","status":"closed","summary":"F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services. CISA added CVE-2021-22986 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-863"],"title":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability (CVE-2021-22986)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/f5-big-ip-and-big-iq-centralized-management-cve-2021-22986","vendor":"F5"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-35464"],"exploited":"in-the-wild","identifiers":["CVE-2021-35464"],"json":"https://helix.ml/threat-watch/i/forgerock-access-management-am-cve-2021-35464.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-35464 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Access Management (AM)","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"forgerock-access-management-am-cve-2021-35464","stacks":[],"startedAt":"2021-11-03","status":"closed","summary":"ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend). CISA added CVE-2021-35464 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","rce","cwe-502"],"title":"ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability (CVE-2021-35464)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/forgerock-access-management-am-cve-2021-35464","vendor":"ForgeRock"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2019-5591"],"exploited":"in-the-wild","identifiers":["CVE-2019-5591"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2019-5591.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2019-5591 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"FortiOS","severity":"medium","severityNote":"CVSS 6.5 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2019-5591","stacks":["network","vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server. CISA added CVE-2019-5591 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","cwe-306"],"title":"Fortinet FortiOS Default Configuration Vulnerability (CVE-2019-5591)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2019-5591","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-12812"],"exploited":"in-the-wild","identifiers":["CVE-2020-12812"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2020-12812.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-12812 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"FortiOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2020-12812","stacks":["network","vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. CISA added CVE-2020-12812 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","auth-bypass","cwe-178","cwe-287"],"title":"Fortinet FortiOS SSL VPN Improper Authentication Vulnerability (CVE-2020-12812)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2020-12812","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2018-13379"],"exploited":"in-the-wild","identifiers":["CVE-2018-13379"],"json":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2018-13379.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2018-13379 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"FortiOS","severity":"critical","severityNote":"CVSS 9.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"fortinet-fortios-cve-2018-13379","stacks":["network","vpn"],"startedAt":"2021-11-03","status":"closed","summary":"Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. CISA added CVE-2018-13379 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.","tags":["cisa-kev","ransomware","path-traversal","cwe-22"],"title":"Fortinet FortiOS SSL VPN Path Traversal Vulnerability (CVE-2018-13379)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/fortinet-fortios-cve-2018-13379","vendor":"Fortinet"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-16010"],"exploited":"in-the-wild","identifiers":["CVE-2020-16010"],"json":"https://helix.ml/threat-watch/i/google-chrome-for-android-ui-cve-2020-16010.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-16010 to the Known Exploited Vulnerabilities catalog (federal remediation due May 3, 2022)"},"patchStatus":"patched","product":"Chrome for Android UI","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chrome-for-android-ui-cve-2020-16010","stacks":["android","browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. CISA added CVE-2020-16010 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chrome for Android UI Heap Buffer Overflow Vulnerability (CVE-2020-16010)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/google-chrome-for-android-ui-cve-2020-16010","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2020-15999"],"exploited":"in-the-wild","identifiers":["CVE-2020-15999"],"json":"https://helix.ml/threat-watch/i/google-chrome-freetype-cve-2020-15999.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2020-15999 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chrome FreeType","severity":"critical","severityNote":"CVSS 9.6 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chrome-freetype-cve-2020-15999","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android. CISA added CVE-2020-15999 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","memory-corruption","cwe-787"],"title":"Google Chrome FreeType Heap Buffer Overflow Vulnerability (CVE-2020-15999)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/google-chrome-freetype-cve-2020-15999","vendor":"Google"},{"auto":true,"category":"patch","closedAt":"2021-11-17","cveIds":["CVE-2021-21166"],"exploited":"in-the-wild","identifiers":["CVE-2021-21166"],"json":"https://helix.ml/threat-watch/i/google-chromium-cve-2021-21166.json","latestUpdate":{"date":"2021-11-03","title":"CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 17, 2021)"},"patchStatus":"patched","product":"Chromium","severity":"high","severityNote":"CVSS 8.8 (v3.1) · exploited in the wild (CISA KEV)","slug":"google-chromium-cve-2021-21166","stacks":["browser"],"startedAt":"2021-11-03","status":"closed","summary":"Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2021-21166 to its Known Exploited Vulnerabilities catalog on Nov 3, 2021, which means attackers are exploiting it in the wild.","tags":["cisa-kev","cwe-122","cwe-362"],"title":"Google Chromium Race Condition Vulnerability (CVE-2021-21166)","updatedAt":"2026-10-25T09:11:37Z","url":"https://helix.ml/threat-watch/i/google-chromium-cve-2021-21166","vendor":"Google"},{"auto":true,"category":"breach","closedAt":"2021-11-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COINMARKETCAP"],"json":"https://helix.ml/threat-watch/i/coinmarketcap-data-breach.json","latestUpdate":{"date":"2021-10-22","title":"Have I Been Pwned loaded 3.1M breached CoinMarketCap accounts"},"patchStatus":"no-fix-needed","product":"coinmarketcap.com","severity":"medium","severityNote":"3.1M accounts","slug":"coinmarketcap-data-breach","stacks":[],"startedAt":"2021-10-22","status":"closed","summary":"During October 2021, 3.1 million email addresses with accounts on the cryptocurrency market capitalisation website CoinMarketCap were discovered being traded on hacking forums. Whilst the email addresses were found to correlate with CoinMarketCap accounts, it's unclear precisely how they were obtained. CoinMarketCap has provided the following statement on the data: \"CoinMarketCap has become aware that batches of data have shown up online purporting to be a list of user accounts. While the data lists we have seen are only email addresses (no passwords), we have found a correlation with our subscriber base. We have not found any evidence of a data leak from our own servers — we are actively investigating this issue and will update our subscribers as soon as we have any new information.\" Exposed data: email addresses. The breach dates from Oct 12, 2021; Have I Been Pwned loaded it on Oct 22, 2021.","tags":["data-breach","hibp","email-addresses"],"title":"CoinMarketCap data breach: 3.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/coinmarketcap-data-breach","vendor":"CoinMarketCap"},{"auto":true,"category":"breach","closedAt":"2021-10-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THINGIVERSE"],"json":"https://helix.ml/threat-watch/i/thingiverse-data-breach.json","latestUpdate":{"date":"2021-10-14","title":"Have I Been Pwned loaded 228K breached Thingiverse accounts"},"patchStatus":"no-fix-needed","product":"thingiverse.com","severity":"high","severityNote":"228K accounts · passwords exposed","slug":"thingiverse-data-breach","stacks":[],"startedAt":"2021-10-14","status":"closed","summary":"In October 2021, a database backup taken from the 3D model sharing service Thingiverse began extensively circulating within the hacking community. Dating back to October 2020, the 36GB file contained 228 thousand unique email addresses, mostly alongside comments left on 3D models. The data also included usernames, IP addresses, full names and passwords stored as either unsalted SHA-1 or bcrypt hashes. In some cases, physical addresses was also exposed. Thingiverse's owner, MakerBot, is aware of the incident but at the time of writing, is yet to issue a disclosure statement. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, physical addresses, usernames. The breach dates from Oct 13, 2020; Have I Been Pwned loaded it on Oct 14, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","physical-addresses","usernames"],"title":"Thingiverse data breach: 228K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/thingiverse-data-breach","vendor":"Thingiverse"},{"auto":true,"category":"breach","closedAt":"2021-10-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PLAYBOOK"],"json":"https://helix.ml/threat-watch/i/playbook-data-breach.json","latestUpdate":{"date":"2021-10-11","title":"Have I Been Pwned loaded 50K breached Playbook accounts"},"patchStatus":"no-fix-needed","product":"playbook.vc","severity":"high","severityNote":"50K accounts · passwords exposed","slug":"playbook-data-breach","stacks":[],"startedAt":"2021-10-11","status":"closed","summary":"In September 2021, a publicly accessible PostgresSQL database belonging to the Playbook service was identified. Run by VC firm Plug and Play Ventures, the database had been exposed since October 2020 and contained more than 50 thousand unique email addresses along with names, phone numbers, job titles and passwords stored as PBKDF2 hashes. It took more than 2 weeks after being notified of the exposed data to properly secure it. It's unknown whether Plug and Play Ventures notified impacted individuals as they ceased responding to queries from the press. Exposed data: email addresses, job titles, names, passwords, phone numbers, social media profiles. The breach dates from Oct 19, 2020; Have I Been Pwned loaded it on Oct 11, 2021.","tags":["data-breach","hibp","email-addresses","job-titles","names","passwords","phone-numbers","social-media-profiles"],"title":"Playbook data breach: 50K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/playbook-data-breach","vendor":"Playbook"},{"auto":true,"category":"breach","closedAt":"2021-10-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FANTASYFOOTBALLHUB"],"json":"https://helix.ml/threat-watch/i/fantasyfootballhub-data-breach.json","latestUpdate":{"date":"2021-10-07","title":"Have I Been Pwned loaded 66K breached Fantasy Football Hub accounts"},"patchStatus":"no-fix-needed","product":"fantasyfootballhub.co.uk","severity":"high","severityNote":"66K accounts · passwords exposed","slug":"fantasyfootballhub-data-breach","stacks":[],"startedAt":"2021-10-07","status":"closed","summary":"In October 2021, the fantasy premier league (soccer) website Fantasy Football Hub suffered a data breach that exposed 66 thousand unique email addresses. The data included names, usernames, IP addresses, transactions and passwords stored as WordPress MD5 hashes. Exposed data: email addresses, ip addresses, names, passwords, purchases, usernames. The breach dates from Oct 2, 2021; Have I Been Pwned loaded it on Oct 7, 2021.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","purchases","usernames"],"title":"Fantasy Football Hub data breach: 66K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/fantasyfootballhub-data-breach","vendor":"Fantasy Football Hub"},{"auto":true,"category":"breach","closedAt":"2021-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REPUBLICANPARTYOFTEXAS"],"json":"https://helix.ml/threat-watch/i/republicanpartyoftexas-data-breach.json","latestUpdate":{"date":"2021-10-06","title":"Have I Been Pwned loaded 72K breached Republican Party of Texas accounts"},"patchStatus":"no-fix-needed","product":"texasgop.org","severity":"medium","severityNote":"72K accounts","slug":"republicanpartyoftexas-data-breach","stacks":[],"startedAt":"2021-10-06","status":"closed","summary":"In September 2021, the Republican Party of Texas was hacked by a group claiming to be \"Anonymous\" in retaliation for the state's controversial abortion ban. The September defacement was followed by a leak of data and documents which included material from the hosting provider Epik. Impacted data included over 72 thousand unique email addresses across various tables, some also including names, geographic location data, IP addresses and browser user agents. Exposed data: browser user agent details, email addresses, geographic locations, ip addresses, names. The breach dates from Sep 11, 2021; Have I Been Pwned loaded it on Oct 6, 2021.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","geographic-locations","ip-addresses","names"],"title":"Republican Party of Texas data breach: 72K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/republicanpartyoftexas-data-breach","vendor":"Republican Party of Texas"},{"auto":true,"category":"breach","closedAt":"2021-10-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LINKEDINSCRAPE"],"json":"https://helix.ml/threat-watch/i/linkedinscrape-data-breach.json","latestUpdate":{"date":"2021-10-02","title":"Have I Been Pwned loaded 125.7M breached LinkedIn Scraped Data (2021) accounts"},"patchStatus":"no-fix-needed","product":"linkedin.com","severity":"high","severityNote":"125.7M accounts","slug":"linkedinscrape-data-breach","stacks":[],"startedAt":"2021-10-02","status":"closed","summary":"During the first half of 2021, LinkedIn was targeted by attackers who scraped data from hundreds of millions of public profiles and later sold them online. Whilst the scraping did not constitute a data breach nor did it access any personal data not intended to be publicly accessible, the data was still monetised and later broadly circulated in hacking circles. The scraped data contains approximately 400M records with 125M unique email addresses, as well as names, geographic locations, genders and job titles. LinkedIn specifically addresses the incident in their post on An update on report of scraped data. Exposed data: education levels, email addresses, genders, geographic locations, job titles, names, social media profiles. The breach dates from Apr 8, 2021; Have I Been Pwned loaded it on Oct 2, 2021.","tags":["data-breach","hibp","education-levels","email-addresses","genders","geographic-locations","job-titles","names","social-media-profiles"],"title":"LinkedIn Scraped Data (2021) data breach: 125.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/linkedinscrape-data-breach","vendor":"LinkedIn Scraped Data (2021)"},{"auto":true,"category":"breach","closedAt":"2021-10-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AJARN"],"json":"https://helix.ml/threat-watch/i/ajarn-data-breach.json","latestUpdate":{"date":"2021-09-26","title":"Have I Been Pwned loaded 266K breached Ajarn accounts"},"patchStatus":"no-fix-needed","product":"ajarn.com","severity":"high","severityNote":"266K accounts · passwords exposed","slug":"ajarn-data-breach","stacks":[],"startedAt":"2021-09-26","status":"closed","summary":"In September 2021, the Thai-based English language teaching website Ajarn discovered they'd been the victim of a data breach dating back to December 2018. The breach was self-submitted to HIBP and included 266k email addresses, names, genders, phone numbers and other personal information. Hashed passwords were also impacted in the breach. Exposed data: dates of birth, education levels, email addresses, genders, geographic locations, job applications, marital statuses, names, nationalities, passwords, phone numbers, profile photos. The breach dates from Dec 13, 2018; Have I Been Pwned loaded it on Sep 26, 2021.","tags":["data-breach","hibp","dates-of-birth","education-levels","email-addresses","genders","geographic-locations","job-applications","marital-statuses","names","nationalities","passwords","phone-numbers","profile-photos"],"title":"Ajarn data breach: 266K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ajarn-data-breach","vendor":"Ajarn"},{"auto":true,"category":"breach","closedAt":"2021-10-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EPIK"],"json":"https://helix.ml/threat-watch/i/epik-data-breach.json","latestUpdate":{"date":"2021-09-19","title":"Have I Been Pwned loaded 15.0M breached Epik accounts"},"patchStatus":"no-fix-needed","product":"epik.com","severity":"medium","severityNote":"15.0M accounts","slug":"epik-data-breach","stacks":[],"startedAt":"2021-09-19","status":"closed","summary":"In September 2021, the domain registrar and web host Epik suffered a significant data breach, allegedly in retaliation for hosting alt-right websites. The breach exposed a huge volume of data not just of Epik customers, but also scraped WHOIS records belonging to individuals and organisations who were not Epik customers. The data included over 15 million unique email addresses (including anonymised versions for domain privacy), names, phone numbers, physical addresses, purchases and passwords stored in various formats. Exposed data: email addresses, names, phone numbers, physical addresses, purchases. The breach dates from Sep 13, 2021; Have I Been Pwned loaded it on Sep 19, 2021.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"Epik data breach: 15.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/epik-data-breach","vendor":"Epik"},{"auto":true,"category":"breach","closedAt":"2021-09-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INDIAMART"],"json":"https://helix.ml/threat-watch/i/indiamart-data-breach.json","latestUpdate":{"date":"2021-08-27","title":"Have I Been Pwned loaded 20.2M breached IndiaMART accounts"},"patchStatus":"no-fix-needed","product":"indiamart.com","severity":"medium","severityNote":"20.2M accounts","slug":"indiamart-data-breach","stacks":[],"startedAt":"2021-08-27","status":"closed","summary":"In August 2021, 38 million records from Indian e-commerce company IndiaMART were found being traded on a popular hacking forum. Dated several months earlier, the data included over 20 million unique email addresses alongside names, phone numbers and physical addresses. It's unclear whether IndiaMART intentionally exposed the data attributes as part of the intended design of the platform or whether the data was obtained by exploiting a vulnerability in the service. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from May 23, 2021; Have I Been Pwned loaded it on Aug 27, 2021.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"IndiaMART data breach: 20.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/indiamart-data-breach","vendor":"IndiaMART"},{"auto":true,"category":"breach","closedAt":"2021-09-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IMAVEX"],"json":"https://helix.ml/threat-watch/i/imavex-data-breach.json","latestUpdate":{"date":"2021-08-26","title":"Have I Been Pwned loaded 878K breached Imavex accounts"},"patchStatus":"no-fix-needed","product":"imavex.com","severity":"high","severityNote":"878K accounts · passwords exposed · financial data exposed","slug":"imavex-data-breach","stacks":[],"startedAt":"2021-08-26","status":"closed","summary":"In August 2021, the website development company Imavex suffered a data breach that exposed 878 thousand unique email addresses. The data included user records containing names, usernames and password material with some records also containing genders and partial credit card data, including the last 4 digits of the card and expiry date. Hundreds of thousands of form submissions and orders via Imavex customers were also exposed and contained further personal information of submitters and the contents of the form. The compromised system was subsequently sunset in January 2024 and all customer data impacted by the incident was permanently deleted. Exposed data: email addresses, genders, names, partial credit card data, passwords, phone numbers, physical addresses, purchases, usernames. The breach dates from Aug 20, 2021; Have I Been Pwned loaded it on Aug 26, 2021.","tags":["data-breach","hibp","email-addresses","genders","names","partial-credit-card-data","passwords","phone-numbers","physical-addresses","purchases","usernames"],"title":"Imavex data breach: 878K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/imavex-data-breach","vendor":"Imavex"},{"auto":true,"category":"breach","closedAt":"2021-09-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EATIGO"],"json":"https://helix.ml/threat-watch/i/eatigo-data-breach.json","latestUpdate":{"date":"2021-08-25","title":"Have I Been Pwned loaded 2.8M breached Eatigo accounts"},"patchStatus":"no-fix-needed","product":"eatigo.com","severity":"high","severityNote":"2.8M accounts · passwords exposed","slug":"eatigo-data-breach","stacks":[],"startedAt":"2021-08-25","status":"closed","summary":"In October 2018, the restaurant reservation service Eatigo suffered a data breach that exposed 2.8 million accounts. The data included email addresses, names, phone numbers, social media profiles, genders and passwords stored as unsalted MD5 hashes. Exposed data: email addresses, genders, names, passwords, phone numbers, social media profiles. The breach dates from Oct 16, 2018; Have I Been Pwned loaded it on Aug 25, 2021.","tags":["data-breach","hibp","email-addresses","genders","names","passwords","phone-numbers","social-media-profiles"],"title":"Eatigo data breach: 2.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/eatigo-data-breach","vendor":"Eatigo"},{"auto":true,"category":"breach","closedAt":"2021-09-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUBAGAMES"],"json":"https://helix.ml/threat-watch/i/subagames-data-breach.json","latestUpdate":{"date":"2021-08-25","title":"Have I Been Pwned loaded 6.1M breached SubaGames accounts"},"patchStatus":"no-fix-needed","product":"subagames.com","severity":"high","severityNote":"6.1M accounts · passwords exposed","slug":"subagames-data-breach","stacks":[],"startedAt":"2021-08-25","status":"closed","summary":"In November 2016, the game developer Suba Games suffered a data breach which led to the exposure of 6.1M unique email addresses. Impacted data also included usernames and passwords, most of which appeared circulating in the breached file in plain text after being cracked from salted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, passwords, usernames. The breach dates from Nov 1, 2016; Have I Been Pwned loaded it on Aug 25, 2021.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"SubaGames data breach: 6.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/subagames-data-breach","vendor":"SubaGames"},{"auto":true,"category":"breach","closedAt":"2021-08-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ORDERSNAPP"],"json":"https://helix.ml/threat-watch/i/ordersnapp-data-breach.json","latestUpdate":{"date":"2021-08-08","title":"Have I Been Pwned loaded 1.3M breached OrderSnapp accounts"},"patchStatus":"no-fix-needed","product":"ordersnapp.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"ordersnapp-data-breach","stacks":[],"startedAt":"2021-08-08","status":"closed","summary":"In June 2020, the restaurant solutions provider OrderSnapp suffered a data breach which exposed 1.3M unique email addresses. Impacted data also included names, phone numbers, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, names, passwords, phone numbers. The breach dates from Jun 29, 2020; Have I Been Pwned loaded it on Aug 8, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers"],"title":"OrderSnapp data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ordersnapp-data-breach","vendor":"OrderSnapp"},{"auto":true,"category":"breach","closedAt":"2021-08-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MMGFUSION"],"json":"https://helix.ml/threat-watch/i/mmgfusion-data-breach.json","latestUpdate":{"date":"2021-08-07","title":"Have I Been Pwned loaded 2.7M breached MMG Fusion accounts"},"patchStatus":"no-fix-needed","product":"mmgfusion.com","severity":"high","severityNote":"2.7M accounts · passwords exposed","slug":"mmgfusion-data-breach","stacks":[],"startedAt":"2021-08-07","status":"closed","summary":"In December 2020, the dental practice management service MMG Fusion was the victim of a data breach which exposed 2.6M unique email addresses. The data also included patient appointments, names, phone numbers, dates of birth, genders and physical addresses. A small number of records also included passwords stored as bcrypt hashes. Exposed data: appointments, dates of birth, email addresses, genders, marital statuses, names, passwords, phone numbers, physical addresses. The breach dates from Dec 20, 2020; Have I Been Pwned loaded it on Aug 7, 2021.","tags":["data-breach","hibp","appointments","dates-of-birth","email-addresses","genders","marital-statuses","names","passwords","phone-numbers","physical-addresses"],"title":"MMG Fusion data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mmgfusion-data-breach","vendor":"MMG Fusion"},{"auto":true,"category":"breach","closedAt":"2021-08-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AUDI"],"json":"https://helix.ml/threat-watch/i/audi-data-breach.json","latestUpdate":{"date":"2021-07-23","title":"Have I Been Pwned loaded 2.7M breached Audi accounts"},"patchStatus":"no-fix-needed","product":"audiusa.com","severity":"medium","severityNote":"2.7M accounts","slug":"audi-data-breach","stacks":[],"startedAt":"2021-07-23","status":"closed","summary":"In August 2019, Audi USA suffered a data breach after a vendor left data unsecured and exposed on the internet. The data contained 2.7M unique email addresses along with names, phone numbers, physical addresses and vehicle information including VIN. In a disclosure statement from Audi, they also advised some customers had driver's licenses, dates of birth, social security numbers and other personal information exposed. Exposed data: dates of birth, driver's licenses, email addresses, names, phone numbers, physical addresses, social security numbers, vehicle details. The breach dates from Aug 14, 2019; Have I Been Pwned loaded it on Jul 23, 2021.","tags":["data-breach","hibp","dates-of-birth","driver-s-licenses","email-addresses","names","phone-numbers","physical-addresses","social-security-numbers","vehicle-details"],"title":"Audi data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/audi-data-breach","vendor":"Audi"},{"auto":true,"category":"breach","closedAt":"2021-08-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GUNTRADER"],"json":"https://helix.ml/threat-watch/i/guntrader-data-breach.json","latestUpdate":{"date":"2021-07-21","title":"Have I Been Pwned loaded 112K breached Guntrader accounts"},"patchStatus":"no-fix-needed","product":"guntrader.uk","severity":"high","severityNote":"112K accounts · passwords exposed","slug":"guntrader-data-breach","stacks":[],"startedAt":"2021-07-21","status":"closed","summary":"In July 2021, the United Kingdom based website Guntrader suffered a data breach that exposed 112k unique email addresses. Extensive personal information was also exposed including names, phone numbers, geolocation data, IP addresses and various physical address attributes (cities for all users, complete addresses for some). Passwords stored as bcrypt hashes were also exposed. Exposed data: browser user agent details, email addresses, geographic locations, ip addresses, names, passwords, phone numbers, physical addresses, salutations. The breach dates from Jul 17, 2021; Have I Been Pwned loaded it on Jul 21, 2021.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","geographic-locations","ip-addresses","names","passwords","phone-numbers","physical-addresses","salutations"],"title":"Guntrader data breach: 112K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/guntrader-data-breach","vendor":"Guntrader"},{"auto":true,"category":"breach","closedAt":"2021-08-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHORTEDITION"],"json":"https://helix.ml/threat-watch/i/shortedition-data-breach.json","latestUpdate":{"date":"2021-07-19","title":"Have I Been Pwned loaded 505K breached Short Édition accounts"},"patchStatus":"no-fix-needed","product":"short-edition.com","severity":"high","severityNote":"505K accounts · passwords exposed","slug":"shortedition-data-breach","stacks":[],"startedAt":"2021-07-19","status":"closed","summary":"In June 2021, the French publishing house of short literature Short Édition suffered a data breach that exposed 505k records. Impacted data included email and physical addresses, names, usernames, phone numbers, dates of birth, genders and passwords stored as either salted SHA-1 or salted SHA-512 hashes. Short Édition self-submitted the impacted data to HIBP. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, social media profiles, usernames. The breach dates from Jun 26, 2021; Have I Been Pwned loaded it on Jul 19, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","social-media-profiles","usernames"],"title":"Short Édition data breach: 505K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/shortedition-data-breach","vendor":"Short Édition"},{"auto":true,"category":"breach","closedAt":"2021-07-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VASTAAMO"],"json":"https://helix.ml/threat-watch/i/vastaamo-data-breach.json","latestUpdate":{"date":"2021-07-17","title":"Have I Been Pwned loaded 30K breached Vastaamo accounts"},"patchStatus":"no-fix-needed","product":"vastaamo.fi","severity":"high","severityNote":"30K accounts","slug":"vastaamo-data-breach","stacks":[],"startedAt":"2021-07-17","status":"closed","summary":"In October 2020, the Finnish psychotherapy service Vastaamo was the subject of a ransomware attack targeting first the company itself, followed by their patients directly. The original security incident dates back to a period between late 2018 and early 2019 and exposed data including 30k unique email addresses, names, social security numbers and notes on individuals' psychotherapy sessions. This breach has been flagged as \"sensitive\" and is only searchable by owners of the email addresses and domains exposed in the incident. Exposed data: email addresses, names, personal health data, social security numbers. The breach dates from Mar 31, 2019; Have I Been Pwned loaded it on Jul 17, 2021.","tags":["data-breach","hibp","email-addresses","names","personal-health-data","social-security-numbers"],"title":"Vastaamo data breach: 30K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/vastaamo-data-breach","vendor":"Vastaamo"},{"auto":true,"category":"breach","closedAt":"2021-07-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RAYCHAT"],"json":"https://helix.ml/threat-watch/i/raychat-data-breach.json","latestUpdate":{"date":"2021-07-04","title":"Have I Been Pwned loaded 938K breached Raychat accounts"},"patchStatus":"no-fix-needed","product":"raychat.ir","severity":"high","severityNote":"938K accounts · passwords exposed","slug":"raychat-data-breach","stacks":[],"startedAt":"2021-07-04","status":"closed","summary":"In January 2021, the now defunct Iranian social media platform Raychat suffered a data breach that exposed 939 thousand unique email addresses. The data included names, IP addresses, browser user agent strings and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: browser user agent details, email addresses, ip addresses, names, passwords. The breach dates from Jan 31, 2021; Have I Been Pwned loaded it on Jul 4, 2021.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","names","passwords"],"title":"Raychat data breach: 938K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/raychat-data-breach","vendor":"Raychat"},{"auto":true,"category":"breach","closedAt":"2021-07-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YOTEPRESTOCOM"],"json":"https://helix.ml/threat-watch/i/yoteprestocom-data-breach.json","latestUpdate":{"date":"2021-06-25","title":"Have I Been Pwned loaded 1.4M breached yotepresto.com accounts"},"patchStatus":"no-fix-needed","product":"yotepresto.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"yoteprestocom-data-breach","stacks":[],"startedAt":"2021-06-25","status":"closed","summary":"In June 2020, the Mexican lending platform yotepresto.com suffered a data breach. Over 1.4 million customers were impacted by the breach which disclosed email and IP addresses, usernames and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jun 22, 2020; Have I Been Pwned loaded it on Jun 25, 2021.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"yotepresto.com data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/yoteprestocom-data-breach","vendor":"yotepresto.com"},{"auto":true,"category":"breach","closedAt":"2021-07-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TEESPRING"],"json":"https://helix.ml/threat-watch/i/teespring-data-breach.json","latestUpdate":{"date":"2021-06-25","title":"Have I Been Pwned loaded 8.2M breached Teespring accounts"},"patchStatus":"no-fix-needed","product":"teespring.com","severity":"medium","severityNote":"8.2M accounts","slug":"teespring-data-breach","stacks":[],"startedAt":"2021-06-25","status":"closed","summary":"In April 2020, the custom printed apparel website Teespring suffered a data breach that exposed 8.2 million customer records. The data included email addresses, names, geographic locations and social media IDs. Exposed data: email addresses, geographic locations, names, social media profiles. The breach dates from Apr 1, 2020; Have I Been Pwned loaded it on Jun 25, 2021.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","social-media-profiles"],"title":"Teespring data breach: 8.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/teespring-data-breach","vendor":"Teespring"},{"auto":true,"category":"breach","closedAt":"2021-07-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UC"],"json":"https://helix.ml/threat-watch/i/uc-data-breach.json","latestUpdate":{"date":"2021-06-20","title":"Have I Been Pwned loaded 547K breached University of California accounts"},"patchStatus":"no-fix-needed","product":"universityofcalifornia.edu","severity":"medium","severityNote":"547K accounts","slug":"uc-data-breach","stacks":[],"startedAt":"2021-06-20","status":"closed","summary":"In December 2020, the University of California suffered a data breach due to vulnerability in in a third-party provider, Accellion. The breach exposed extensive personal data on both students and staff including 547 thousand unique email addresses, names, dates of birth, genders, social security numbers, ethnicities and other academic related data attributes. Further analysis is available in Exploring the Impact of the UC Data Breach. The data was provided to HIBP courtesy of Cyril Gorlla. Exposed data: dates of birth, education levels, email addresses, ethnicities, genders, job titles, names, phone numbers, physical addresses, social security numbers. The breach dates from Dec 24, 2020; Have I Been Pwned loaded it on Jun 20, 2021.","tags":["data-breach","hibp","dates-of-birth","education-levels","email-addresses","ethnicities","genders","job-titles","names","phone-numbers","physical-addresses","social-security-numbers"],"title":"University of California data breach: 547K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/uc-data-breach","vendor":"University of California"},{"auto":true,"category":"breach","closedAt":"2021-06-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FOTOLOG"],"json":"https://helix.ml/threat-watch/i/fotolog-data-breach.json","latestUpdate":{"date":"2021-06-15","title":"Have I Been Pwned loaded 16.7M breached Fotolog accounts"},"patchStatus":"no-fix-needed","product":"fotolog.com","severity":"high","severityNote":"16.7M accounts · passwords exposed","slug":"fotolog-data-breach","stacks":[],"startedAt":"2021-06-15","status":"closed","summary":"In December 2018, the photo sharing social network Fotolog suffered a data breach that exposed 16.7 million unique email addresses. The data also included usernames and unsalted SHA-256 password hashes. The site was dissolved the following year and repurposed as a news website based in Brcko, Bosnia and Herzegovina. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 1, 2018; Have I Been Pwned loaded it on Jun 15, 2021.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Fotolog data breach: 16.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/fotolog-data-breach","vendor":"Fotolog"},{"auto":true,"category":"breach","closedAt":"2021-06-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NAMELESSMALWARE"],"json":"https://helix.ml/threat-watch/i/namelessmalware-data-breach.json","latestUpdate":{"date":"2021-06-09","title":"Have I Been Pwned loaded 1.1M breached Nameless Malware accounts"},"patchStatus":"no-fix-needed","product":"Nameless Malware","severity":"high","severityNote":"1.1M accounts","slug":"namelessmalware-data-breach","stacks":[],"startedAt":"2021-06-09","status":"closed","summary":"In January 2021, NordLocker provided HIBP 1.1 million email addresses collected by nameless malware. The malware campaign ran between 2018 and 2020 and infected 3.25 million computers, stealing files, credentials and taking screenshots and photos using the computer's webcam. Read more in NordLocker's writeup about the Nameless malware that stole 1.2 TB of private data. Exposed data: email addresses. The breach dates from Jan 1, 2020; Have I Been Pwned loaded it on Jun 9, 2021.","tags":["data-breach","hibp","malware","email-addresses"],"title":"Nameless Malware data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/namelessmalware-data-breach","vendor":"Nameless Malware"},{"auto":true,"category":"breach","closedAt":"2021-06-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOMINOSINDIA"],"json":"https://helix.ml/threat-watch/i/dominosindia-data-breach.json","latestUpdate":{"date":"2021-06-03","title":"Have I Been Pwned loaded 22.5M breached Domino's India accounts"},"patchStatus":"no-fix-needed","product":"dominos.co.in","severity":"medium","severityNote":"22.5M accounts","slug":"dominosindia-data-breach","stacks":[],"startedAt":"2021-06-03","status":"closed","summary":"In April 2021, 13TB of compromised Domino's India appeared for sale on a hacking forum after which the company acknowledged a major data breach they dated back to March. The compromised data included 22.5 million unique email addresses, names, phone numbers, order histories and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses, purchases. The breach dates from Mar 24, 2021; Have I Been Pwned loaded it on Jun 3, 2021.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"Domino's India data breach: 22.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dominosindia-data-breach","vendor":"Domino's India"},{"auto":true,"category":"breach","closedAt":"2021-06-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JD"],"json":"https://helix.ml/threat-watch/i/jd-data-breach.json","latestUpdate":{"date":"2021-06-02","title":"Have I Been Pwned loaded 77.4M breached JD accounts"},"patchStatus":"no-fix-needed","product":"jd.com","severity":"high","severityNote":"77.4M accounts · passwords exposed","slug":"jd-data-breach","stacks":[],"startedAt":"2021-06-02","status":"closed","summary":"In 2013 (exact date unknown), the Chinese e-commerce service JD suffered a data breach that exposed 13GB of data containing 77 million unique email addresses. The data also included usernames, phone numbers and passwords stored as SHA-1 hashes. Exposed data: email addresses, passwords, phone numbers, usernames. The breach dates from Jan 1, 2013; Have I Been Pwned loaded it on Jun 2, 2021.","tags":["data-breach","hibp","email-addresses","passwords","phone-numbers","usernames"],"title":"JD data breach: 77.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/jd-data-breach","vendor":"JD"},{"auto":true,"category":"breach","closedAt":"2021-06-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MOBIFRIENDS"],"json":"https://helix.ml/threat-watch/i/mobifriends-data-breach.json","latestUpdate":{"date":"2021-05-23","title":"Have I Been Pwned loaded 3.5M breached MobiFriends accounts"},"patchStatus":"no-fix-needed","product":"mobifriends.com","severity":"high","severityNote":"3.5M accounts · passwords exposed","slug":"mobifriends-data-breach","stacks":[],"startedAt":"2021-05-23","status":"closed","summary":"In January 2020, the Barcelona-based dating app MobiFriends suffered a data breach that exposed 3.5 million unique email addresses. The data also included usernames, genders, dates of birth and MD5 password hashes. Exposed data: dates of birth, email addresses, genders, passwords, usernames. The breach dates from Jan 6, 2020; Have I Been Pwned loaded it on May 23, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","passwords","usernames"],"title":"MobiFriends data breach: 3.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mobifriends-data-breach","vendor":"MobiFriends"},{"auto":true,"category":"breach","closedAt":"2021-06-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIVPURE"],"json":"https://helix.ml/threat-watch/i/livpure-data-breach.json","latestUpdate":{"date":"2021-05-22","title":"Have I Been Pwned loaded 269K breached Livpure accounts"},"patchStatus":"no-fix-needed","product":"livpure.com","severity":"medium","severityNote":"269K accounts","slug":"livpure-data-breach","stacks":[],"startedAt":"2021-05-22","status":"closed","summary":"In August 2020, the Indian retailer Livpure suffered a data breach which exposed over 1 million customer purchases with 270 thousand unique email addresses. The data also included names, phone numbers, physical addresses and details of purchased items. Exposed data: email addresses, names, phone numbers, physical addresses, purchases, salutations. The breach dates from Aug 29, 2020; Have I Been Pwned loaded it on May 22, 2021.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","purchases","salutations"],"title":"Livpure data breach: 269K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/livpure-data-breach","vendor":"Livpure"},{"auto":true,"category":"breach","closedAt":"2021-06-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YAM"],"json":"https://helix.ml/threat-watch/i/yam-data-breach.json","latestUpdate":{"date":"2021-05-22","title":"Have I Been Pwned loaded 13.3M breached Yam accounts"},"patchStatus":"no-fix-needed","product":"yam.com","severity":"high","severityNote":"13.3M accounts · passwords exposed","slug":"yam-data-breach","stacks":[],"startedAt":"2021-05-22","status":"closed","summary":"In June 2013, the Taiwanese website Yam.com suffered a data breach which was shared to a popular hacking forum in 2021. The data included 13 million unique email addresses alongside names, usernames, phone numbers, physical addresses, dates of birth and unsalted MD5 password hashes. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Jun 2, 2013; Have I Been Pwned loaded it on May 22, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Yam data breach: 13.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/yam-data-breach","vendor":"Yam"},{"auto":true,"category":"breach","closedAt":"2021-06-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MONEYCONTROL"],"json":"https://helix.ml/threat-watch/i/moneycontrol-data-breach.json","latestUpdate":{"date":"2021-05-22","title":"Have I Been Pwned loaded 762K breached Moneycontrol accounts"},"patchStatus":"no-fix-needed","product":"moneycontrol.com","severity":"high","severityNote":"762K accounts · passwords exposed","slug":"moneycontrol-data-breach","stacks":[],"startedAt":"2021-05-22","status":"closed","summary":"In April 2021, hackers posted data for sale originating from the online Indian financial platform, Moneycontrol. The data included 763 thousand unique email addresses (allegedly a subset of a larger 40 million account breach), alongside geographic locations, phone numbers, genders, dates of birth and plain text passwords. The date of the original breach is unclear, although the breached data indicates the file was created in September 2017 and Moneycontrol has stated that the breach is \"an old data set\". Exposed data: email addresses, genders, geographic locations, passwords, phone numbers. The breach dates from Sep 7, 2017; Have I Been Pwned loaded it on May 22, 2021.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","passwords","phone-numbers"],"title":"Moneycontrol data breach: 762K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/moneycontrol-data-breach","vendor":"Moneycontrol"},{"auto":true,"category":"breach","closedAt":"2021-06-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IIMJOBS"],"json":"https://helix.ml/threat-watch/i/iimjobs-data-breach.json","latestUpdate":{"date":"2021-05-21","title":"Have I Been Pwned loaded 4.2M breached IIMJobs accounts"},"patchStatus":"no-fix-needed","product":"iimjobs.com","severity":"high","severityNote":"4.2M accounts · passwords exposed","slug":"iimjobs-data-breach","stacks":[],"startedAt":"2021-05-21","status":"closed","summary":"In December 2018, the Indian job portal IIMJobs suffered a data breach that exposed 4.1 million unique email addresses. The data also included names, phone numbers, geographic locations, dates of birth, job titles, job applications and cover letters plus passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, geographic locations, ip addresses, job applications, job titles, names, passwords, phone numbers. The breach dates from Dec 31, 2018; Have I Been Pwned loaded it on May 21, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","ip-addresses","job-applications","job-titles","names","passwords","phone-numbers"],"title":"IIMJobs data breach: 4.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/iimjobs-data-breach","vendor":"IIMJobs"},{"auto":true,"category":"breach","closedAt":"2021-06-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DAILYQUIZ"],"json":"https://helix.ml/threat-watch/i/dailyquiz-data-breach.json","latestUpdate":{"date":"2021-05-21","title":"Have I Been Pwned loaded 8.0M breached Daily Quiz accounts"},"patchStatus":"no-fix-needed","product":"dailyquiz.me","severity":"high","severityNote":"8.0M accounts · passwords exposed","slug":"dailyquiz-data-breach","stacks":[],"startedAt":"2021-05-21","status":"closed","summary":"In January 2021, the quiz website Daily Quiz suffered a data breach that exposed over 8 million unique email addresses. The data also included usernames, IP addresses and passwords stored in plain text. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 13, 2021; Have I Been Pwned loaded it on May 21, 2021.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Daily Quiz data breach: 8.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dailyquiz-data-breach","vendor":"Daily Quiz"},{"auto":true,"category":"breach","closedAt":"2021-05-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WEDMEGOOD"],"json":"https://helix.ml/threat-watch/i/wedmegood-data-breach.json","latestUpdate":{"date":"2021-05-13","title":"Have I Been Pwned loaded 1.3M breached WedMeGood accounts"},"patchStatus":"no-fix-needed","product":"wedmegood.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"wedmegood-data-breach","stacks":[],"startedAt":"2021-05-13","status":"closed","summary":"In January 2021, the Indian wedding planning platform WedMeGood suffered a data breach that exposed 1.3 million customers. The breach exposed 41.5GB of data including email and physical addresses, names, genders, phone numbers and password hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, genders, names, passwords, phone numbers, physical addresses. The breach dates from Jan 6, 2021; Have I Been Pwned loaded it on May 13, 2021.","tags":["data-breach","hibp","email-addresses","genders","names","passwords","phone-numbers","physical-addresses"],"title":"WedMeGood data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wedmegood-data-breach","vendor":"WedMeGood"},{"auto":true,"category":"breach","closedAt":"2021-05-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DRIVESURE"],"json":"https://helix.ml/threat-watch/i/drivesure-data-breach.json","latestUpdate":{"date":"2021-05-10","title":"Have I Been Pwned loaded 3.7M breached DriveSure accounts"},"patchStatus":"no-fix-needed","product":"drivesure.com","severity":"high","severityNote":"3.7M accounts · passwords exposed","slug":"drivesure-data-breach","stacks":[],"startedAt":"2021-05-10","status":"closed","summary":"In December 2020, the car dealership service provider DriveSure suffered a data breach. The incident resulted in 26GB of data being downloaded and later shared on a hacking forum. Impacted personal information included 3.6 million unique email addresses, names, phone numbers and physical addresses. Vehicle data was also exposed and included makes, models, VIN numbers and odometer readings. A small number of passwords stored as bcrypt hashes were also included in the data set. Exposed data: email addresses, names, passwords, phone numbers, physical addresses, vehicle details. The breach dates from Dec 19, 2020; Have I Been Pwned loaded it on May 10, 2021.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses","vehicle-details"],"title":"DriveSure data breach: 3.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/drivesure-data-breach","vendor":"DriveSure"},{"auto":true,"category":"breach","closedAt":"2021-05-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PARKMOBILE"],"json":"https://helix.ml/threat-watch/i/parkmobile-data-breach.json","latestUpdate":{"date":"2021-04-30","title":"Have I Been Pwned loaded 20.9M breached ParkMobile accounts"},"patchStatus":"no-fix-needed","product":"parkmobile.io","severity":"high","severityNote":"20.9M accounts · passwords exposed","slug":"parkmobile-data-breach","stacks":[],"startedAt":"2021-04-30","status":"closed","summary":"In March 2021, the mobile parking app service ParkMobile suffered a data breach which exposed 21 million customers' personal data. The impacted data included email addresses, names, phone numbers, vehicle licence plates and passwords stored as bcrypt hashes. The following month, the data appeared on a public hacking forum where it was extensively redistributed. Exposed data: email addresses, licence plates, names, passwords, phone numbers. The breach dates from Mar 21, 2021; Have I Been Pwned loaded it on Apr 30, 2021.","tags":["data-breach","hibp","email-addresses","licence-plates","names","passwords","phone-numbers"],"title":"ParkMobile data breach: 20.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/parkmobile-data-breach","vendor":"ParkMobile"},{"auto":true,"category":"breach","closedAt":"2021-05-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DESCOMPLICA"],"json":"https://helix.ml/threat-watch/i/descomplica-data-breach.json","latestUpdate":{"date":"2021-04-28","title":"Have I Been Pwned loaded 4.8M breached Descomplica accounts"},"patchStatus":"no-fix-needed","product":"descomplica.com.br","severity":"high","severityNote":"4.8M accounts · passwords exposed · financial data exposed","slug":"descomplica-data-breach","stacks":[],"startedAt":"2021-04-28","status":"closed","summary":"In March 2021, the Brazilian EdTech company Descomplica suffered a data breach which was subsequently posted to a popular hacking forum. The data included almost 5 million email addresses, names, the first 6 and last 4 digits and the expiry date of credit cards, purchase histories and password hashes. Exposed data: email addresses, names, partial credit card data, passwords, purchases. The breach dates from Mar 14, 2021; Have I Been Pwned loaded it on Apr 28, 2021.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","passwords","purchases"],"title":"Descomplica data breach: 4.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/descomplica-data-breach","vendor":"Descomplica"},{"auto":true,"category":"breach","closedAt":"2021-05-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JEFIT"],"json":"https://helix.ml/threat-watch/i/jefit-data-breach.json","latestUpdate":{"date":"2021-04-27","title":"Have I Been Pwned loaded 9.1M breached Jefit accounts"},"patchStatus":"no-fix-needed","product":"jefit.com","severity":"high","severityNote":"9.1M accounts · passwords exposed","slug":"jefit-data-breach","stacks":[],"startedAt":"2021-04-27","status":"closed","summary":"In August 2020, the workout tracking app Jefit suffered a data breach. The data was subsequently sold within the hacking community and included over 9 million email and IP addresses, usernames and passwords stored as either vBulletin or argon2 hashes. Several million cracked passwords later appeared in broad circulation. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Aug 11, 2020; Have I Been Pwned loaded it on Apr 27, 2021.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Jefit data breach: 9.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/jefit-data-breach","vendor":"Jefit"},{"auto":true,"category":"breach","closedAt":"2021-05-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BIGBASKET"],"json":"https://helix.ml/threat-watch/i/bigbasket-data-breach.json","latestUpdate":{"date":"2021-04-26","title":"Have I Been Pwned loaded 24.5M breached bigbasket accounts"},"patchStatus":"no-fix-needed","product":"bigbasket.com","severity":"high","severityNote":"24.5M accounts · passwords exposed","slug":"bigbasket-data-breach","stacks":[],"startedAt":"2021-04-26","status":"closed","summary":"In October 2020, the Indian grocery platform bigbasket suffered a data breach that exposed over 20 million customer records. The data was originally sold before being leaked publicly in April the following year and included email, IP and physical addresses, names, phones numbers, dates of birth passwords stored as Django(SHA-1) hashes. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Oct 14, 2020; Have I Been Pwned loaded it on Apr 26, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"bigbasket data breach: 24.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bigbasket-data-breach","vendor":"bigbasket"},{"auto":true,"category":"breach","closedAt":"2021-05-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EMOTET"],"json":"https://helix.ml/threat-watch/i/emotet-data-breach.json","latestUpdate":{"date":"2021-04-26","title":"Have I Been Pwned loaded 4.3M breached Emotet accounts"},"patchStatus":"no-fix-needed","product":"Emotet","severity":"high","severityNote":"4.3M accounts · passwords exposed","slug":"emotet-data-breach","stacks":[],"startedAt":"2021-04-26","status":"closed","summary":"In January 2021, the FBI in partnership with the Dutch NHTCU, German BKA and other international law enforcement agencies brought down the world's most dangerous malware: Emotet. The agencies obtained data collected by the malware and provided impacted email addresses to HIBP so that impacted individuals and domain owners could assess their exposure. Read more about the takedown and recommended actions. Exposed data: email addresses, passwords. The breach dates from Jan 27, 2021; Have I Been Pwned loaded it on Apr 26, 2021.","tags":["data-breach","hibp","malware","email-addresses","passwords"],"title":"Emotet data breach: 4.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/emotet-data-breach","vendor":"Emotet"},{"auto":true,"category":"breach","closedAt":"2021-05-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHOPBACK"],"json":"https://helix.ml/threat-watch/i/shopback-data-breach.json","latestUpdate":{"date":"2021-04-25","title":"Have I Been Pwned loaded 20.5M breached ShopBack accounts"},"patchStatus":"no-fix-needed","product":"shopback.com","severity":"high","severityNote":"20.5M accounts · passwords exposed","slug":"shopback-data-breach","stacks":[],"startedAt":"2021-04-25","status":"closed","summary":"In September 2020, the cashback reward program ShopBack suffered a data breach. The incident exposed over 20 million unique email addresses along with names, phone numbers, country of residence and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, geographic locations, names, passwords, phone numbers. The breach dates from Sep 17, 2020; Have I Been Pwned loaded it on Apr 25, 2021.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","phone-numbers"],"title":"ShopBack data breach: 20.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/shopback-data-breach","vendor":"ShopBack"},{"auto":true,"category":"breach","closedAt":"2021-05-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MANGADEX"],"json":"https://helix.ml/threat-watch/i/mangadex-data-breach.json","latestUpdate":{"date":"2021-04-25","title":"Have I Been Pwned loaded 3.0M breached MangaDex accounts"},"patchStatus":"no-fix-needed","product":"mangadex.org","severity":"high","severityNote":"3.0M accounts · passwords exposed","slug":"mangadex-data-breach","stacks":[],"startedAt":"2021-04-25","status":"closed","summary":"In March 2021, the manga fan site MangaDex suffered a data breach that resulted in the exposure of almost 3 million subscribers. The data included email and IP addresses, usernames and passwords stored as bcrypt hashes. The data was subsequently circulated within hacking groups. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Mar 22, 2021; Have I Been Pwned loaded it on Apr 25, 2021.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"MangaDex data breach: 3.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mangadex-data-breach","vendor":"MangaDex"},{"auto":true,"category":"breach","closedAt":"2021-05-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CLEARVOICESURVEYS"],"json":"https://helix.ml/threat-watch/i/clearvoicesurveys-data-breach.json","latestUpdate":{"date":"2021-04-23","title":"Have I Been Pwned loaded 15.1M breached ClearVoice Surveys accounts"},"patchStatus":"no-fix-needed","product":"clearvoicesurveys.com","severity":"high","severityNote":"15.1M accounts · passwords exposed","slug":"clearvoicesurveys-data-breach","stacks":[],"startedAt":"2021-04-23","status":"closed","summary":"In April 2021, the market research surveys company ClearVoice Surveys had a publicly facing database backup from 2015 taken and redistributed on a popular hacking forum. The data included 15M unique email addresses across more than 17M rows of data that also included names, physical and IP addresses, genders, dates of birth and plain text passwords. ClearVoice Surveys advised they were aware of the breach and confirmed its authenticity. Exposed data: dates of birth, email addresses, genders, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Aug 23, 2015; Have I Been Pwned loaded it on Apr 23, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"ClearVoice Surveys data breach: 15.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/clearvoicesurveys-data-breach","vendor":"ClearVoice Surveys"},{"auto":true,"category":"breach","closedAt":"2021-05-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PHONEHOUSE"],"json":"https://helix.ml/threat-watch/i/phonehouse-data-breach.json","latestUpdate":{"date":"2021-04-22","title":"Have I Been Pwned loaded 5.2M breached Phone House España accounts"},"patchStatus":"no-fix-needed","product":"phonehouse.es","severity":"medium","severityNote":"5.2M accounts","slug":"phonehouse-data-breach","stacks":[],"startedAt":"2021-04-22","status":"closed","summary":"In April 2021, the Spanish retailer Phone House allegedly suffered a ransomware attack that also exposed significant volumes of customer data. Attributed to the Babuk ransomware, a collection of data alleged to be a subset of a larger corpus was posted to a dark web site and contained 5.2M email addresses along with names, nationalities, genders, dates of birth, phone numbers and physical addresses. Phone House has been threatened with further releases if a ransom is not paid. Exposed data: dates of birth, email addresses, genders, names, nationalities, phone numbers, physical addresses. The breach dates from Apr 8, 2021; Have I Been Pwned loaded it on Apr 22, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","nationalities","phone-numbers","physical-addresses"],"title":"Phone House España data breach: 5.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/phonehouse-data-breach","vendor":"Phone House España"},{"auto":true,"category":"breach","closedAt":"2021-04-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FACEBOOK"],"json":"https://helix.ml/threat-watch/i/facebook-data-breach.json","latestUpdate":{"date":"2021-04-04","title":"Have I Been Pwned loaded 509.5M breached Facebook accounts"},"patchStatus":"no-fix-needed","product":"facebook.com","severity":"high","severityNote":"509.5M accounts","slug":"facebook-data-breach","stacks":[],"startedAt":"2021-04-04","status":"closed","summary":"In April 2021, a large data set of over 500 million Facebook users was made freely available for download. Encompassing approximately 20% of Facebook's subscribers, the data was allegedly obtained by exploiting a vulnerability Facebook advises they rectified in August 2019. The primary value of the data is the association of phone numbers to identities; whilst each record included phone, only 2.5 million contained an email address. Most records contained names and genders with many also including dates of birth, location, relationship status and employer. Exposed data: dates of birth, email addresses, employers, genders, geographic locations, names, phone numbers, relationship statuses. The breach dates from Aug 1, 2019; Have I Been Pwned loaded it on Apr 4, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","employers","genders","geographic-locations","names","phone-numbers","relationship-statuses"],"title":"Facebook data breach: 509.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/facebook-data-breach","vendor":"Facebook"},{"auto":true,"category":"breach","closedAt":"2021-04-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CARDINGMAFIA"],"json":"https://helix.ml/threat-watch/i/cardingmafia-data-breach.json","latestUpdate":{"date":"2021-03-23","title":"Have I Been Pwned loaded 297K breached Carding Mafia (March 2021) accounts"},"patchStatus":"no-fix-needed","product":"cardmafia.cc","severity":"high","severityNote":"297K accounts · passwords exposed","slug":"cardingmafia-data-breach","stacks":[],"startedAt":"2021-03-23","status":"closed","summary":"In March 2021, the Carding Mafia forum suffered a data breach that exposed almost 300k members' email addresses. Dedicated to the theft and trading of stolen credit cards, the forum breach also exposed usernames, IP addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Mar 18, 2021; Have I Been Pwned loaded it on Mar 23, 2021.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Carding Mafia (March 2021) data breach: 297K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cardingmafia-data-breach","vendor":"Carding Mafia (March 2021)"},{"auto":true,"category":"breach","closedAt":"2021-03-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WELEAKINFO"],"json":"https://helix.ml/threat-watch/i/weleakinfo-data-breach.json","latestUpdate":{"date":"2021-03-15","title":"Have I Been Pwned loaded 11K breached WeLeakInfo accounts"},"patchStatus":"no-fix-needed","product":"weleakinfo.com","severity":"high","severityNote":"11K accounts · financial data exposed","slug":"weleakinfo-data-breach","stacks":[],"startedAt":"2021-03-15","status":"closed","summary":"In March 2021, the Stripe account of the now-defunct WeLeakInfo service was taken over by \"pompompurin\" after acquiring an expired domain name with an email address used to manage the account. Access to Stripe then exposed almost 12k unique email addresses from customers who'd made credit card payments in order to obtain breached data hosted by WeLeakInfo. The data was subsequently leaked publicly and also included names, payment histories, IP addresses, billing addresses, partial credit card data and the organisation making the purchase. Exposed data: browser user agent details, email addresses, employers, ip addresses, names, partial credit card data, physical addresses, purchases. The breach dates from Mar 8, 2021; Have I Been Pwned loaded it on Mar 15, 2021.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","employers","ip-addresses","names","partial-credit-card-data","physical-addresses","purchases"],"title":"WeLeakInfo data breach: 11K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/weleakinfo-data-breach","vendor":"WeLeakInfo"},{"auto":true,"category":"breach","closedAt":"2021-03-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIKER"],"json":"https://helix.ml/threat-watch/i/liker-data-breach.json","latestUpdate":{"date":"2021-03-13","title":"Have I Been Pwned loaded 465K breached Liker accounts"},"patchStatus":"no-fix-needed","product":"liker.com","severity":"high","severityNote":"465K accounts · passwords exposed","slug":"liker-data-breach","stacks":[],"startedAt":"2021-03-13","status":"closed","summary":"In March 2021, the self-proclaimed \"kinder, smarter social network\" Liker suffered a data breach, allegedly in retaliation for the Gab data breach and scraping of data from Parler. The site remained offline after the breach which exposed 465k email addresses in addition to names, dates of birth, education levels, private messages, security questions and answers in plain text, passwords stored as bcrypt hashes and other personal data attributes. Liker did not respond when contacted about the breach. Exposed data: auth tokens, dates of birth, education levels, email addresses, geographic locations, ip addresses, names, passwords, phone numbers, private messages, security questions and answers, social media profiles, usernames. The breach dates from Mar 8, 2021; Have I Been Pwned loaded it on Mar 13, 2021.","tags":["data-breach","hibp","auth-tokens","dates-of-birth","education-levels","email-addresses","geographic-locations","ip-addresses","names","passwords","phone-numbers","private-messages","security-questions-and-answers","social-media-profiles"],"title":"Liker data breach: 465K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/liker-data-breach","vendor":"Liker"},{"auto":true,"category":"breach","closedAt":"2021-03-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRAVELOK"],"json":"https://helix.ml/threat-watch/i/travelok-data-breach.json","latestUpdate":{"date":"2021-03-10","title":"Have I Been Pwned loaded 637K breached Travel Oklahoma accounts"},"patchStatus":"no-fix-needed","product":"travelok.com","severity":"medium","severityNote":"637K accounts","slug":"travelok-data-breach","stacks":[],"startedAt":"2021-03-10","status":"closed","summary":"In December 2020, the Oklahoma state Tourism and Recreation Department suffered a data breach. The incident exposed 637k email addresses across a variety of tables including age ranges against brochure orders and dates of birth against contest entries. Genders, names and physical addresses were also exposed. Exposed data: age groups, dates of birth, email addresses, genders, names, physical addresses. The breach dates from Dec 17, 2020; Have I Been Pwned loaded it on Mar 10, 2021.","tags":["data-breach","hibp","age-groups","dates-of-birth","email-addresses","genders","names","physical-addresses"],"title":"Travel Oklahoma data breach: 637K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/travelok-data-breach","vendor":"Travel Oklahoma"},{"auto":true,"category":"breach","closedAt":"2021-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAB"],"json":"https://helix.ml/threat-watch/i/gab-data-breach.json","latestUpdate":{"date":"2021-03-03","title":"Have I Been Pwned loaded 66K breached Gab accounts"},"patchStatus":"no-fix-needed","product":"gab.com","severity":"high","severityNote":"66K accounts · passwords exposed","slug":"gab-data-breach","stacks":[],"startedAt":"2021-03-03","status":"closed","summary":"In February 2021, the alt-tech social network service Gab suffered a data breach. The incident exposed almost 70GB of data including 4M user accounts, a small number of private chat logs and a list of public groups and public posts made to the service. Only a small number of accounts included email addresses and / or passwords stored as bcrypt hashes with a total of 66.5k unique email addresses being exposed across the corpus of data. Exposed data: avatars, email addresses, names, passwords, private messages, usernames. The breach dates from Feb 26, 2021; Have I Been Pwned loaded it on Mar 3, 2021.","tags":["data-breach","hibp","avatars","email-addresses","names","passwords","private-messages","usernames"],"title":"Gab data breach: 66K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gab-data-breach","vendor":"Gab"},{"auto":true,"category":"breach","closedAt":"2021-03-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OXFAM"],"json":"https://helix.ml/threat-watch/i/oxfam-data-breach.json","latestUpdate":{"date":"2021-03-02","title":"Have I Been Pwned loaded 1.8M breached Oxfam accounts"},"patchStatus":"no-fix-needed","product":"oxfam.org.au","severity":"high","severityNote":"1.8M accounts · financial data exposed","slug":"oxfam-data-breach","stacks":[],"startedAt":"2021-03-02","status":"closed","summary":"In January 2021, Oxfam Australia was the victim of a data breach which exposed 1.8M unique email addresses of supporters of the charity. The data was put up for sale on a popular hacking forum and also included names, phone numbers, addresses, genders and dates of birth. A small number of people also had partial credit card data exposed (the first 6 and last 3 digits of the card, plus card type and expiry) and in some cases the bank name, account number and BSB were also exposed. The data was subsequently made freely available on the hacking forum later the following month. Exposed data: bank account numbers, dates of birth, email addresses, genders, names, partial credit card data, payment histories, phone numbers, physical addresses. The breach dates from Jan 20, 2021; Have I Been Pwned loaded it on Mar 2, 2021.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","email-addresses","genders","names","partial-credit-card-data","payment-histories","phone-numbers","physical-addresses"],"title":"Oxfam data breach: 1.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/oxfam-data-breach","vendor":"Oxfam"},{"auto":true,"category":"breach","closedAt":"2021-03-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TICKETCOUNTER"],"json":"https://helix.ml/threat-watch/i/ticketcounter-data-breach.json","latestUpdate":{"date":"2021-03-01","title":"Have I Been Pwned loaded 1.9M breached Ticketcounter accounts"},"patchStatus":"no-fix-needed","product":"ticketcounter.nl","severity":"high","severityNote":"1.9M accounts · financial data exposed","slug":"ticketcounter-data-breach","stacks":[],"startedAt":"2021-03-01","status":"closed","summary":"In August 2020, the Dutch ticketing service Ticketcounter inadvertently published a database backup to a publicly accessible location where it was then found and downloaded in February 2021. The data contained 1.9M unique email addresses which were offered for sale on a hacking forum and in some cases included names, physical and IP addresses, genders, dates of birth, payment histories and bank account numbers. Ticketcounter was later held to ransom with the threat of the breached being released publicly. Exposed data: bank account numbers, dates of birth, email addresses, genders, ip addresses, names, payment histories, phone numbers, physical addresses. The breach dates from Feb 22, 2021; Have I Been Pwned loaded it on Mar 1, 2021.","tags":["data-breach","hibp","bank-account-numbers","dates-of-birth","email-addresses","genders","ip-addresses","names","payment-histories","phone-numbers","physical-addresses"],"title":"Ticketcounter data breach: 1.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ticketcounter-data-breach","vendor":"Ticketcounter"},{"auto":true,"category":"breach","closedAt":"2021-03-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUPERVPNGECKOVPN"],"json":"https://helix.ml/threat-watch/i/supervpngeckovpn-data-breach.json","latestUpdate":{"date":"2021-02-28","title":"Have I Been Pwned loaded 20.3M breached SuperVPN \u0026 GeckoVPN accounts"},"patchStatus":"no-fix-needed","product":"SuperVPN \u0026 GeckoVPN","severity":"medium","severityNote":"20.3M accounts","slug":"supervpngeckovpn-data-breach","stacks":[],"startedAt":"2021-02-28","status":"closed","summary":"In February 2021, a series of \"free\" VPN services were breached including SuperVPN and GeckoVPN, exposing over 20M records. The data appeared together in a single file with a small number of records also included from FlashVPN, suggesting that all three brands may share the same platform. Impacted data also included email addresses, the country logged in from and the date and time each login occurred alongside device information including the make and model, IMSI number and serial number. Exposed data: device information, device serial numbers, email addresses, geographic locations, imsi numbers, login histories. The breach dates from Feb 25, 2021; Have I Been Pwned loaded it on Feb 28, 2021.","tags":["data-breach","hibp","device-information","device-serial-numbers","email-addresses","geographic-locations","imsi-numbers","login-histories"],"title":"SuperVPN \u0026 GeckoVPN data breach: 20.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/supervpngeckovpn-data-breach","vendor":"SuperVPN \u0026 GeckoVPN"},{"auto":true,"category":"breach","closedAt":"2021-03-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NETGALLEY"],"json":"https://helix.ml/threat-watch/i/netgalley-data-breach.json","latestUpdate":{"date":"2021-02-23","title":"Have I Been Pwned loaded 1.4M breached NetGalley accounts"},"patchStatus":"no-fix-needed","product":"netgalley.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"netgalley-data-breach","stacks":[],"startedAt":"2021-02-23","status":"closed","summary":"In December 2020, the book promotion site NetGalley suffered a data breach. The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1 hashes. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Dec 21, 2020; Have I Been Pwned loaded it on Feb 23, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"NetGalley data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/netgalley-data-breach","vendor":"NetGalley"},{"auto":true,"category":"breach","closedAt":"2021-03-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PEOPLESENERGY"],"json":"https://helix.ml/threat-watch/i/peoplesenergy-data-breach.json","latestUpdate":{"date":"2021-02-23","title":"Have I Been Pwned loaded 358K breached People's Energy accounts"},"patchStatus":"no-fix-needed","product":"peoplesenergy.co.uk","severity":"high","severityNote":"358K accounts · passwords exposed","slug":"peoplesenergy-data-breach","stacks":[],"startedAt":"2021-02-23","status":"closed","summary":"In December 2020, the UK power company People's Energy suffered a data breach. The breach exposed almost 7GB of files containing 359k unique email addresses along with names, phones numbers, physical addresses and dates of birth. The incident also included People's Energy staff email addresses and bcrypt password hashes (no customer passwords were exposed). Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Dec 16, 2020; Have I Been Pwned loaded it on Feb 23, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"People's Energy data breach: 358K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/peoplesenergy-data-breach","vendor":"People's Energy"},{"auto":true,"category":"breach","closedAt":"2021-03-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NURSERYCAM"],"json":"https://helix.ml/threat-watch/i/nurserycam-data-breach.json","latestUpdate":{"date":"2021-02-23","title":"Have I Been Pwned loaded 10K breached NurseryCam accounts"},"patchStatus":"no-fix-needed","product":"nurserycam.co.uk","severity":"medium","severityNote":"10K accounts","slug":"nurserycam-data-breach","stacks":[],"startedAt":"2021-02-23","status":"closed","summary":"In February 2021, a series of egregiously bad security flaws were identified in the NurseryCam system designed for parents to remotely monitor their children whilst attending nursery. The flaws led to the exposure of over 10k parent records before the service was shut down. The email addresses alone were provided to Have I Been Pwned to ensure parents were properly notified of the incident. Exposed data: email addresses. The breach dates from Feb 12, 2021; Have I Been Pwned loaded it on Feb 23, 2021.","tags":["data-breach","hibp","email-addresses"],"title":"NurseryCam data breach: 10K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nurserycam-data-breach","vendor":"NurseryCam"},{"auto":true,"category":"breach","closedAt":"2021-03-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FILMAIIN"],"json":"https://helix.ml/threat-watch/i/filmaiin-data-breach.json","latestUpdate":{"date":"2021-02-23","title":"Have I Been Pwned loaded 645K breached Filmai.in accounts"},"patchStatus":"no-fix-needed","product":"filmai.in","severity":"high","severityNote":"645K accounts · passwords exposed","slug":"filmaiin-data-breach","stacks":[],"startedAt":"2021-02-23","status":"closed","summary":"In approximately 2019 or 2020, the Lithuanian movie streaming service Filmai.in suffered a data breach exposing 645k email addresses, usernames and plain text passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 1, 2020; Have I Been Pwned loaded it on Feb 23, 2021.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Filmai.in data breach: 645K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/filmaiin-data-breach","vendor":"Filmai.in"},{"auto":true,"category":"breach","closedAt":"2021-03-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CITYBEE"],"json":"https://helix.ml/threat-watch/i/citybee-data-breach.json","latestUpdate":{"date":"2021-02-17","title":"Have I Been Pwned loaded 110K breached CityBee accounts"},"patchStatus":"no-fix-needed","product":"citybee.lt","severity":"high","severityNote":"110K accounts · passwords exposed","slug":"citybee-data-breach","stacks":[],"startedAt":"2021-02-17","status":"closed","summary":"In February 2021, the Lithuanian car-sharing service CityBee announced they'd suffered a data breach that exposed 110k customers' personal information. The breach exposed names, email addresses, government issued IDs and passwords stored as unsalted SHA-1 hashes. Exposed data: email addresses, government issued ids, names, passwords. The breach dates from Feb 5, 2021; Have I Been Pwned loaded it on Feb 17, 2021.","tags":["data-breach","hibp","email-addresses","government-issued-ids","names","passwords"],"title":"CityBee data breach: 110K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/citybee-data-breach","vendor":"CityBee"},{"auto":true,"category":"breach","closedAt":"2021-03-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GETT"],"json":"https://helix.ml/threat-watch/i/gett-data-breach.json","latestUpdate":{"date":"2021-02-16","title":"Have I Been Pwned loaded 2.5M breached Ge.tt accounts"},"patchStatus":"no-fix-needed","product":"ge.tt","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"gett-data-breach","stacks":[],"startedAt":"2021-02-16","status":"closed","summary":"In May 2017, the file sharing platform Ge.tt suffered a data breach. The data was subsequently put up for sale on a dark web marketplace in February 2019 alongside a raft of other breaches. The Ge.tt breach included names, social media profile identifiers, SHA256 password hashes and almost 2.5M unique email addresses. Exposed data: email addresses, names, passwords, social media profiles. The breach dates from May 4, 2017; Have I Been Pwned loaded it on Feb 16, 2021.","tags":["data-breach","hibp","email-addresses","names","passwords","social-media-profiles"],"title":"Ge.tt data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gett-data-breach","vendor":"Ge.tt"},{"auto":true,"category":"breach","closedAt":"2021-02-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STORYBIRD"],"json":"https://helix.ml/threat-watch/i/storybird-data-breach.json","latestUpdate":{"date":"2021-02-02","title":"Have I Been Pwned loaded 1.0M breached StoryBird accounts"},"patchStatus":"no-fix-needed","product":"storybird.com","severity":"high","severityNote":"1.0M accounts · passwords exposed","slug":"storybird-data-breach","stacks":[],"startedAt":"2021-02-02","status":"closed","summary":"In August 2015, the storytelling service StoryBird suffered a data breach exposing 4 million records with 1 million unique email addresses. Impacted data also included names, usernames and passwords stored as PBKDF2 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, names, passwords, usernames. The breach dates from Aug 7, 2015; Have I Been Pwned loaded it on Feb 2, 2021.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"StoryBird data breach: 1.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/storybird-data-breach","vendor":"StoryBird"},{"auto":true,"category":"breach","closedAt":"2021-02-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PIXLR"],"json":"https://helix.ml/threat-watch/i/pixlr-data-breach.json","latestUpdate":{"date":"2021-02-01","title":"Have I Been Pwned loaded 1.9M breached Pixlr accounts"},"patchStatus":"no-fix-needed","product":"pixlr.com","severity":"high","severityNote":"1.9M accounts · passwords exposed","slug":"pixlr-data-breach","stacks":[],"startedAt":"2021-02-01","status":"closed","summary":"In October 2020, the online photo editing application Pixlr suffered a data breach exposing 1.9 million subscribers. Impacted data included names, email addresses, social media profiles, the country signed up from and passwords stored as SHA-512 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, geographic locations, names, passwords, social media profiles. The breach dates from Oct 7, 2020; Have I Been Pwned loaded it on Feb 1, 2021.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","social-media-profiles"],"title":"Pixlr data breach: 1.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/pixlr-data-breach","vendor":"Pixlr"},{"auto":true,"category":"breach","closedAt":"2021-02-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BONOBOS"],"json":"https://helix.ml/threat-watch/i/bonobos-data-breach.json","latestUpdate":{"date":"2021-01-31","title":"Have I Been Pwned loaded 2.8M breached Bonobos accounts"},"patchStatus":"no-fix-needed","product":"bonobos.com","severity":"high","severityNote":"2.8M accounts · passwords exposed · financial data exposed","slug":"bonobos-data-breach","stacks":[],"startedAt":"2021-01-31","status":"closed","summary":"In August 2020, the clothing store Bonobos suffered a data breach that exposed almost 70GB of data containing 2.8 million unique email addresses. The breach also exposed names, physical and IP addresses, phone numbers, order histories and passwords stored as salted SHA-512 hashes, including historical passwords. The breach also exposed partial credit card data including card type, the name on the card, expiry date and the last 4 digits of the card. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, historical passwords, ip addresses, names, partial credit card data, passwords, phone numbers, physical addresses, purchases. The breach dates from Aug 14, 2020; Have I Been Pwned loaded it on Jan 31, 2021.","tags":["data-breach","hibp","email-addresses","historical-passwords","ip-addresses","names","partial-credit-card-data","passwords","phone-numbers","physical-addresses","purchases"],"title":"Bonobos data breach: 2.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bonobos-data-breach","vendor":"Bonobos"},{"auto":true,"category":"breach","closedAt":"2021-02-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MEETMINDFUL"],"json":"https://helix.ml/threat-watch/i/meetmindful-data-breach.json","latestUpdate":{"date":"2021-01-31","title":"Have I Been Pwned loaded 1.4M breached MeetMindful accounts"},"patchStatus":"no-fix-needed","product":"meetmindful.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"meetmindful-data-breach","stacks":[],"startedAt":"2021-01-31","status":"closed","summary":"In early 2020, the online dating service MeetMindful suffered a data breach that exposed 1.4 million unique customer email addresses. Included in the data was an extensive array of personal information used to find romantic matches including physical attributes, use of alcohol, drugs and cigarettes, marital statuses, birthdates, genders and the gender being sought. Additional personal information such as names, geographical locations and IP addresses were also exposed, along with passwords stored as bcrypt hashes. Exposed data: dates of birth, drinking habits, drug habits, email addresses, genders, geographic locations, ip addresses, marital statuses, names, passwords, physical attributes, religions, sexual orientations, smoking habits, social media profiles, usernames. The breach dates from Jan 26, 2020; Have I Been Pwned loaded it on Jan 31, 2021.","tags":["data-breach","hibp","dates-of-birth","drinking-habits","drug-habits","email-addresses","genders","geographic-locations","ip-addresses","marital-statuses","names","passwords","physical-attributes","religions"],"title":"MeetMindful data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/meetmindful-data-breach","vendor":"MeetMindful"},{"auto":true,"category":"breach","closedAt":"2021-02-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NITRO"],"json":"https://helix.ml/threat-watch/i/nitro-data-breach.json","latestUpdate":{"date":"2021-01-19","title":"Have I Been Pwned loaded 77.2M breached Nitro accounts"},"patchStatus":"no-fix-needed","product":"gonitro.com","severity":"high","severityNote":"77.2M accounts · passwords exposed","slug":"nitro-data-breach","stacks":[],"startedAt":"2021-01-19","status":"closed","summary":"In September 2020, the Nitro PDF service suffered a massive data breach which exposed over 70 million unique email addresses. The breach also exposed names, bcrypt password hashes and the titles of converted documents. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, names, passwords. The breach dates from Sep 28, 2020; Have I Been Pwned loaded it on Jan 19, 2021.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"Nitro data breach: 77.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nitro-data-breach","vendor":"Nitro"},{"auto":true,"category":"breach","closedAt":"2021-02-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROMWE"],"json":"https://helix.ml/threat-watch/i/romwe-data-breach.json","latestUpdate":{"date":"2021-01-18","title":"Have I Been Pwned loaded 19.5M breached Romwe accounts"},"patchStatus":"no-fix-needed","product":"romwe.com","severity":"high","severityNote":"19.5M accounts · passwords exposed","slug":"romwe-data-breach","stacks":[],"startedAt":"2021-01-18","status":"closed","summary":"In mid-2018, the Hong Kong-based retailer Romwe suffered a data breach which exposed almost 20 million customers. The data was subsequently sold online and includes names, phone numbers, email and IP addresses, customer geographic locations and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com. Exposed data: geographic locations, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jun 1, 2018; Have I Been Pwned loaded it on Jan 18, 2021.","tags":["data-breach","hibp","geographic-locations","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Romwe data breach: 19.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/romwe-data-breach","vendor":"Romwe"},{"auto":true,"category":"breach","closedAt":"2021-01-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JOBANDTALENT"],"json":"https://helix.ml/threat-watch/i/jobandtalent-data-breach.json","latestUpdate":{"date":"2021-01-17","title":"Have I Been Pwned loaded 11.0M breached Jobandtalent accounts"},"patchStatus":"no-fix-needed","product":"jobandtalent.com","severity":"high","severityNote":"11.0M accounts · passwords exposed","slug":"jobandtalent-data-breach","stacks":[],"startedAt":"2021-01-17","status":"closed","summary":"In approximately February 2018, the employment website Jobandtalent suffered a data breach which then appeared for sale alongside other breaches a year later. The incident impacted 11 million subscribers and exposed their names, email and IP addresses and passwords stored as salted SHA-1 hashes. Exposed data: email addresses, ip addresses, names, passwords. The breach dates from Feb 1, 2018; Have I Been Pwned loaded it on Jan 17, 2021.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords"],"title":"Jobandtalent data breach: 11.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/jobandtalent-data-breach","vendor":"Jobandtalent"},{"auto":true,"category":"breach","closedAt":"2021-01-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GLOFOX"],"json":"https://helix.ml/threat-watch/i/glofox-data-breach.json","latestUpdate":{"date":"2021-01-10","title":"Have I Been Pwned loaded 2.3M breached Glofox accounts"},"patchStatus":"no-fix-needed","product":"glofox.com","severity":"high","severityNote":"2.3M accounts · passwords exposed","slug":"glofox-data-breach","stacks":[],"startedAt":"2021-01-10","status":"closed","summary":"In March 2020, the Irish gym management software company Glofox suffered a data breach which exposed 2.3M membership records. The data included email addresses, names, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers. The breach dates from Mar 27, 2020; Have I Been Pwned loaded it on Jan 10, 2021.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers"],"title":"Glofox data breach: 2.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/glofox-data-breach","vendor":"Glofox"},{"auto":true,"category":"breach","closedAt":"2021-01-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GENIUSU"],"json":"https://helix.ml/threat-watch/i/geniusu-data-breach.json","latestUpdate":{"date":"2021-01-08","title":"Have I Been Pwned loaded 1.3M breached GeniusU accounts"},"patchStatus":"no-fix-needed","product":"geniusu.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"geniusu-data-breach","stacks":[],"startedAt":"2021-01-08","status":"closed","summary":"In November 2020, a collection of data breaches were made public including the \"Entrepreneur Success Platform\", GeniusU. Dating back to the previous month, the data included 1.3M names, email and IP addresses, genders, links to social media profiles and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, genders, ip addresses, names, passwords, social media profiles. The breach dates from Oct 2, 2020; Have I Been Pwned loaded it on Jan 8, 2021.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","names","passwords","social-media-profiles"],"title":"GeniusU data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/geniusu-data-breach","vendor":"GeniusU"},{"auto":true,"category":"breach","closedAt":"2021-01-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEDGER"],"json":"https://helix.ml/threat-watch/i/ledger-data-breach.json","latestUpdate":{"date":"2020-12-20","title":"Have I Been Pwned loaded 1.1M breached Ledger accounts"},"patchStatus":"no-fix-needed","product":"ledger.com","severity":"medium","severityNote":"1.1M accounts","slug":"ledger-data-breach","stacks":[],"startedAt":"2020-12-20","status":"closed","summary":"In June 2020, the hardware crypto wallet manufacturer Ledger suffered a data breach that exposed over 1 million email addresses. The data was initially sold before being dumped publicly in December 2020 and included names, physical addresses and phone numbers. The data was provided to HIBP by Alon Gal, CTO of cybercrime intelligence firm Hudson Rock. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Jun 25, 2020; Have I Been Pwned loaded it on Dec 20, 2020.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Ledger data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ledger-data-breach","vendor":"Ledger"},{"auto":true,"category":"breach","closedAt":"2020-12-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PEATIX"],"json":"https://helix.ml/threat-watch/i/peatix-data-breach.json","latestUpdate":{"date":"2020-12-06","title":"Have I Been Pwned loaded 4.2M breached Peatix accounts"},"patchStatus":"no-fix-needed","product":"peatix.com","severity":"high","severityNote":"4.2M accounts · passwords exposed","slug":"peatix-data-breach","stacks":[],"startedAt":"2020-12-06","status":"closed","summary":"In January 2019, the event organising platform Peatix suffered a data breach. The incident exposed 4.2M email addresses, names and salted password hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, names, passwords. The breach dates from Jan 20, 2019; Have I Been Pwned loaded it on Dec 6, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"Peatix data breach: 4.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/peatix-data-breach","vendor":"Peatix"},{"auto":true,"category":"breach","closedAt":"2020-12-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PLUTOTV"],"json":"https://helix.ml/threat-watch/i/plutotv-data-breach.json","latestUpdate":{"date":"2020-12-05","title":"Have I Been Pwned loaded 3.2M breached Pluto TV accounts"},"patchStatus":"no-fix-needed","product":"pluto.tv","severity":"high","severityNote":"3.2M accounts · passwords exposed","slug":"plutotv-data-breach","stacks":[],"startedAt":"2020-12-05","status":"closed","summary":"In October 2018, the internet television service Pluto TV suffered a data breach which was then shared extensively in hacking communities. Pluto TV \"decided not to proactively inform users of the breach\" which contained 3.2M unique email and IP addresses, names, usernames, genders, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, device information, email addresses, genders, ip addresses, names, passwords, social media profiles, usernames. The breach dates from Oct 12, 2018; Have I Been Pwned loaded it on Dec 5, 2020.","tags":["data-breach","hibp","dates-of-birth","device-information","email-addresses","genders","ip-addresses","names","passwords","social-media-profiles","usernames"],"title":"Pluto TV data breach: 3.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/plutotv-data-breach","vendor":"Pluto TV"},{"auto":true,"category":"breach","closedAt":"2020-11-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:123RF"],"json":"https://helix.ml/threat-watch/i/123rf-data-breach.json","latestUpdate":{"date":"2020-11-15","title":"Have I Been Pwned loaded 8.7M breached 123RF accounts"},"patchStatus":"no-fix-needed","product":"123rf.com","severity":"high","severityNote":"8.7M accounts · passwords exposed","slug":"123rf-data-breach","stacks":[],"startedAt":"2020-11-15","status":"closed","summary":"In March 2020, the stock photo site 123RF suffered a data breach which impacted over 8 million subscribers and was subsequently sold online. The breach included email, IP and physical addresses, names, phone numbers and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Mar 22, 2020; Have I Been Pwned loaded it on Nov 15, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"123RF data breach: 8.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/123rf-data-breach","vendor":"123RF"},{"auto":true,"category":"breach","closedAt":"2020-11-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOMECHEF"],"json":"https://helix.ml/threat-watch/i/homechef-data-breach.json","latestUpdate":{"date":"2020-11-13","title":"Have I Been Pwned loaded 8.8M breached Home Chef accounts"},"patchStatus":"no-fix-needed","product":"homechef.com","severity":"high","severityNote":"8.8M accounts · passwords exposed · financial data exposed","slug":"homechef-data-breach","stacks":[],"startedAt":"2020-11-13","status":"closed","summary":"In early 2020, the food delivery service Home Chef suffered a data breach which was subsequently sold online. The breach exposed the personal information of almost 9 million customers including names, IP addresses, post codes, the last 4 digits of credit card numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, geographic locations, ip addresses, names, partial credit card data, passwords, phone numbers. The breach dates from Feb 10, 2020; Have I Been Pwned loaded it on Nov 13, 2020.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","names","partial-credit-card-data","passwords","phone-numbers"],"title":"Home Chef data breach: 8.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/homechef-data-breach","vendor":"Home Chef"},{"auto":true,"category":"breach","closedAt":"2020-11-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANIMALJAM"],"json":"https://helix.ml/threat-watch/i/animaljam-data-breach.json","latestUpdate":{"date":"2020-11-12","title":"Have I Been Pwned loaded 7.1M breached Animal Jam accounts"},"patchStatus":"no-fix-needed","product":"animaljam.com","severity":"high","severityNote":"7.1M accounts · passwords exposed","slug":"animaljam-data-breach","stacks":[],"startedAt":"2020-11-12","status":"closed","summary":"In October 2020, the online game for kids Animal Jam suffered a data breach which was subsequently shared through online hacking communities the following month. The data contained 46 million user accounts with over 7 million unique email addresses. Impacted data also included usernames, IP addresses and for some records, dates of birth (sometimes in partial form), physical addresses, parent names and passwords stored as PBKDF2 hashes. Exposed data: dates of birth, email addresses, genders, ip addresses, names, passwords, physical addresses, usernames. The breach dates from Oct 12, 2020; Have I Been Pwned loaded it on Nov 12, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","names","passwords","physical-addresses","usernames"],"title":"Animal Jam data breach: 7.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/animaljam-data-breach","vendor":"Animal Jam"},{"auto":true,"category":"breach","closedAt":"2020-11-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LAZADA"],"json":"https://helix.ml/threat-watch/i/lazada-data-breach.json","latestUpdate":{"date":"2020-11-10","title":"Have I Been Pwned loaded 1.1M breached Lazada RedMart accounts"},"patchStatus":"no-fix-needed","product":"redmart.lazada.sg","severity":"high","severityNote":"1.1M accounts · passwords exposed · financial data exposed","slug":"lazada-data-breach","stacks":[],"startedAt":"2020-11-10","status":"closed","summary":"In October 2020, news broke of Lazada RedMart data breach containing records as recent as July 2020 and being sold via an online marketplace. In all, the data contained 1.1 million customer email addresses alongside names, phone numbers, physical addresses, partial credit card numbers and passwords stored as SHA-1 hashes. Exposed data: email addresses, names, partial credit card data, passwords, phone numbers, physical addresses. The breach dates from Jul 30, 2020; Have I Been Pwned loaded it on Nov 10, 2020.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","passwords","phone-numbers","physical-addresses"],"title":"Lazada RedMart data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lazada-data-breach","vendor":"Lazada RedMart"},{"auto":true,"category":"breach","closedAt":"2020-11-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MASHABLE"],"json":"https://helix.ml/threat-watch/i/mashable-data-breach.json","latestUpdate":{"date":"2020-11-10","title":"Have I Been Pwned loaded 1.4M breached Mashable accounts"},"patchStatus":"no-fix-needed","product":"mashable.com","severity":"medium","severityNote":"1.4M accounts","slug":"mashable-data-breach","stacks":[],"startedAt":"2020-11-10","status":"closed","summary":"In approximately mid-2020, Mashable suffered a data breach that subsequently turned up publicly in November 2020. The data included 1.4 million unique email addresses along with names, genders, expired auth tokens, physical locations, links to social media profiles and days and months of birth. The data was provided to HIBP by dehashed.com. Exposed data: auth tokens, email addresses, genders, geographic locations, ip addresses, names, partial dates of birth, social media profiles. The breach dates from Jun 1, 2020; Have I Been Pwned loaded it on Nov 10, 2020.","tags":["data-breach","hibp","auth-tokens","email-addresses","genders","geographic-locations","ip-addresses","names","partial-dates-of-birth","social-media-profiles"],"title":"Mashable data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mashable-data-breach","vendor":"Mashable"},{"auto":true,"category":"breach","closedAt":"2020-11-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JAMES"],"json":"https://helix.ml/threat-watch/i/james-data-breach.json","latestUpdate":{"date":"2020-11-05","title":"Have I Been Pwned loaded 1.5M breached James accounts"},"patchStatus":"no-fix-needed","product":"jamesdelivery.com.br","severity":"high","severityNote":"1.5M accounts · passwords exposed","slug":"james-data-breach","stacks":[],"startedAt":"2020-11-05","status":"closed","summary":"In June 2020, 14 previously undisclosed data breaches appeared for sale including the Brazilian delivery service, \"James\". The breach occurred in March 2020 and exposed 1.5M unique email addresses, customer locations expressed in longitude and latitude and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, geographic locations, latitude and longitude pairs, passwords. The breach dates from Mar 25, 2020; Have I Been Pwned loaded it on Nov 5, 2020.","tags":["data-breach","hibp","email-addresses","geographic-locations","latitude-and-longitude-pairs","passwords"],"title":"James data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/james-data-breach","vendor":"James"},{"auto":true,"category":"breach","closedAt":"2020-11-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WONGNAI"],"json":"https://helix.ml/threat-watch/i/wongnai-data-breach.json","latestUpdate":{"date":"2020-11-04","title":"Have I Been Pwned loaded 3.9M breached Wongnai accounts"},"patchStatus":"no-fix-needed","product":"wongnai.com","severity":"high","severityNote":"3.9M accounts · passwords exposed","slug":"wongnai-data-breach","stacks":[],"startedAt":"2020-11-04","status":"closed","summary":"In October 2020, 17 previously undisclosed data breaches appeared for sale including the Thai restaurant, hotel and attraction finding service, Wongnai. The breach exposed almost 4M unique customer records from some time during 2020 along with names, phone numbers, links to social media profiles and passwords stored as MD5 hashes. The data was self-submitted to HIBP by Wongnai. Exposed data: dates of birth, email addresses, geographic locations, ip addresses, names, passwords, phone numbers, social media profiles. The breach dates from Oct 28, 2020; Have I Been Pwned loaded it on Nov 4, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","ip-addresses","names","passwords","phone-numbers","social-media-profiles"],"title":"Wongnai data breach: 3.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wongnai-data-breach","vendor":"Wongnai"},{"auto":true,"category":"breach","closedAt":"2020-11-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MINTED"],"json":"https://helix.ml/threat-watch/i/minted-data-breach.json","latestUpdate":{"date":"2020-11-03","title":"Have I Been Pwned loaded 4.4M breached Minted accounts"},"patchStatus":"no-fix-needed","product":"minted.com","severity":"high","severityNote":"4.4M accounts · passwords exposed","slug":"minted-data-breach","stacks":[],"startedAt":"2020-11-03","status":"closed","summary":"In May 2020, the online marketplace for independent artists Minted suffered a data breach that exposed 4.4M unique customer records subsequently sold on a dark web marketplace. Exposed data also included names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from May 6, 2020; Have I Been Pwned loaded it on Nov 3, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Minted data breach: 4.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/minted-data-breach","vendor":"Minted"},{"auto":true,"category":"breach","closedAt":"2020-11-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROMOFARMA"],"json":"https://helix.ml/threat-watch/i/promofarma-data-breach.json","latestUpdate":{"date":"2020-11-01","title":"Have I Been Pwned loaded 1.3M breached Promofarma accounts"},"patchStatus":"no-fix-needed","product":"promofarma.com","severity":"medium","severityNote":"1.3M accounts","slug":"promofarma-data-breach","stacks":[],"startedAt":"2020-11-01","status":"closed","summary":"In August 2019, a data breach from the Spanish online pharmacy Promofarma appeared for sale on a dark web marketplace. The breach exposed over 2.7M records and contained almost 1.3M unique customer email addresses. The data also included customer names and was provided to HIBP by dehashed.com. Exposed data: email addresses, names. The breach dates from Aug 3, 2019; Have I Been Pwned loaded it on Nov 1, 2020.","tags":["data-breach","hibp","email-addresses","names"],"title":"Promofarma data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/promofarma-data-breach","vendor":"Promofarma"},{"auto":true,"category":"breach","closedAt":"2020-11-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STARTRIBUNE"],"json":"https://helix.ml/threat-watch/i/startribune-data-breach.json","latestUpdate":{"date":"2020-10-30","title":"Have I Been Pwned loaded 2.2M breached StarTribune accounts"},"patchStatus":"no-fix-needed","product":"startribune.com","severity":"high","severityNote":"2.2M accounts · passwords exposed","slug":"startribune-data-breach","stacks":[],"startedAt":"2020-10-30","status":"closed","summary":"In October 2019, the Minnesota-based news service StarTribune suffered a data breach which was subsequently sold on the dark web. The breach exposed over 2 million unique email addresses alongside names, usernames, physical addresses, dates of birth, genders and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, genders, names, passwords, physical addresses, usernames. The breach dates from Oct 10, 2019; Have I Been Pwned loaded it on Oct 30, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","physical-addresses","usernames"],"title":"StarTribune data breach: 2.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/startribune-data-breach","vendor":"StarTribune"},{"auto":true,"category":"breach","closedAt":"2020-11-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REINCUBATE"],"json":"https://helix.ml/threat-watch/i/reincubate-data-breach.json","latestUpdate":{"date":"2020-10-29","title":"Have I Been Pwned loaded 616K breached Reincubate accounts"},"patchStatus":"no-fix-needed","product":"reincubate.com","severity":"high","severityNote":"616K accounts · passwords exposed","slug":"reincubate-data-breach","stacks":[],"startedAt":"2020-10-29","status":"closed","summary":"In October 2020, the app data company Reincubate suffered a data breach which exposed a backup from November 2017 (the newest record in the data appeared several months earlier). The data included over 616k unique email addresses, names and passwords stored as PBKDF2 hashes. Exposed data: email addresses, names, passwords. The breach dates from May 11, 2017; Have I Been Pwned loaded it on Oct 29, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"Reincubate data breach: 616K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/reincubate-data-breach","vendor":"Reincubate"},{"auto":true,"category":"breach","closedAt":"2020-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHOWBUS"],"json":"https://helix.ml/threat-watch/i/chowbus-data-breach.json","latestUpdate":{"date":"2020-10-06","title":"Have I Been Pwned loaded 444K breached Chowbus accounts"},"patchStatus":"no-fix-needed","product":"chowbus.com","severity":"medium","severityNote":"444K accounts","slug":"chowbus-data-breach","stacks":[],"startedAt":"2020-10-06","status":"closed","summary":"In October 2020, the Asian food delivery app Chowbus suffered a data breach which led to over 800,000 records being emailed to customers. The email contained a link to a CSV file with customer data including physical addresses, names, phone numbers and over 444,000 unique email addresses. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Oct 5, 2020; Have I Been Pwned loaded it on Oct 6, 2020.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Chowbus data breach: 444K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/chowbus-data-breach","vendor":"Chowbus"},{"auto":true,"category":"breach","closedAt":"2020-10-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WIZISHOP"],"json":"https://helix.ml/threat-watch/i/wizishop-data-breach.json","latestUpdate":{"date":"2020-10-05","title":"Have I Been Pwned loaded 2.9M breached WiziShop accounts"},"patchStatus":"no-fix-needed","product":"wizishop.fr","severity":"high","severityNote":"2.9M accounts · passwords exposed","slug":"wizishop-data-breach","stacks":[],"startedAt":"2020-10-05","status":"closed","summary":"In July 2020, the French e-commerce platform WiziShop suffered a data breach. The breach exposed 18GB worth of data including names, phone numbers, dates of birth, physical and IP addresses, SHA-1 password hashes and almost 3 million unique email addresses. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jul 14, 2020; Have I Been Pwned loaded it on Oct 5, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"WiziShop data breach: 2.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wizishop-data-breach","vendor":"WiziShop"},{"auto":true,"category":"breach","closedAt":"2020-09-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EXPERIAN2020"],"json":"https://helix.ml/threat-watch/i/experian2020-data-breach.json","latestUpdate":{"date":"2020-09-01","title":"Have I Been Pwned loaded 1.3M breached Experian (South Africa) accounts"},"patchStatus":"no-fix-needed","product":"Experian (South Africa)","severity":"medium","severityNote":"1.3M accounts","slug":"experian2020-data-breach","stacks":[],"startedAt":"2020-09-01","status":"closed","summary":"In August 2020, Experian South Africa suffered a data breach which exposed the personal information of tens of millions of individuals. Only 1.3M of the records contained email addresses, whilst most contained government issued identity numbers, names, addresses, occupations and employers, amongst other person information. Exposed data: email addresses, employers, government issued ids, names, occupations, phone numbers. The breach dates from Aug 19, 2020; Have I Been Pwned loaded it on Sep 1, 2020.","tags":["data-breach","hibp","email-addresses","employers","government-issued-ids","names","occupations","phone-numbers"],"title":"Experian (South Africa) data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/experian2020-data-breach","vendor":"Experian (South Africa)"},{"auto":true,"category":"breach","closedAt":"2020-09-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIVEAUCTIONEERS"],"json":"https://helix.ml/threat-watch/i/liveauctioneers-data-breach.json","latestUpdate":{"date":"2020-08-22","title":"Have I Been Pwned loaded 3.4M breached LiveAuctioneers accounts"},"patchStatus":"no-fix-needed","product":"liveauctioneers.com","severity":"high","severityNote":"3.4M accounts · passwords exposed","slug":"liveauctioneers-data-breach","stacks":[],"startedAt":"2020-08-22","status":"closed","summary":"In June 2020, the online antiques marketplace LiveAuctioneers suffered a data breach which was subsequently sold online then extensively redistributed in the hacking community. The data contained 3.4 million records including names, email and IP addresses, physical addresses, phones numbers and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Jun 19, 2020; Have I Been Pwned loaded it on Aug 22, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"LiveAuctioneers data breach: 3.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/liveauctioneers-data-breach","vendor":"LiveAuctioneers"},{"auto":true,"category":"breach","closedAt":"2020-09-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UTAHGUNEXCHANGE"],"json":"https://helix.ml/threat-watch/i/utahgunexchange-data-breach.json","latestUpdate":{"date":"2020-08-19","title":"Have I Been Pwned loaded 235K breached Utah Gun Exchange accounts"},"patchStatus":"no-fix-needed","product":"utahgunexchange.com","severity":"high","severityNote":"235K accounts · passwords exposed","slug":"utahgunexchange-data-breach","stacks":[],"startedAt":"2020-08-19","status":"closed","summary":"In July 2020, the Utah Gun Exchange website suffered a data breach which included several other associated websites. In total, 235k unique email addresses were exposed before being traded online alongside names, usernames, genders, IP addresses and password hashes. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, genders, ip addresses, passwords, usernames. The breach dates from Jul 17, 2020; Have I Been Pwned loaded it on Aug 19, 2020.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","passwords","usernames"],"title":"Utah Gun Exchange data breach: 235K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/utahgunexchange-data-breach","vendor":"Utah Gun Exchange"},{"auto":true,"category":"breach","closedAt":"2020-09-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNICOCAMPANIA"],"json":"https://helix.ml/threat-watch/i/unicocampania-data-breach.json","latestUpdate":{"date":"2020-08-19","title":"Have I Been Pwned loaded 166K breached Unico Campania accounts"},"patchStatus":"no-fix-needed","product":"unicocampania.it","severity":"high","severityNote":"166K accounts · passwords exposed","slug":"unicocampania-data-breach","stacks":[],"startedAt":"2020-08-19","status":"closed","summary":"In August 2020, the Neapolitan public transport website Unico Campania was hacked and the data extensively circulated. The breach contained 166k user records with email addresses and plain text passwords. Exposed data: email addresses, passwords. The breach dates from Aug 19, 2020; Have I Been Pwned loaded it on Aug 19, 2020.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Unico Campania data breach: 166K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/unicocampania-data-breach","vendor":"Unico Campania"},{"auto":true,"category":"breach","closedAt":"2020-09-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SONICBIDS"],"json":"https://helix.ml/threat-watch/i/sonicbids-data-breach.json","latestUpdate":{"date":"2020-08-18","title":"Have I Been Pwned loaded 751K breached Sonicbids accounts"},"patchStatus":"no-fix-needed","product":"sonicbids.com","severity":"high","severityNote":"751K accounts · passwords exposed","slug":"sonicbids-data-breach","stacks":[],"startedAt":"2020-08-18","status":"closed","summary":"In December 2019, the booking website Sonicbids suffered a data breach which they attributed to \"a data privacy event involving our third-party cloud hosting services\". The breach contained 752k user records including names and usernames, email addresses and passwords stored as PBKDF2 hashes. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, names, passwords, usernames. The breach dates from Dec 30, 2019; Have I Been Pwned loaded it on Aug 18, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"Sonicbids data breach: 751K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sonicbids-data-breach","vendor":"Sonicbids"},{"auto":true,"category":"breach","closedAt":"2020-09-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CATHO"],"json":"https://helix.ml/threat-watch/i/catho-data-breach.json","latestUpdate":{"date":"2020-08-18","title":"Have I Been Pwned loaded 1.2M breached Catho accounts"},"patchStatus":"no-fix-needed","product":"catho.com.br","severity":"high","severityNote":"1.2M accounts · passwords exposed","slug":"catho-data-breach","stacks":[],"startedAt":"2020-08-18","status":"closed","summary":"In approximately March 2020, the Brazilian recruitment website Catho was compromised and subsequently appeared alongside 20 other breached websites listed for sale on a dark web marketplace. The breach included almost 11 million records with 1.2 million unique email addresses. Names, usernames and plain text passwords were also exposed. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, names, passwords, usernames. The breach dates from Mar 1, 2020; Have I Been Pwned loaded it on Aug 18, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"Catho data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/catho-data-breach","vendor":"Catho"},{"auto":true,"category":"breach","closedAt":"2020-08-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZOOSK2020"],"json":"https://helix.ml/threat-watch/i/zoosk2020-data-breach.json","latestUpdate":{"date":"2020-08-07","title":"Have I Been Pwned loaded 23.9M breached Zoosk (2020) accounts"},"patchStatus":"no-fix-needed","product":"zoosk.com","severity":"high","severityNote":"23.9M accounts","slug":"zoosk2020-data-breach","stacks":[],"startedAt":"2020-08-07","status":"closed","summary":"In January 2020, the online dating service Zoosk suffered a data breach which was subsequently shared extensively across online hacking communities. The breach contained 24 million unique email addresses alongside extensive personal information including genders, sexualities, dates of birth, physical attributes such as height and weight, religions, ethnicities and political views. The breach also allegedly exposed MD5 password hashes, although the data circulating in hacking circles had this field nulled out. The breach was provided to HIBP by breachbase.pw. Exposed data: dates of birth, drinking habits, education levels, email addresses, ethnicities, family structure, genders, geographic locations, income levels, names, nicknames, physical attributes, political views, relationship statuses, religions, sexual orientations, smoking habits. The breach dates from Jan 12, 2020; Have I Been Pwned loaded it on Aug 7, 2020.","tags":["data-breach","hibp","dates-of-birth","drinking-habits","education-levels","email-addresses","ethnicities","family-structure","genders","geographic-locations","income-levels","names","nicknames","physical-attributes"],"title":"Zoosk (2020) data breach: 23.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/zoosk2020-data-breach","vendor":"Zoosk (2020)"},{"auto":true,"category":"breach","closedAt":"2020-08-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROCTORU"],"json":"https://helix.ml/threat-watch/i/proctoru-data-breach.json","latestUpdate":{"date":"2020-08-06","title":"Have I Been Pwned loaded 444K breached ProctorU accounts"},"patchStatus":"no-fix-needed","product":"proctoru.com","severity":"high","severityNote":"444K accounts · passwords exposed","slug":"proctoru-data-breach","stacks":[],"startedAt":"2020-08-06","status":"closed","summary":"In June 2020, the online exam service ProctorU suffered a data breach which was subsequently shared extensively across online hacking communities. The breach contained 444k user records including names, email and physical addresses, phones numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Jun 26, 2020; Have I Been Pwned loaded it on Aug 6, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"ProctorU data breach: 444K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/proctoru-data-breach","vendor":"ProctorU"},{"auto":true,"category":"breach","closedAt":"2020-08-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KREDITPLUS"],"json":"https://helix.ml/threat-watch/i/kreditplus-data-breach.json","latestUpdate":{"date":"2020-08-03","title":"Have I Been Pwned loaded 768K breached Kreditplus accounts"},"patchStatus":"no-fix-needed","product":"kreditplus.com","severity":"medium","severityNote":"768K accounts","slug":"kreditplus-data-breach","stacks":[],"startedAt":"2020-08-03","status":"closed","summary":"In June 2020, the Indonesian credit service Kreditplus suffered a data breach which exposed 896k records containing 769k unique email addresses. The breach exposed extensive personal information including names, family makeup, information on spouses, income and expenses, religions and employment information. The data was provided to HIBP by breachbase.pw. Exposed data: dates of birth, email addresses, employers, family structure, genders, income levels, living costs, marital statuses, mothers maiden names, names, phone numbers, physical addresses, places of birth, religions, spouses names. The breach dates from Jun 23, 2020; Have I Been Pwned loaded it on Aug 3, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","employers","family-structure","genders","income-levels","living-costs","marital-statuses","mothers-maiden-names","names","phone-numbers","physical-addresses"],"title":"Kreditplus data breach: 768K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/kreditplus-data-breach","vendor":"Kreditplus"},{"auto":true,"category":"breach","closedAt":"2020-08-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DECORATINGTHEHOUSE"],"json":"https://helix.ml/threat-watch/i/decoratingthehouse-data-breach.json","latestUpdate":{"date":"2020-08-02","title":"Have I Been Pwned loaded 1.3M breached 집꾸미기 accounts"},"patchStatus":"no-fix-needed","product":"ggumim.co.kr","severity":"medium","severityNote":"1.3M accounts","slug":"decoratingthehouse-data-breach","stacks":[],"startedAt":"2020-08-02","status":"closed","summary":"In March 2020, the Korean interior decoration website ???? (Decorating the House) suffered a data breach which impacted almost 1.3 million members. Served via the URL ggumim.co.kr, the exposed data included email addresses, names, usernames and phone numbers, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, names, phone numbers, usernames. The breach dates from Mar 27, 2020; Have I Been Pwned loaded it on Aug 2, 2020.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","usernames"],"title":"집꾸미기 data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/decoratingthehouse-data-breach","vendor":"집꾸미기"},{"auto":true,"category":"breach","closedAt":"2020-08-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRUEFIRE"],"json":"https://helix.ml/threat-watch/i/truefire-data-breach.json","latestUpdate":{"date":"2020-08-02","title":"Have I Been Pwned loaded 599K breached TrueFire accounts"},"patchStatus":"no-fix-needed","product":"truefire.com","severity":"high","severityNote":"599K accounts · passwords exposed","slug":"truefire-data-breach","stacks":[],"startedAt":"2020-08-02","status":"closed","summary":"In February 2020, the guitar tuition website TrueFire suffered a data breach which impacted 600k members. The breach exposed extensive personal information including names, email and physical addresses, account balances and unsalted MD5 password hashes. The data was provided to HIBP by dehashed.com. Exposed data: account balances, dates of birth, email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Feb 21, 2020; Have I Been Pwned loaded it on Aug 2, 2020.","tags":["data-breach","hibp","account-balances","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"TrueFire data breach: 599K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/truefire-data-breach","vendor":"TrueFire"},{"auto":true,"category":"breach","closedAt":"2020-08-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HAVENLY"],"json":"https://helix.ml/threat-watch/i/havenly-data-breach.json","latestUpdate":{"date":"2020-08-01","title":"Have I Been Pwned loaded 1.4M breached Havenly accounts"},"patchStatus":"no-fix-needed","product":"havenly.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"havenly-data-breach","stacks":[],"startedAt":"2020-08-01","status":"closed","summary":"In June 2020, the interior design website Havenly suffered a data breach which impacted almost 1.4 million members of the service. The exposed data included email addresses, names, phone numbers, geographic locations and passwords stored as SHA-1 hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, geographic locations, names, passwords, phone numbers. The breach dates from Jun 25, 2020; Have I Been Pwned loaded it on Aug 1, 2020.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","phone-numbers"],"title":"Havenly data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/havenly-data-breach","vendor":"Havenly"},{"auto":true,"category":"breach","closedAt":"2020-08-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VAKINHA"],"json":"https://helix.ml/threat-watch/i/vakinha-data-breach.json","latestUpdate":{"date":"2020-08-01","title":"Have I Been Pwned loaded 4.8M breached Vakinha accounts"},"patchStatus":"no-fix-needed","product":"vakinha.com.br","severity":"high","severityNote":"4.8M accounts · passwords exposed","slug":"vakinha-data-breach","stacks":[],"startedAt":"2020-08-01","status":"closed","summary":"In June 2020, the Brazilian fund raising service Vakinha suffered a data breach which impacted almost 4.8 million members. The exposed data included email addresses, names, phone numbers, geographic locations and passwords stored as bcrypt hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, phone numbers. The breach dates from Jun 22, 2020; Have I Been Pwned loaded it on Aug 1, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","phone-numbers"],"title":"Vakinha data breach: 4.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/vakinha-data-breach","vendor":"Vakinha"},{"auto":true,"category":"breach","closedAt":"2020-08-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SWVL"],"json":"https://helix.ml/threat-watch/i/swvl-data-breach.json","latestUpdate":{"date":"2020-07-31","title":"Have I Been Pwned loaded 4.2M breached Swvl accounts"},"patchStatus":"no-fix-needed","product":"swvl.com","severity":"high","severityNote":"4.2M accounts · passwords exposed · financial data exposed","slug":"swvl-data-breach","stacks":[],"startedAt":"2020-07-31","status":"closed","summary":"In June 2020, the Egyptian bus operator Swvl suffered a data breach which impacted over 4 million members of the service. The exposed data included names, email addresses, phone numbers, profile photos, partial credit card data (type and last 4 digits) and passwords stored as bcrypt hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, names, partial credit card data, passwords, phone numbers, profile photos. The breach dates from Jun 23, 2020; Have I Been Pwned loaded it on Jul 31, 2020.","tags":["data-breach","hibp","email-addresses","names","partial-credit-card-data","passwords","phone-numbers","profile-photos"],"title":"Swvl data breach: 4.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/swvl-data-breach","vendor":"Swvl"},{"auto":true,"category":"breach","closedAt":"2020-08-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SCENTBIRD"],"json":"https://helix.ml/threat-watch/i/scentbird-data-breach.json","latestUpdate":{"date":"2020-07-30","title":"Have I Been Pwned loaded 5.8M breached Scentbird accounts"},"patchStatus":"no-fix-needed","product":"scentbird.com","severity":"high","severityNote":"5.8M accounts · passwords exposed","slug":"scentbird-data-breach","stacks":[],"startedAt":"2020-07-30","status":"closed","summary":"In June 2020, the online fragrance service Scentbird suffered a data breach that exposed the personal information of over 5.8 million customers. Personal information including names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes and indicators of password strength were all exposed. The data was provided to HIBP by breachbase.pw. Exposed data: dates of birth, email addresses, genders, names, password strengths, passwords. The breach dates from Jun 22, 2020; Have I Been Pwned loaded it on Jul 30, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","password-strengths","passwords"],"title":"Scentbird data breach: 5.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/scentbird-data-breach","vendor":"Scentbird"},{"auto":true,"category":"breach","closedAt":"2020-08-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:APPEN"],"json":"https://helix.ml/threat-watch/i/appen-data-breach.json","latestUpdate":{"date":"2020-07-30","title":"Have I Been Pwned loaded 5.9M breached Appen accounts"},"patchStatus":"no-fix-needed","product":"appen.com","severity":"high","severityNote":"5.9M accounts · passwords exposed","slug":"appen-data-breach","stacks":[],"startedAt":"2020-07-30","status":"closed","summary":"In June 2020, the AI training data company Appen suffered a data breach exposing the details of almost 5.9 million users which were subsequently sold online. Included in the breach were names, email addresses and passwords stored as bcrypt hashes. Some records also contained phone numbers, employers and IP addresses. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, employers, ip addresses, names, passwords, phone numbers. The breach dates from Jun 22, 2020; Have I Been Pwned loaded it on Jul 30, 2020.","tags":["data-breach","hibp","email-addresses","employers","ip-addresses","names","passwords","phone-numbers"],"title":"Appen data breach: 5.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/appen-data-breach","vendor":"Appen"},{"auto":true,"category":"breach","closedAt":"2020-08-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DUNZO"],"json":"https://helix.ml/threat-watch/i/dunzo-data-breach.json","latestUpdate":{"date":"2020-07-29","title":"Have I Been Pwned loaded 3.5M breached Dunzo accounts"},"patchStatus":"no-fix-needed","product":"dunzo.com","severity":"medium","severityNote":"3.5M accounts","slug":"dunzo-data-breach","stacks":[],"startedAt":"2020-07-29","status":"closed","summary":"In approximately June 2019, the Indian delivery service Dunzo suffered a data breach. Exposing 3.5 million unique email addresses, the Dunzo breach also included names, phone numbers and IP addresses which were all broadly distributed online via a hacking forum. The data was provided to HIBP by dehashed.com. Exposed data: device information, email addresses, geographic locations, ip addresses, names, phone numbers. The breach dates from Jun 19, 2020; Have I Been Pwned loaded it on Jul 29, 2020.","tags":["data-breach","hibp","device-information","email-addresses","geographic-locations","ip-addresses","names","phone-numbers"],"title":"Dunzo data breach: 3.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dunzo-data-breach","vendor":"Dunzo"},{"auto":true,"category":"breach","closedAt":"2020-08-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHATBOOKS"],"json":"https://helix.ml/threat-watch/i/chatbooks-data-breach.json","latestUpdate":{"date":"2020-07-29","title":"Have I Been Pwned loaded 2.5M breached Chatbooks accounts"},"patchStatus":"no-fix-needed","product":"chatbooks.com","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"chatbooks-data-breach","stacks":[],"startedAt":"2020-07-29","status":"closed","summary":"In March 2020, the photo print service Chatbooks suffered a data breach which was subsequently put up for sale on a dark web marketplace. The breach contained 15 million user records with 2.5 million unique email addresses alongside names, phone numbers, social media profiles and salted SHA-512 password hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, names, passwords, phone numbers, social media profiles. The breach dates from Mar 26, 2020; Have I Been Pwned loaded it on Jul 29, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","social-media-profiles"],"title":"Chatbooks data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/chatbooks-data-breach","vendor":"Chatbooks"},{"auto":true,"category":"breach","closedAt":"2020-08-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DRIZLY"],"json":"https://helix.ml/threat-watch/i/drizly-data-breach.json","latestUpdate":{"date":"2020-07-28","title":"Have I Been Pwned loaded 2.5M breached Drizly accounts"},"patchStatus":"no-fix-needed","product":"drizly.com","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"drizly-data-breach","stacks":[],"startedAt":"2020-07-28","status":"closed","summary":"In approximately July 2020, the US-based online alcohol delivery service Drizly suffered a data breach. The data was sold online before being extensively redistributed and contained 2.5 million unique email addresses alongside names, physical and IP addresses, phone numbers, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, device information, email addresses, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jul 2, 2020; Have I Been Pwned loaded it on Jul 28, 2020.","tags":["data-breach","hibp","dates-of-birth","device-information","email-addresses","ip-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Drizly data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/drizly-data-breach","vendor":"Drizly"},{"auto":true,"category":"breach","closedAt":"2020-08-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DAVE"],"json":"https://helix.ml/threat-watch/i/dave-data-breach.json","latestUpdate":{"date":"2020-07-27","title":"Have I Been Pwned loaded 3.0M breached Dave accounts"},"patchStatus":"no-fix-needed","product":"dave.com","severity":"high","severityNote":"3.0M accounts · passwords exposed","slug":"dave-data-breach","stacks":[],"startedAt":"2020-07-27","status":"closed","summary":"In June 2020, the digital banking app Dave suffered a data breach which exposed 7.5 million rows of data and subsequently appeared for public download on a hacking forum. The breach exposed extensive personal information including almost 3 million unique email addresses alongside names, dates of birth, encrypted social security numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses, social security numbers. The breach dates from Jun 28, 2020; Have I Been Pwned loaded it on Jul 27, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","social-security-numbers"],"title":"Dave data breach: 3.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dave-data-breach","vendor":"Dave"},{"auto":true,"category":"breach","closedAt":"2020-08-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HURB"],"json":"https://helix.ml/threat-watch/i/hurb-data-breach.json","latestUpdate":{"date":"2020-07-27","title":"Have I Been Pwned loaded 20.7M breached Hurb accounts"},"patchStatus":"no-fix-needed","product":"hurb.com","severity":"high","severityNote":"20.7M accounts · passwords exposed","slug":"hurb-data-breach","stacks":[],"startedAt":"2020-07-27","status":"closed","summary":"In approximately March 2019, the online Brazilian travel agency Hurb (formerly Hotel Urbano) suffered a data breach. The data subsequently appeared online for download the following year and included over 20 million customer records with email and IP addresses, names, dates of birth, phone numbers and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, phone numbers, social media profiles. The breach dates from Mar 14, 2019; Have I Been Pwned loaded it on Jul 27, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","phone-numbers","social-media-profiles"],"title":"Hurb data breach: 20.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hurb-data-breach","vendor":"Hurb"},{"auto":true,"category":"breach","closedAt":"2020-08-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROMO"],"json":"https://helix.ml/threat-watch/i/promo-data-breach.json","latestUpdate":{"date":"2020-07-26","title":"Have I Been Pwned loaded 14.6M breached Promo accounts"},"patchStatus":"no-fix-needed","product":"promo.com","severity":"high","severityNote":"14.6M accounts · passwords exposed","slug":"promo-data-breach","stacks":[],"startedAt":"2020-07-26","status":"closed","summary":"In July 2020, the self-proclaimed \"World's #1 Marketing Video Maker\" Promo suffered a data breach which was then shared extensively on a hacking forum. The incident exposed 22 million records containing almost 15 million unique email addresses alongside IP addresses, genders, names and salted SHA-256 password hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, genders, ip addresses, names, passwords. The breach dates from Jun 22, 2020; Have I Been Pwned loaded it on Jul 26, 2020.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","names","passwords"],"title":"Promo data breach: 14.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/promo-data-breach","vendor":"Promo"},{"auto":true,"category":"breach","closedAt":"2020-08-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WATTPAD"],"json":"https://helix.ml/threat-watch/i/wattpad-data-breach.json","latestUpdate":{"date":"2020-07-19","title":"Have I Been Pwned loaded 268.8M breached Wattpad accounts"},"patchStatus":"no-fix-needed","product":"wattpad.com","severity":"critical","severityNote":"268.8M accounts · passwords exposed","slug":"wattpad-data-breach","stacks":[],"startedAt":"2020-07-19","status":"closed","summary":"In June 2020, the user-generated stories website Wattpad suffered a huge data breach that exposed almost 270 million records. The data was initially sold then published on a public hacking forum where it was broadly shared. The incident exposed extensive personal information including names and usernames, email and IP addresses, genders, birth dates and passwords stored as bcrypt hashes. Exposed data: bios, dates of birth, email addresses, genders, geographic locations, ip addresses, names, passwords, social media profiles, user website urls, usernames. The breach dates from Jun 29, 2020; Have I Been Pwned loaded it on Jul 19, 2020.","tags":["data-breach","hibp","bios","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","names","passwords","social-media-profiles","user-website-urls","usernames"],"title":"Wattpad data breach: 268.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wattpad-data-breach","vendor":"Wattpad"},{"auto":true,"category":"breach","closedAt":"2020-07-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QUIDD"],"json":"https://helix.ml/threat-watch/i/quidd-data-breach.json","latestUpdate":{"date":"2020-06-24","title":"Have I Been Pwned loaded 3.8M breached Quidd accounts"},"patchStatus":"no-fix-needed","product":"quidd.co","severity":"high","severityNote":"3.8M accounts · passwords exposed","slug":"quidd-data-breach","stacks":[],"startedAt":"2020-06-24","status":"closed","summary":"In 2019, online marketplace for trading stickers, cards, toys, and other collectibles Quidd suffered a data breach. The breach exposed almost 4 million users' email addresses, usernames and passwords stored as bcrypt hashes. The data was subsequently sold then redistributed extensively via hacking forums. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 1, 2019; Have I Been Pwned loaded it on Jun 24, 2020.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Quidd data breach: 3.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/quidd-data-breach","vendor":"Quidd"},{"auto":true,"category":"breach","closedAt":"2020-06-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FOODORA"],"json":"https://helix.ml/threat-watch/i/foodora-data-breach.json","latestUpdate":{"date":"2020-06-16","title":"Have I Been Pwned loaded 582K breached Foodora accounts"},"patchStatus":"no-fix-needed","product":"foodora.com","severity":"high","severityNote":"582K accounts · passwords exposed","slug":"foodora-data-breach","stacks":[],"startedAt":"2020-06-16","status":"closed","summary":"In April 2016, the online food delivery service Foodora suffered a data breach which was then extensively redistributed online. The breach included the personal information of hundreds of thousands of customers from multiple countries including their names, delivery addresses, phone numbers and passwords stored as either a salted MD5 or a bcrypt hash. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Apr 22, 2016; Have I Been Pwned loaded it on Jun 16, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Foodora data breach: 582K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/foodora-data-breach","vendor":"Foodora"},{"auto":true,"category":"breach","closedAt":"2020-06-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZOOMCAR"],"json":"https://helix.ml/threat-watch/i/zoomcar-data-breach.json","latestUpdate":{"date":"2020-06-05","title":"Have I Been Pwned loaded 3.6M breached Zoomcar accounts"},"patchStatus":"no-fix-needed","product":"zoomcar.com","severity":"high","severityNote":"3.6M accounts · passwords exposed","slug":"zoomcar-data-breach","stacks":[],"startedAt":"2020-06-05","status":"closed","summary":"In July 2018, the Indian self-drive car rental company Zoomcar suffered a data breach which was subsequently sold on a dark web marketplace in 2020. The breach exposed over 3.5M records including names, email and IP addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, names, passwords, phone numbers. The breach dates from Jul 1, 2018; Have I Been Pwned loaded it on Jun 5, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers"],"title":"Zoomcar data breach: 3.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/zoomcar-data-breach","vendor":"Zoomcar"},{"auto":true,"category":"breach","closedAt":"2020-06-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MATHWAY"],"json":"https://helix.ml/threat-watch/i/mathway-data-breach.json","latestUpdate":{"date":"2020-06-05","title":"Have I Been Pwned loaded 25.7M breached Mathway accounts"},"patchStatus":"no-fix-needed","product":"mathway.com","severity":"high","severityNote":"25.7M accounts · passwords exposed","slug":"mathway-data-breach","stacks":[],"startedAt":"2020-06-05","status":"closed","summary":"In January 2020, the math solving website Mathway suffered a data breach that exposed over 25M records. The data was subsequently sold on a dark web marketplace and included names, Google and Facebook IDs, email addresses and salted password hashes. Exposed data: device information, email addresses, names, passwords, social media profiles. The breach dates from Jan 13, 2020; Have I Been Pwned loaded it on Jun 5, 2020.","tags":["data-breach","hibp","device-information","email-addresses","names","passwords","social-media-profiles"],"title":"Mathway data breach: 25.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mathway-data-breach","vendor":"Mathway"},{"auto":true,"category":"breach","closedAt":"2020-06-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEADHUNTER"],"json":"https://helix.ml/threat-watch/i/leadhunter-data-breach.json","latestUpdate":{"date":"2020-06-03","title":"Have I Been Pwned loaded 68.7M breached Lead Hunter accounts"},"patchStatus":"no-fix-needed","product":"Lead Hunter","severity":"high","severityNote":"68.7M accounts","slug":"leadhunter-data-breach","stacks":[],"startedAt":"2020-06-03","status":"closed","summary":"In March 2020, a massive trove of personal information referred to as \"Lead Hunter\" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server. The data contained 69 million unique email addresses across 110 million rows of data accompanied by additional personal information including names, phone numbers, genders and physical addresses. At the time of publishing, the breach could not be attributed to those responsible for obtaining and exposing it. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, genders, ip addresses, names, phone numbers, physical addresses. The breach dates from Mar 4, 2020; Have I Been Pwned loaded it on Jun 3, 2020.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","names","phone-numbers","physical-addresses"],"title":"Lead Hunter data breach: 68.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/leadhunter-data-breach","vendor":"Lead Hunter"},{"auto":true,"category":"breach","closedAt":"2020-06-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WISHBONE2020"],"json":"https://helix.ml/threat-watch/i/wishbone2020-data-breach.json","latestUpdate":{"date":"2020-05-28","title":"Have I Been Pwned loaded 9.7M breached Wishbone (2020) accounts"},"patchStatus":"no-fix-needed","product":"wishbone.io","severity":"high","severityNote":"9.7M accounts · passwords exposed","slug":"wishbone2020-data-breach","stacks":[],"startedAt":"2020-05-28","status":"closed","summary":"In January 2020, the mobile app to \"compare anything\" Wishbone suffered another data breach which followed their breach from 2016. An extensive amount of personal information including almost 10M unique email addresses alongside names, phone numbers geographic locations and other personal attributes were leaked online and extensively redistributed. Passwords stored as unsalted MD5 hashes were also included in the breach. Exposed data: auth tokens, dates of birth, email addresses, genders, geographic locations, ip addresses, names, passwords, phone numbers, profile photos, social media profiles, usernames. The breach dates from Jan 27, 2020; Have I Been Pwned loaded it on May 28, 2020.","tags":["data-breach","hibp","auth-tokens","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","names","passwords","phone-numbers","profile-photos","social-media-profiles","usernames"],"title":"Wishbone (2020) data breach: 9.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wishbone2020-data-breach","vendor":"Wishbone (2020)"},{"auto":true,"category":"breach","closedAt":"2020-06-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PETFLOW"],"json":"https://helix.ml/threat-watch/i/petflow-data-breach.json","latestUpdate":{"date":"2020-05-26","title":"Have I Been Pwned loaded 990K breached PetFlow accounts"},"patchStatus":"no-fix-needed","product":"petflow.com","severity":"high","severityNote":"990K accounts · passwords exposed","slug":"petflow-data-breach","stacks":[],"startedAt":"2020-05-26","status":"closed","summary":"In December 2017, the pet care delivery service PetFlow suffered a data breach which consequently appeared for sale on a dark web marketplace. Almost 1M accounts were impacted and exposed email addresses and passwords stored as unsalted MD5 hashes. Exposed data: email addresses, passwords. The breach dates from Dec 9, 2017; Have I Been Pwned loaded it on May 26, 2020.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"PetFlow data breach: 990K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/petflow-data-breach","vendor":"PetFlow"},{"auto":true,"category":"breach","closedAt":"2020-06-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIVEJOURNAL"],"json":"https://helix.ml/threat-watch/i/livejournal-data-breach.json","latestUpdate":{"date":"2020-05-26","title":"Have I Been Pwned loaded 26.4M breached LiveJournal accounts"},"patchStatus":"no-fix-needed","product":"livejournal.com","severity":"high","severityNote":"26.4M accounts · passwords exposed","slug":"livejournal-data-breach","stacks":[],"startedAt":"2020-05-26","status":"closed","summary":"In mid-2019, news broke of an alleged LiveJournal data breach. This followed multiple reports of credential abuse against Dreamwidth beginning in 2018, a fork of LiveJournal with a significant crossover in user base. The breach allegedly dates back to 2017 and contains 26M unique usernames and email addresses (both of which have been confirmed to exist on LiveJournal) alongside plain text passwords. An archive of the data was subsequently shared on a popular hacking forum in May 2020 and redistributed broadly. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on May 26, 2020.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"LiveJournal data breach: 26.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/livejournal-data-breach","vendor":"LiveJournal"},{"auto":true,"category":"breach","closedAt":"2020-06-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIFEBEAR"],"json":"https://helix.ml/threat-watch/i/lifebear-data-breach.json","latestUpdate":{"date":"2020-05-25","title":"Have I Been Pwned loaded 3.7M breached Lifebear accounts"},"patchStatus":"no-fix-needed","product":"lifebear.com","severity":"high","severityNote":"3.7M accounts · passwords exposed","slug":"lifebear-data-breach","stacks":[],"startedAt":"2020-05-25","status":"closed","summary":"In early 2019, the Japanese schedule app Lifebear appeared for sale on a dark web marketplace amongst a raft of other hacked websites. The breach exposed almost 3.7M unique email addresses, usernames and passwords stored as salted MD5 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Feb 28, 2019; Have I Been Pwned loaded it on May 25, 2020.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Lifebear data breach: 3.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lifebear-data-breach","vendor":"Lifebear"},{"auto":true,"category":"breach","closedAt":"2020-06-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ARTSY"],"json":"https://helix.ml/threat-watch/i/artsy-data-breach.json","latestUpdate":{"date":"2020-05-25","title":"Have I Been Pwned loaded 1.1M breached Artsy accounts"},"patchStatus":"no-fix-needed","product":"artsy.net","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"artsy-data-breach","stacks":[],"startedAt":"2020-05-25","status":"closed","summary":"In April 2018, the online arts database Artsy suffered a data breach which consequently appeared for sale on a dark web marketplace. Over 1M accounts were impacted and included IP and email addresses, names and passwords stored as salted SHA-512 hashes. Exposed data: email addresses, ip addresses, names, passwords. The breach dates from Apr 1, 2018; Have I Been Pwned loaded it on May 25, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords"],"title":"Artsy data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/artsy-data-breach","vendor":"Artsy"},{"auto":true,"category":"breach","closedAt":"2020-06-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NULLEDCH"],"json":"https://helix.ml/threat-watch/i/nulledch-data-breach.json","latestUpdate":{"date":"2020-05-24","title":"Have I Been Pwned loaded 43K breached Nulled.ch accounts"},"patchStatus":"no-fix-needed","product":"nulled.ch","severity":"high","severityNote":"43K accounts · passwords exposed","slug":"nulledch-data-breach","stacks":[],"startedAt":"2020-05-24","status":"closed","summary":"In May 2020, the hacking forum Nulled.ch was breached and the data published to a rival hacking forum. Over 43k records were compromised and included IP and email addresses, usernames and passwords stored as salted MD5 hashes alongside the private message history of the website's admin. Exposed data: email addresses, ip addresses, passwords, private messages, usernames. The breach dates from May 20, 2020; Have I Been Pwned loaded it on May 24, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"Nulled.ch data breach: 43K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nulledch-data-breach","vendor":"Nulled.ch"},{"auto":true,"category":"breach","closedAt":"2020-05-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DB8151DD"],"json":"https://helix.ml/threat-watch/i/db8151dd-data-breach.json","latestUpdate":{"date":"2020-05-15","title":"Have I Been Pwned loaded 22.8M breached Covve accounts"},"patchStatus":"no-fix-needed","product":"covve.com","severity":"medium","severityNote":"22.8M accounts","slug":"db8151dd-data-breach","stacks":[],"startedAt":"2020-05-15","status":"closed","summary":"In February 2020, a massive trove of personal information referred to as \"db8151dd\" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server. Later identified as originating from the Covve contacts app, the exposed data included extensive personal information and interactions between Covve users and their contacts. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, job titles, names, phone numbers, physical addresses, social media profiles. The breach dates from Feb 20, 2020; Have I Been Pwned loaded it on May 15, 2020.","tags":["data-breach","hibp","email-addresses","job-titles","names","phone-numbers","physical-addresses","social-media-profiles"],"title":"Covve data breach: 22.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/db8151dd-data-breach","vendor":"Covve"},{"auto":true,"category":"breach","closedAt":"2020-05-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ULMON"],"json":"https://helix.ml/threat-watch/i/ulmon-data-breach.json","latestUpdate":{"date":"2020-05-08","title":"Have I Been Pwned loaded 777K breached Ulmon accounts"},"patchStatus":"no-fix-needed","product":"ulmon.com","severity":"high","severityNote":"777K accounts · passwords exposed","slug":"ulmon-data-breach","stacks":[],"startedAt":"2020-05-08","status":"closed","summary":"In January 2020, the travel app creator Ulmon suffered a data breach. The service had almost 1.3M records with 777k unique email addresses, names, passwords stored as bcrypt hashes and in some cases, social media profile IDs, telephone numbers and bios. The data was subsequently posted to a popular hacking forum. Exposed data: bios, email addresses, names, passwords, phone numbers, social media profiles. The breach dates from Jan 26, 2020; Have I Been Pwned loaded it on May 8, 2020.","tags":["data-breach","hibp","bios","email-addresses","names","passwords","phone-numbers","social-media-profiles"],"title":"Ulmon data breach: 777K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ulmon-data-breach","vendor":"Ulmon"},{"auto":true,"category":"breach","closedAt":"2020-05-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ELANIC"],"json":"https://helix.ml/threat-watch/i/elanic-data-breach.json","latestUpdate":{"date":"2020-05-04","title":"Have I Been Pwned loaded 2.3M breached Elanic accounts"},"patchStatus":"no-fix-needed","product":"elanic.in","severity":"medium","severityNote":"2.3M accounts","slug":"elanic-data-breach","stacks":[],"startedAt":"2020-05-04","status":"closed","summary":"In January 2020, the Indian fashion marketplace Elanic had 2.8M records with 2.3M unique email addresses posted publicly to a popular hacking forum. Elanic confirmed that they had \"verified the data and it was pulled from one of our test servers where this data was exposed publicly\" and that the data was \"old\" (the hacking forum reported it as being from 2016-2018). When asked about disclosure to impacted customers, Elanic advised that they had \"decided to not have as such any communication and public disclosure\". Exposed data: email addresses, geographic locations, usernames. The breach dates from Jan 1, 2018; Have I Been Pwned loaded it on May 4, 2020.","tags":["data-breach","hibp","email-addresses","geographic-locations","usernames"],"title":"Elanic data breach: 2.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/elanic-data-breach","vendor":"Elanic"},{"auto":true,"category":"breach","closedAt":"2020-05-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TAILIEU"],"json":"https://helix.ml/threat-watch/i/tailieu-data-breach.json","latestUpdate":{"date":"2020-05-03","title":"Have I Been Pwned loaded 7.3M breached TaiLieu accounts"},"patchStatus":"no-fix-needed","product":"tailieu.vn","severity":"high","severityNote":"7.3M accounts · passwords exposed","slug":"tailieu-data-breach","stacks":[],"startedAt":"2020-05-03","status":"closed","summary":"In November 2019, the Vietnamese education website TaiLieu allegedly suffered a data breach exposing 7.3M customer records. Impacted data included names and usernames, email addresses, dates of birth, genders and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com after being shared on a popular hacking forum. TaiLieu did not respond when contacted about the incident. Exposed data: dates of birth, email addresses, genders, geographic locations, names, passwords, phone numbers, usernames. The breach dates from Nov 24, 2019; Have I Been Pwned loaded it on May 3, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","passwords","phone-numbers","usernames"],"title":"TaiLieu data breach: 7.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tailieu-data-breach","vendor":"TaiLieu"},{"auto":true,"category":"breach","closedAt":"2020-05-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TOKOPEDIA"],"json":"https://helix.ml/threat-watch/i/tokopedia-data-breach.json","latestUpdate":{"date":"2020-05-02","title":"Have I Been Pwned loaded 71.4M breached Tokopedia accounts"},"patchStatus":"no-fix-needed","product":"tokopedia.com","severity":"high","severityNote":"71.4M accounts · passwords exposed","slug":"tokopedia-data-breach","stacks":[],"startedAt":"2020-05-02","status":"closed","summary":"In April 2020, Indonesia's largest online store Tokopedia suffered a data breach. The incident resulted in 15M rows of data being posted to a popular hacking forum. An additional 76M rows were later provided to HIBP in July 2020. In total, the data included over 71M unique email addresses alongside names, genders, birth dates and passwords stored as SHA2-384 hashes. Exposed data: dates of birth, email addresses, genders, names, passwords. The breach dates from Apr 17, 2020; Have I Been Pwned loaded it on May 2, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords"],"title":"Tokopedia data breach: 71.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tokopedia-data-breach","vendor":"Tokopedia"},{"auto":true,"category":"breach","closedAt":"2020-05-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VIANET"],"json":"https://helix.ml/threat-watch/i/vianet-data-breach.json","latestUpdate":{"date":"2020-04-22","title":"Have I Been Pwned loaded 94K breached Vianet accounts"},"patchStatus":"no-fix-needed","product":"vianet.com.np","severity":"medium","severityNote":"94K accounts","slug":"vianet-data-breach","stacks":[],"startedAt":"2020-04-22","status":"closed","summary":"In April 2020, the Nepalese internet service provider Vianet suffered a data breach. The attack on the ISP led to the exposure of 177k customer records including 94k unique email addresses. Also exposed were names, phone numbers and physical addresses. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Apr 8, 2020; Have I Been Pwned loaded it on Apr 22, 2020.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Vianet data breach: 94K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/vianet-data-breach","vendor":"Vianet"},{"auto":true,"category":"breach","closedAt":"2020-05-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:APTOIDE"],"json":"https://helix.ml/threat-watch/i/aptoide-data-breach.json","latestUpdate":{"date":"2020-04-19","title":"Have I Been Pwned loaded 20.0M breached Aptoide accounts"},"patchStatus":"no-fix-needed","product":"aptoide.com","severity":"high","severityNote":"20.0M accounts · passwords exposed","slug":"aptoide-data-breach","stacks":[],"startedAt":"2020-04-19","status":"closed","summary":"In April 2020, the independent Android app store Aptoide suffered a data breach. The incident resulted in the exposure of 20M customer records which were subsequently shared online via a popular hacking forum. Impacted data included email and IP addresses, names, IP addresses and passwords stored as SHA-1 hashes without a salt. Exposed data: browser user agent details, email addresses, ip addresses, names, passwords. The breach dates from Apr 13, 2020; Have I Been Pwned loaded it on Apr 19, 2020.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","names","passwords"],"title":"Aptoide data breach: 20.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/aptoide-data-breach","vendor":"Aptoide"},{"auto":true,"category":"breach","closedAt":"2020-04-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HTCMANIA"],"json":"https://helix.ml/threat-watch/i/htcmania-data-breach.json","latestUpdate":{"date":"2020-04-06","title":"Have I Been Pwned loaded 1.5M breached HTC Mania accounts"},"patchStatus":"no-fix-needed","product":"htcmania.com","severity":"high","severityNote":"1.5M accounts · passwords exposed","slug":"htcmania-data-breach","stacks":[],"startedAt":"2020-04-06","status":"closed","summary":"In January 2020, the Spanish mobile phone forum HTC Mania suffered a data breach of the vBulletin based site. The incident exposed 1.5M member email addresses, usernames, IP addresses, dates of birth and salted MD5 password hashes and password histories. Data from the breach was subsequently redistributed on popular hacking websites. Exposed data: dates of birth, email addresses, historical passwords, ip addresses, passwords, usernames. The breach dates from Jan 4, 2020; Have I Been Pwned loaded it on Apr 6, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","historical-passwords","ip-addresses","passwords","usernames"],"title":"HTC Mania data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/htcmania-data-breach","vendor":"HTC Mania"},{"auto":true,"category":"breach","closedAt":"2020-04-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OGUSERS2020"],"json":"https://helix.ml/threat-watch/i/ogusers2020-data-breach.json","latestUpdate":{"date":"2020-04-04","title":"Have I Been Pwned loaded 263K breached OGUsers (2020 breach) accounts"},"patchStatus":"no-fix-needed","product":"ogusers.com","severity":"high","severityNote":"263K accounts · passwords exposed","slug":"ogusers2020-data-breach","stacks":[],"startedAt":"2020-04-04","status":"closed","summary":"In April 2020, the account hijacking and SIM swapping forum OGUsers suffered their second data breach in less than a year. As with the previous breach, the exposed data included email and IP addresses, usernames, private messages and passwords stored as salted MD5 hashes. A total of 263k email addresses across user accounts and other tables were posted to a rival hacking forum. Exposed data: email addresses, ip addresses, passwords, private messages, usernames. The breach dates from Apr 2, 2020; Have I Been Pwned loaded it on Apr 4, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"OGUsers (2020 breach) data breach: 263K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ogusers2020-data-breach","vendor":"OGUsers (2020 breach)"},{"auto":true,"category":"breach","closedAt":"2020-04-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DUELINGNETWORK"],"json":"https://helix.ml/threat-watch/i/duelingnetwork-data-breach.json","latestUpdate":{"date":"2020-03-30","title":"Have I Been Pwned loaded 6.5M breached Dueling Network accounts"},"patchStatus":"no-fix-needed","product":"duelingnetwork.com","severity":"high","severityNote":"6.5M accounts · passwords exposed","slug":"duelingnetwork-data-breach","stacks":[],"startedAt":"2020-03-30","status":"closed","summary":"In March 2017, the Flash game based on the Yu-Gi-Oh trading card game Dueling Network suffered a data breach. The site itself was taken offline in 2016 due to a cease-and-desist order but the forum remained online for another year. The data breach exposed usernames, IP and email addresses and passwords stored as MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Mar 29, 2017; Have I Been Pwned loaded it on Mar 30, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Dueling Network data breach: 6.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/duelingnetwork-data-breach","vendor":"Dueling Network"},{"auto":true,"category":"breach","closedAt":"2020-04-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROPTIGER"],"json":"https://helix.ml/threat-watch/i/proptiger-data-breach.json","latestUpdate":{"date":"2020-03-24","title":"Have I Been Pwned loaded 2.2M breached PropTiger accounts"},"patchStatus":"no-fix-needed","product":"proptiger.com","severity":"high","severityNote":"2.2M accounts · passwords exposed","slug":"proptiger-data-breach","stacks":[],"startedAt":"2020-03-24","status":"closed","summary":"In January 2018, the Indian property website PropTiger suffered a data breach which resulted in a 3.46GB database file being exposed and subsequently shared extensively on a popular hacking forum 2 years later. The exposed data contained both user records and login histories with over 2M unique customer email addresses. Exposed data also included additional personal attributes such as names, dates of birth, genders, IP addresses and passwords stored as MD5 hashes. PropTiger advised they believe the usability of the data is \"limited\" due to how certain data attributes were generated and stored. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, device information, email addresses, genders, ip addresses, names, passwords. The breach dates from Jan 30, 2018; Have I Been Pwned loaded it on Mar 24, 2020.","tags":["data-breach","hibp","dates-of-birth","device-information","email-addresses","genders","ip-addresses","names","passwords"],"title":"PropTiger data breach: 2.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/proptiger-data-breach","vendor":"PropTiger"},{"auto":true,"category":"breach","closedAt":"2020-04-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TAMODO"],"json":"https://helix.ml/threat-watch/i/tamodo-data-breach.json","latestUpdate":{"date":"2020-03-24","title":"Have I Been Pwned loaded 494K breached Tamodo accounts"},"patchStatus":"no-fix-needed","product":"tamodo.com","severity":"high","severityNote":"494K accounts · passwords exposed","slug":"tamodo-data-breach","stacks":[],"startedAt":"2020-03-24","status":"closed","summary":"In February 2020, the affiliate marketing network Tamodo suffered a data breach which was subsequently shared on a popular hacking forum. The incident exposed almost 500k accounts including names, email addresses, dates of birth and passwords stored as bcrypt hashes. Tamodo failed to respond to multiple attempts to report the breach via published communication channels. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, names, passwords. The breach dates from Feb 28, 2020; Have I Been Pwned loaded it on Mar 24, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","names","passwords"],"title":"Tamodo data breach: 494K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tamodo-data-breach","vendor":"Tamodo"},{"auto":true,"category":"breach","closedAt":"2020-03-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HALLOWEENSPOT"],"json":"https://helix.ml/threat-watch/i/halloweenspot-data-breach.json","latestUpdate":{"date":"2020-03-16","title":"Have I Been Pwned loaded 10K breached The Halloween Spot accounts"},"patchStatus":"no-fix-needed","product":"thehalloweenspot.com","severity":"medium","severityNote":"10K accounts","slug":"halloweenspot-data-breach","stacks":[],"startedAt":"2020-03-16","status":"closed","summary":"In September 2019, the Halloween costume store The Halloween Spot suffered a data breach. Originally misattributed to fancy dress store Smiffys, the breach contained 13GB of data with over 10k unique email addresses alongside names, physical and IP addresses, phone numbers and order histories. The Halloween Spot advised customers the breach was traced back to \"an old shipping information database\". Exposed data: email addresses, ip addresses, names, phone numbers, physical addresses, purchases. The breach dates from Sep 27, 2019; Have I Been Pwned loaded it on Mar 16, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"The Halloween Spot data breach: 10K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/halloweenspot-data-breach","vendor":"The Halloween Spot"},{"auto":true,"category":"breach","closedAt":"2020-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANIMEGAME"],"json":"https://helix.ml/threat-watch/i/animegame-data-breach.json","latestUpdate":{"date":"2020-03-09","title":"Have I Been Pwned loaded 1.4M breached AnimeGame accounts"},"patchStatus":"no-fix-needed","product":"animegame.me","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"animegame-data-breach","stacks":[],"startedAt":"2020-03-09","status":"closed","summary":"In February 2020, the gaming website AnimeGame suffered a data breach. The incident affected 1.4M subscribers and exposed email addresses, usernames and passwords stored as salted MD5 hashes. The data was subsequently shared on a popular hacking forum and was provided to HIBP by dehashed.com. Exposed data: email addresses, passwords, usernames. The breach dates from Feb 27, 2020; Have I Been Pwned loaded it on Mar 9, 2020.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"AnimeGame data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/animegame-data-breach","vendor":"AnimeGame"},{"auto":true,"category":"breach","closedAt":"2020-03-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STRAFFIC"],"json":"https://helix.ml/threat-watch/i/straffic-data-breach.json","latestUpdate":{"date":"2020-02-27","title":"Have I Been Pwned loaded 48.6M breached Straffic accounts"},"patchStatus":"no-fix-needed","product":"straffic.io","severity":"medium","severityNote":"48.6M accounts","slug":"straffic-data-breach","stacks":[],"startedAt":"2020-02-27","status":"closed","summary":"In February 2020, Israeli marketing company Straffic exposed a database with 140GB of personal data. The publicly accessible Elasticsearch database contained over 300M rows with 49M unique email addresses. Exposed data also included names, phone numbers, physical addresses and genders. In their breach disclosure message, Straffic stated that \"it is impossible to create a totally immune system, and these things can occur\". Exposed data: email addresses, genders, names, phone numbers, physical addresses. The breach dates from Feb 14, 2020; Have I Been Pwned loaded it on Feb 27, 2020.","tags":["data-breach","hibp","email-addresses","genders","names","phone-numbers","physical-addresses"],"title":"Straffic data breach: 48.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/straffic-data-breach","vendor":"Straffic"},{"auto":true,"category":"breach","closedAt":"2020-03-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SLICKWRAPS"],"json":"https://helix.ml/threat-watch/i/slickwraps-data-breach.json","latestUpdate":{"date":"2020-02-22","title":"Have I Been Pwned loaded 857K breached Slickwraps accounts"},"patchStatus":"no-fix-needed","product":"slickwraps.com","severity":"medium","severityNote":"857K accounts","slug":"slickwraps-data-breach","stacks":[],"startedAt":"2020-02-22","status":"closed","summary":"In February 2020, the online store for consumer electronics wraps Slickwraps suffered a data breach. The incident resulted in the exposure of 858k unique email addresses across customer records and newsletter subscribers. Additional impacted data included names, physical addresses, phone numbers and purchase histories. Exposed data: email addresses, names, phone numbers, physical addresses, purchases. The breach dates from Feb 16, 2020; Have I Been Pwned loaded it on Feb 22, 2020.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"Slickwraps data breach: 857K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/slickwraps-data-breach","vendor":"Slickwraps"},{"auto":true,"category":"breach","closedAt":"2020-03-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MGM"],"json":"https://helix.ml/threat-watch/i/mgm-data-breach.json","latestUpdate":{"date":"2020-02-20","title":"Have I Been Pwned loaded 3.1M breached MGM Resorts accounts"},"patchStatus":"no-fix-needed","product":"mgmresorts.com","severity":"medium","severityNote":"3.1M accounts","slug":"mgm-data-breach","stacks":[],"startedAt":"2020-02-20","status":"closed","summary":"In July 2019, MGM Resorts discovered a data breach of one of their cloud services. The breach included 10.6M guest records with 3.1M unique email addresses stemming back to 2017. The exposed data included email and physical addresses, names, phone numbers and dates of birth and was subsequently shared on a popular hacking forum in February 2020 where it was extensively redistributed. The data was provided to HIBP by Under The Breach. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Jul 25, 2019; Have I Been Pwned loaded it on Feb 20, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses"],"title":"MGM Resorts data breach: 3.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mgm-data-breach","vendor":"MGM Resorts"},{"auto":true,"category":"breach","closedAt":"2020-02-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADULTFRIENDFINDER2016"],"json":"https://helix.ml/threat-watch/i/adultfriendfinder2016-data-breach.json","latestUpdate":{"date":"2020-02-06","title":"Have I Been Pwned loaded 169.7M breached Adult FriendFinder (2016) accounts"},"patchStatus":"no-fix-needed","product":"adultfriendfinder.com","severity":"critical","severityNote":"169.7M accounts · passwords exposed","slug":"adultfriendfinder2016-data-breach","stacks":[],"startedAt":"2020-02-06","status":"closed","summary":"In October 2016, the adult entertainment company Friend Finder Networks suffered a massive data breach. The incident impacted multiple separate online assets owned by the company, the largest of which was the Adult FriendFinder website alleged to be \"the world's largest sex \u0026 swinger community\". Exposed data included usernames, passwords stored as SHA-1 hashes and 170 million unique email addresses. This incident is separate to the 2015 data breach Adult FriendFinder also suffered. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, passwords, spoken languages, usernames. The breach dates from Oct 16, 2016; Have I Been Pwned loaded it on Feb 6, 2020.","tags":["data-breach","hibp","email-addresses","passwords","spoken-languages","usernames"],"title":"Adult FriendFinder (2016) data breach: 169.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/adultfriendfinder2016-data-breach","vendor":"Adult FriendFinder (2016)"},{"auto":true,"category":"breach","closedAt":"2020-02-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DAILYOBJECTS"],"json":"https://helix.ml/threat-watch/i/dailyobjects-data-breach.json","latestUpdate":{"date":"2020-01-28","title":"Have I Been Pwned loaded 464K breached DailyObjects accounts"},"patchStatus":"no-fix-needed","product":"dailyobjects.com","severity":"high","severityNote":"464K accounts · passwords exposed","slug":"dailyobjects-data-breach","stacks":[],"startedAt":"2020-01-28","status":"closed","summary":"In approximately January 2018, a collection of more than 464k customer records from the Indian online retailer DailyObjects were leaked online. The data included names, physical and email addresses, phone numbers and \"pincodes\" stored in plain text. After multiple attempts to contact them, DailyObjects responded and received a copy of the data for verification, however failed to respond to multiple contact attempts following that. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jan 1, 2018; Have I Been Pwned loaded it on Jan 28, 2020.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"DailyObjects data breach: 464K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dailyobjects-data-breach","vendor":"DailyObjects"},{"auto":true,"category":"breach","closedAt":"2020-02-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TOUT"],"json":"https://helix.ml/threat-watch/i/tout-data-breach.json","latestUpdate":{"date":"2020-01-25","title":"Have I Been Pwned loaded 652K breached Tout accounts"},"patchStatus":"no-fix-needed","product":"tout.com","severity":"high","severityNote":"652K accounts · passwords exposed","slug":"tout-data-breach","stacks":[],"startedAt":"2020-01-25","status":"closed","summary":"In approximately September 2014, the now defunct social networking service Tout suffered a data breach. The breach subsequently appeared years later and included 653k unique email addresses, names, IP addresses, the location of the user, their bio and passwords stored as bcrypt hashes. Exposed data: bios, email addresses, geographic locations, ip addresses, names, passwords, usernames. The breach dates from Sep 11, 2014; Have I Been Pwned loaded it on Jan 25, 2020.","tags":["data-breach","hibp","bios","email-addresses","geographic-locations","ip-addresses","names","passwords","usernames"],"title":"Tout data breach: 652K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tout-data-breach","vendor":"Tout"},{"auto":true,"category":"breach","closedAt":"2020-01-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EUROPAJOBS"],"json":"https://helix.ml/threat-watch/i/europajobs-data-breach.json","latestUpdate":{"date":"2020-01-15","title":"Have I Been Pwned loaded 226K breached europa.jobs accounts"},"patchStatus":"no-fix-needed","product":"europa.jobs","severity":"high","severityNote":"226K accounts · passwords exposed","slug":"europajobs-data-breach","stacks":[],"startedAt":"2020-01-15","status":"closed","summary":"In August 2019, the now defunct European jobs website europa.jobs (Google cache link) suffered a data breach. The incident exposed 226k unique email addresses alongside extensive personal information including names, dates of birth, job applications and passwords. The data was subsequently redistributed on a popular hacking forum. Exposed data: dates of birth, email addresses, geographic locations, job applications, names, passwords, phone numbers, spoken languages. The breach dates from Aug 11, 2019; Have I Been Pwned loaded it on Jan 15, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","job-applications","names","passwords","phone-numbers","spoken-languages"],"title":"europa.jobs data breach: 226K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/europajobs-data-breach","vendor":"europa.jobs"},{"auto":true,"category":"breach","closedAt":"2020-01-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PLANETCALYPSO"],"json":"https://helix.ml/threat-watch/i/planetcalypso-data-breach.json","latestUpdate":{"date":"2020-01-12","title":"Have I Been Pwned loaded 62K breached Planet Calypso accounts"},"patchStatus":"no-fix-needed","product":"planetcalypsoforum.com","severity":"high","severityNote":"62K accounts · passwords exposed","slug":"planetcalypso-data-breach","stacks":[],"startedAt":"2020-01-12","status":"closed","summary":"In approximately July 2019, the forums for the Planet Calypso game suffered a data breach. The breach of the vBulletin based forum exposed email and IP addresses, usernames and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2019; Have I Been Pwned loaded it on Jan 12, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Planet Calypso data breach: 62K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/planetcalypso-data-breach","vendor":"Planet Calypso"},{"auto":true,"category":"breach","closedAt":"2020-01-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GOGAMES"],"json":"https://helix.ml/threat-watch/i/gogames-data-breach.json","latestUpdate":{"date":"2020-01-11","title":"Have I Been Pwned loaded 3.4M breached Go Games accounts"},"patchStatus":"no-fix-needed","product":"gogames.me","severity":"high","severityNote":"3.4M accounts · passwords exposed","slug":"gogames-data-breach","stacks":[],"startedAt":"2020-01-11","status":"closed","summary":"In approximately October 2015, the manga website Go Games suffered a data breach. The exposed data included 3.4M customer records including email and IP addresses, usernames and passwords stored as salted MD5 hashes. Go Games did not respond when contacted about the incident. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 24, 2015; Have I Been Pwned loaded it on Jan 11, 2020.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Go Games data breach: 3.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gogames-data-breach","vendor":"Go Games"},{"auto":true,"category":"breach","closedAt":"2020-01-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BTOBET"],"json":"https://helix.ml/threat-watch/i/btobet-data-breach.json","latestUpdate":{"date":"2020-01-11","title":"Have I Been Pwned loaded 444K breached BtoBet accounts"},"patchStatus":"no-fix-needed","product":"btobet.com","severity":"medium","severityNote":"444K accounts","slug":"btobet-data-breach","stacks":[],"startedAt":"2020-01-11","status":"closed","summary":"In December 2019, a large collection of data from Nigerian gambling company Surebet247 was sent to HIBP. Alongside the Surebet247, database backups from gambling sites BetAlfa, BetWay, BongoBongo and TopBet was also included. Further investigation implicated betting platform provider BtoBet as being the common source of the data. Impacted data included user records and extensive information on gambling histories. Exposed data: dates of birth, email addresses, financial transactions, geographic locations, ip addresses, names, usernames. The breach dates from Dec 26, 2019; Have I Been Pwned loaded it on Jan 11, 2020.","tags":["data-breach","hibp","dates-of-birth","email-addresses","financial-transactions","geographic-locations","ip-addresses","names","usernames"],"title":"BtoBet data breach: 444K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/btobet-data-breach","vendor":"BtoBet"},{"auto":true,"category":"breach","closedAt":"2020-01-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INDIANRAILWAYS"],"json":"https://helix.ml/threat-watch/i/indianrailways-data-breach.json","latestUpdate":{"date":"2020-01-10","title":"Have I Been Pwned loaded 583K breached Indian Railways accounts"},"patchStatus":"no-fix-needed","product":"indianrails.in","severity":"high","severityNote":"583K accounts · passwords exposed","slug":"indianrailways-data-breach","stacks":[],"startedAt":"2020-01-10","status":"closed","summary":"In November 2019, the website for Indian Rail left more than 2M records exposed on an unprotected Firebase database instance. The exposed data included 583k unique email addresses alongside usernames and passwords stored in plain text. Exposed data: email addresses, passwords, usernames. The breach dates from Oct 28, 2019; Have I Been Pwned loaded it on Jan 10, 2020.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Indian Railways data breach: 583K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/indianrailways-data-breach","vendor":"Indian Railways"},{"auto":true,"category":"breach","closedAt":"2020-01-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNIVERSARIUM"],"json":"https://helix.ml/threat-watch/i/universarium-data-breach.json","latestUpdate":{"date":"2020-01-03","title":"Have I Been Pwned loaded 564K breached Universarium accounts"},"patchStatus":"no-fix-needed","product":"universarium.org","severity":"high","severityNote":"564K accounts · passwords exposed","slug":"universarium-data-breach","stacks":[],"startedAt":"2020-01-03","status":"closed","summary":"In approximately November 2019, the Russian \"Remote preparatory faculty for IT specialties\" Universarium suffered a data breach. The incident exposed 565k email addresses and passwords in plain text. Universarium did not respond to multiple attempts to make contact over a period of many weeks. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, passwords. The breach dates from Nov 1, 2019; Have I Been Pwned loaded it on Jan 3, 2020.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Universarium data breach: 564K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/universarium-data-breach","vendor":"Universarium"},{"auto":true,"category":"breach","closedAt":"2020-01-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FACTUAL"],"json":"https://helix.ml/threat-watch/i/factual-data-breach.json","latestUpdate":{"date":"2019-12-24","title":"Have I Been Pwned loaded 2.5M breached Factual accounts"},"patchStatus":"no-fix-needed","product":"factual.com","severity":"medium","severityNote":"2.5M accounts","slug":"factual-data-breach","stacks":[],"startedAt":"2019-12-24","status":"closed","summary":"In March 2017, a file containing 8M rows of data allegedly sourced from data aggregator Factual was compiled and later exchanged on the premise it was a \"breach\". The data contained 2.5M unique email addresses alongside business names, addresses and phone numbers. After consultation with Factual, they advised the data was \"publicly available information about businesses and other points of interest that Factual makes available on its website and to customers\". Exposed data: email addresses, employers, phone numbers, physical addresses. The breach dates from Mar 22, 2017; Have I Been Pwned loaded it on Dec 24, 2019.","tags":["data-breach","hibp","email-addresses","employers","phone-numbers","physical-addresses"],"title":"Factual data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/factual-data-breach","vendor":"Factual"},{"auto":true,"category":"breach","closedAt":"2020-01-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZYNGA"],"json":"https://helix.ml/threat-watch/i/zynga-data-breach.json","latestUpdate":{"date":"2019-12-19","title":"Have I Been Pwned loaded 172.9M breached Zynga accounts"},"patchStatus":"no-fix-needed","product":"zynga.com","severity":"critical","severityNote":"172.9M accounts · passwords exposed","slug":"zynga-data-breach","stacks":[],"startedAt":"2019-12-19","status":"closed","summary":"In September 2019, game developer Zynga (the creator of Words with Friends) suffered a data breach. The incident exposed 173M unique email addresses alongside usernames and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, passwords, phone numbers, usernames. The breach dates from Sep 1, 2019; Have I Been Pwned loaded it on Dec 19, 2019.","tags":["data-breach","hibp","email-addresses","passwords","phone-numbers","usernames"],"title":"Zynga data breach: 172.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/zynga-data-breach","vendor":"Zynga"},{"auto":true,"category":"breach","closedAt":"2019-12-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AGUSIQTORRENTS"],"json":"https://helix.ml/threat-watch/i/agusiqtorrents-data-breach.json","latestUpdate":{"date":"2019-12-04","title":"Have I Been Pwned loaded 90K breached AgusiQ-Torrents.pl accounts"},"patchStatus":"no-fix-needed","product":"agusiq-torrents.pl","severity":"high","severityNote":"90K accounts · passwords exposed","slug":"agusiqtorrents-data-breach","stacks":[],"startedAt":"2019-12-04","status":"closed","summary":"In September 2019, Polish torrent site AgusiQ-Torrents.pl suffered a data breach. The incident exposed 90k member records including email and IP addresses, usernames and passwords stored as MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 24, 2019; Have I Been Pwned loaded it on Dec 4, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"AgusiQ-Torrents.pl data breach: 90K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/agusiqtorrents-data-breach","vendor":"AgusiQ-Torrents.pl"},{"auto":true,"category":"breach","closedAt":"2019-12-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PDL"],"json":"https://helix.ml/threat-watch/i/pdl-data-breach.json","latestUpdate":{"date":"2019-11-22","title":"Have I Been Pwned loaded 622.2M breached Data Enrichment Exposure From PDL Customer accounts"},"patchStatus":"no-fix-needed","product":"Data Enrichment Exposure From PDL Customer","severity":"high","severityNote":"622.2M accounts","slug":"pdl-data-breach","stacks":[],"startedAt":"2019-11-22","status":"closed","summary":"In October 2019, security researchers Vinny Troia and Bob Diachenko identified an unprotected Elasticsearch server holding 1.2 billion records of personal data. The exposed data included an index indicating it was sourced from data enrichment company People Data Labs (PDL) and contained 622 million unique email addresses. The server was not owned by PDL and it's believed a customer failed to properly secure the database. Exposed information included email addresses, phone numbers, social media profiles and job history data. Exposed data: email addresses, employers, geographic locations, job titles, names, phone numbers, social media profiles. The breach dates from Oct 16, 2019; Have I Been Pwned loaded it on Nov 22, 2019.","tags":["data-breach","hibp","email-addresses","employers","geographic-locations","job-titles","names","phone-numbers","social-media-profiles"],"title":"Data Enrichment Exposure From PDL Customer data breach: 622.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/pdl-data-breach","vendor":"Data Enrichment Exposure From PDL Customer"},{"auto":true,"category":"breach","closedAt":"2019-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GATEHUB"],"json":"https://helix.ml/threat-watch/i/gatehub-data-breach.json","latestUpdate":{"date":"2019-11-20","title":"Have I Been Pwned loaded 1.4M breached GateHub accounts"},"patchStatus":"no-fix-needed","product":"gatehub.net","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"gatehub-data-breach","stacks":[],"startedAt":"2019-11-20","status":"closed","summary":"In October 2019, 1.4M accounts from the cryptocurrency wallet service GateHub were posted to a popular hacking forum. GateHub had previously acknowledged a data breach in June, albeit with a smaller number of impacted accounts. Data from the breach included email addresses, mnemonic phrases, encrypted master keys, encrypted recovery keys and passwords stored as bcrypt hashes. Exposed data: email addresses, encrypted keys, mnemonic phrases, passwords. The breach dates from Jun 4, 2019; Have I Been Pwned loaded it on Nov 20, 2019.","tags":["data-breach","hibp","email-addresses","encrypted-keys","mnemonic-phrases","passwords"],"title":"GateHub data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gatehub-data-breach","vendor":"GateHub"},{"auto":true,"category":"breach","closedAt":"2019-12-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GPSUNDERGROUND"],"json":"https://helix.ml/threat-watch/i/gpsunderground-data-breach.json","latestUpdate":{"date":"2019-11-19","title":"Have I Been Pwned loaded 669K breached GPS Underground accounts"},"patchStatus":"no-fix-needed","product":"gpsunderground.com","severity":"high","severityNote":"669K accounts · passwords exposed","slug":"gpsunderground-data-breach","stacks":[],"startedAt":"2019-11-19","status":"closed","summary":"In early 2017, GPS Underground was amongst a collection of compromised vBulletin websites that were found being sold online. The breach dated back to mid-2016 and included 670k records with usernames, email and IP addresses, dates of birth and salted MD5 password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Nov 19, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"GPS Underground data breach: 669K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gpsunderground-data-breach","vendor":"GPS Underground"},{"auto":true,"category":"breach","closedAt":"2019-12-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EPICBOT"],"json":"https://helix.ml/threat-watch/i/epicbot-data-breach.json","latestUpdate":{"date":"2019-11-19","title":"Have I Been Pwned loaded 816K breached EpicBot accounts"},"patchStatus":"no-fix-needed","product":"epicbot.com","severity":"high","severityNote":"816K accounts · passwords exposed","slug":"epicbot-data-breach","stacks":[],"startedAt":"2019-11-19","status":"closed","summary":"In September 2019, the RuneScape bot provider EpicBot suffered a data breach that impacted 817k subscribers. Data from the breach was subsequently shared on a popular hacking forum and included usernames, email and IP addresses and passwords stored as either salted MD5 or bcrypt hashes. EpicBot did not respond when contacted about the incident. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 1, 2019; Have I Been Pwned loaded it on Nov 19, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"EpicBot data breach: 816K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/epicbot-data-breach","vendor":"EpicBot"},{"auto":true,"category":"breach","closedAt":"2019-11-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TOONDOO"],"json":"https://helix.ml/threat-watch/i/toondoo-data-breach.json","latestUpdate":{"date":"2019-11-11","title":"Have I Been Pwned loaded 6.0M breached ToonDoo accounts"},"patchStatus":"no-fix-needed","product":"toondoo.com","severity":"high","severityNote":"6.0M accounts · passwords exposed","slug":"toondoo-data-breach","stacks":[],"startedAt":"2019-11-11","status":"closed","summary":"In August 2019, the comic strip creation website ToonDoo suffered a data breach. The data was subsequently redistributed on a popular hacking forum in November where the personal information of over 6M subscribers was shared. Impacted data included email and IP addresses, usernames, genders, the location of the individual and salted password hashes. Exposed data: email addresses, genders, geographic locations, ip addresses, passwords, usernames. The breach dates from Aug 21, 2019; Have I Been Pwned loaded it on Nov 11, 2019.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","ip-addresses","passwords","usernames"],"title":"ToonDoo data breach: 6.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/toondoo-data-breach","vendor":"ToonDoo"},{"auto":true,"category":"breach","closedAt":"2019-11-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VEDANTU"],"json":"https://helix.ml/threat-watch/i/vedantu-data-breach.json","latestUpdate":{"date":"2019-11-01","title":"Have I Been Pwned loaded 686K breached Vedantu accounts"},"patchStatus":"no-fix-needed","product":"vedantu.com","severity":"high","severityNote":"686K accounts · passwords exposed","slug":"vedantu-data-breach","stacks":[],"startedAt":"2019-11-01","status":"closed","summary":"In mid-2019, the Indian interactive online tutoring platform Vedantu suffered a data breach which exposed the personal data of 687k users. The JSON formatted database dump exposed extensive personal information including email and IP address, names, phone numbers, genders and passwords stored as bcrypt hashes. When contacted about the incident, Vedantu advised that they were aware of the breach and were in the process of informing their customers. Exposed data: browser user agent details, email addresses, genders, ip addresses, names, passwords, phone numbers, spoken languages, time zones, website activity. The breach dates from Jul 8, 2019; Have I Been Pwned loaded it on Nov 1, 2019.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","genders","ip-addresses","names","passwords","phone-numbers","spoken-languages","time-zones","website-activity"],"title":"Vedantu data breach: 686K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/vedantu-data-breach","vendor":"Vedantu"},{"auto":true,"category":"breach","closedAt":"2019-11-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOOKERSNL"],"json":"https://helix.ml/threat-watch/i/hookersnl-data-breach.json","latestUpdate":{"date":"2019-10-23","title":"Have I Been Pwned loaded 290K breached Hookers.nl accounts"},"patchStatus":"no-fix-needed","product":"hookers.nl","severity":"high","severityNote":"290K accounts · passwords exposed","slug":"hookersnl-data-breach","stacks":[],"startedAt":"2019-10-23","status":"closed","summary":"In October 2019, the Dutch prostitution forum Hookers.nl suffered a data breach which exposed the personal information of sex workers and their customers. The IP and email addresses, usernames and either bcrypt or salted MD5 password hashes of 291k members were accessed via an unpatched vulnerability in the vBulletin forum software. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 10, 2019; Have I Been Pwned loaded it on Oct 23, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Hookers.nl data breach: 290K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hookersnl-data-breach","vendor":"Hookers.nl"},{"auto":true,"category":"breach","closedAt":"2019-11-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZOOVILLE"],"json":"https://helix.ml/threat-watch/i/zooville-data-breach.json","latestUpdate":{"date":"2019-10-19","title":"Have I Been Pwned loaded 71K breached Zooville accounts"},"patchStatus":"no-fix-needed","product":"zooville.org","severity":"high","severityNote":"71K accounts · passwords exposed","slug":"zooville-data-breach","stacks":[],"startedAt":"2019-10-19","status":"closed","summary":"In September 2019, the zoophilia and bestiality forum Zooville suffered a data breach. The usernames and email addresses of 71k members were accessed via an unpatched vulnerability in the vBulletin forum software then subsequently distributed online. A second data set was later provided to HIBP which contained a complete vBulletin database dump including IP addresses, dates of birth and passwords stored as bcrypt hashes. The site administrator advised that following the breach, all data had been deleted from the forum and a new one had been stood up on the XenForo platform. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Sep 27, 2019; Have I Been Pwned loaded it on Oct 19, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Zooville data breach: 71K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/zooville-data-breach","vendor":"Zooville"},{"auto":true,"category":"breach","closedAt":"2019-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SEPHORA"],"json":"https://helix.ml/threat-watch/i/sephora-data-breach.json","latestUpdate":{"date":"2019-10-06","title":"Have I Been Pwned loaded 780K breached Sephora accounts"},"patchStatus":"no-fix-needed","product":"sephora.com.au","severity":"medium","severityNote":"780K accounts","slug":"sephora-data-breach","stacks":[],"startedAt":"2019-10-06","status":"closed","summary":"In approximately January 2017, the beauty store Sephora suffered a data breach. Impacting customers in South East Asia, Australia and New Zealand, 780k unique email addresses were included in the breach alongside names, genders, dates of birth, ethnicities and other personal information. Exposed data: dates of birth, email addresses, ethnicities, genders, names, physical attributes. The breach dates from Jan 9, 2017; Have I Been Pwned loaded it on Oct 6, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ethnicities","genders","names","physical-attributes"],"title":"Sephora data breach: 780K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sephora-data-breach","vendor":"Sephora"},{"auto":true,"category":"breach","closedAt":"2019-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STREETEASY"],"json":"https://helix.ml/threat-watch/i/streeteasy-data-breach.json","latestUpdate":{"date":"2019-10-06","title":"Have I Been Pwned loaded 988K breached StreetEasy accounts"},"patchStatus":"no-fix-needed","product":"streeteasy.com","severity":"high","severityNote":"988K accounts · passwords exposed","slug":"streeteasy-data-breach","stacks":[],"startedAt":"2019-10-06","status":"closed","summary":"In approximately June 2016, the real estate website StreetEasy suffered a data breach. In total, 988k unique email addresses were included in the breach alongside names, usernames and SHA-1 hashes of passwords, all of which appeared for sale on a dark web marketplace in February 2019. Exposed data: email addresses, names, passwords, usernames. The breach dates from Jun 28, 2016; Have I Been Pwned loaded it on Oct 6, 2019.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"StreetEasy data breach: 988K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/streeteasy-data-breach","vendor":"StreetEasy"},{"auto":true,"category":"breach","closedAt":"2019-10-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WANELO"],"json":"https://helix.ml/threat-watch/i/wanelo-data-breach.json","latestUpdate":{"date":"2019-09-30","title":"Have I Been Pwned loaded 23.2M breached Wanelo accounts"},"patchStatus":"no-fix-needed","product":"wanelo.com","severity":"high","severityNote":"23.2M accounts · passwords exposed","slug":"wanelo-data-breach","stacks":[],"startedAt":"2019-09-30","status":"closed","summary":"In approximately December 2018, the digital mall Wanelo suffered a data breach. The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in April 2019. A total of 23 million unique email addresses were included in the breach alongside passwords stored as either MD5 or bcrypt hashes. After the initial HIBP load, further data containing names, shipping addresses and IP addresses were also provided to HIBP, albeit without direct association to the email addresses and passwords. Exposed data: email addresses, ip addresses, names, passwords, physical addresses. The breach dates from Dec 13, 2018; Have I Been Pwned loaded it on Sep 30, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","physical-addresses"],"title":"Wanelo data breach: 23.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wanelo-data-breach","vendor":"Wanelo"},{"auto":true,"category":"breach","closedAt":"2019-10-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LUMINPDF"],"json":"https://helix.ml/threat-watch/i/luminpdf-data-breach.json","latestUpdate":{"date":"2019-09-18","title":"Have I Been Pwned loaded 15.5M breached Lumin PDF accounts"},"patchStatus":"no-fix-needed","product":"luminpdf.com","severity":"high","severityNote":"15.5M accounts · passwords exposed","slug":"luminpdf-data-breach","stacks":[],"startedAt":"2019-09-18","status":"closed","summary":"In April 2019, the PDF management service Lumin PDF suffered a data breach. The breach wasn't publicly disclosed until September when 15.5M records of user data appeared for download on a popular hacking forum. The data had been left publicly exposed in a MongoDB instance after which Lumin PDF was allegedly been \"contacted multiple times, but ignored all the queries\". The exposed data included names, email addresses, genders, spoken language and either a bcrypt password hash or Google auth token. Exposed data: auth tokens, email addresses, genders, names, passwords, spoken languages, usernames. The breach dates from Apr 1, 2019; Have I Been Pwned loaded it on Sep 18, 2019.","tags":["data-breach","hibp","auth-tokens","email-addresses","genders","names","passwords","spoken-languages","usernames"],"title":"Lumin PDF data breach: 15.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/luminpdf-data-breach","vendor":"Lumin PDF"},{"auto":true,"category":"breach","closedAt":"2019-10-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MINEHUT"],"json":"https://helix.ml/threat-watch/i/minehut-data-breach.json","latestUpdate":{"date":"2019-09-17","title":"Have I Been Pwned loaded 396K breached Minehut accounts"},"patchStatus":"no-fix-needed","product":"minehut.com","severity":"high","severityNote":"396K accounts · passwords exposed","slug":"minehut-data-breach","stacks":[],"startedAt":"2019-09-17","status":"closed","summary":"In May 2019, the Minecraft server website Minehut suffered a data breach. The company advised a database backup had been obtained after which they subsequently notified all impacted users. 397k email addresses from the incident were provided to HIBP. A data set with both email addresses and bcrypt password hashes was also later provided to HIBP. Exposed data: email addresses, passwords. The breach dates from May 17, 2019; Have I Been Pwned loaded it on Sep 17, 2019.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Minehut data breach: 396K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/minehut-data-breach","vendor":"Minehut"},{"auto":true,"category":"breach","closedAt":"2019-10-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KIWIFARMS"],"json":"https://helix.ml/threat-watch/i/kiwifarms-data-breach.json","latestUpdate":{"date":"2019-09-17","title":"Have I Been Pwned loaded 4606 breached KiwiFarms accounts"},"patchStatus":"no-fix-needed","product":"kiwifarms.net","severity":"low","severityNote":"4606 accounts","slug":"kiwifarms-data-breach","stacks":[],"startedAt":"2019-09-17","status":"closed","summary":"In September 2019, the forum for discussing \"lolcows\" (people who can be milked for laughs) Kiwi Farms suffered a data breach. The disclosure notice advised that email and IP addresses, dates of birth and content created by members were all exposed in the incident. Exposed data: avatars, dates of birth, email addresses, ip addresses, website activity. The breach dates from Sep 10, 2019; Have I Been Pwned loaded it on Sep 17, 2019.","tags":["data-breach","hibp","avatars","dates-of-birth","email-addresses","ip-addresses","website-activity"],"title":"KiwiFarms data breach: 4606 accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/kiwifarms-data-breach","vendor":"KiwiFarms"},{"auto":true,"category":"breach","closedAt":"2019-09-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VOIDTO"],"json":"https://helix.ml/threat-watch/i/voidto-data-breach.json","latestUpdate":{"date":"2019-09-11","title":"Have I Been Pwned loaded 95K breached Void.to accounts"},"patchStatus":"no-fix-needed","product":"void.to","severity":"high","severityNote":"95K accounts · passwords exposed","slug":"voidto-data-breach","stacks":[],"startedAt":"2019-09-11","status":"closed","summary":"In June 2019, the hacking website Void.to suffered a data breach. There were 95k unique email addresses spread across 86k forum users and other tables in the database. A rival hacking website claimed responsibility for breaching the MyBB based forum which disclosed email and IP addresses, usernames, private messages and passwords stored as either salted MD5 or bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, private messages, usernames. The breach dates from Jun 13, 2019; Have I Been Pwned loaded it on Sep 11, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"Void.to data breach: 95K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/voidto-data-breach","vendor":"Void.to"},{"auto":true,"category":"breach","closedAt":"2019-09-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POSHMARK"],"json":"https://helix.ml/threat-watch/i/poshmark-data-breach.json","latestUpdate":{"date":"2019-09-02","title":"Have I Been Pwned loaded 36.4M breached Poshmark accounts"},"patchStatus":"no-fix-needed","product":"poshmark.com","severity":"high","severityNote":"36.4M accounts · passwords exposed","slug":"poshmark-data-breach","stacks":[],"startedAt":"2019-09-02","status":"closed","summary":"In mid-2018, social commerce marketplace Poshmark suffered a data breach that exposed 36M user accounts. The compromised data included email addresses, names, usernames, genders, locations and passwords stored as bcrypt hashes. Exposed data: email addresses, genders, geographic locations, names, passwords, usernames. The breach dates from May 16, 2018; Have I Been Pwned loaded it on Sep 2, 2019.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","names","passwords","usernames"],"title":"Poshmark data breach: 36.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/poshmark-data-breach","vendor":"Poshmark"},{"auto":true,"category":"breach","closedAt":"2019-09-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:XKCD"],"json":"https://helix.ml/threat-watch/i/xkcd-data-breach.json","latestUpdate":{"date":"2019-09-01","title":"Have I Been Pwned loaded 561K breached XKCD accounts"},"patchStatus":"no-fix-needed","product":"xkcd.com","severity":"high","severityNote":"561K accounts · passwords exposed","slug":"xkcd-data-breach","stacks":[],"startedAt":"2019-09-01","status":"closed","summary":"In July 2019, the forum for webcomic XKCD suffered a data breach that impacted 562k subscribers. The breached phpBB forum leaked usernames, email and IP addresses and passwords stored in MD5 phpBB3 format. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2019; Have I Been Pwned loaded it on Sep 1, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"XKCD data breach: 561K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/xkcd-data-breach","vendor":"XKCD"},{"auto":true,"category":"breach","closedAt":"2019-09-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MASTERCARDPRICELESSSPECIALS"],"json":"https://helix.ml/threat-watch/i/mastercardpricelessspecials-data-breach.json","latestUpdate":{"date":"2019-09-01","title":"Have I Been Pwned loaded 89K breached Mastercard Priceless Specials accounts"},"patchStatus":"no-fix-needed","product":"specials.mastercard.de","severity":"high","severityNote":"89K accounts · financial data exposed","slug":"mastercardpricelessspecials-data-breach","stacks":[],"startedAt":"2019-09-01","status":"closed","summary":"In August 2019, the German Mastercard bonus program \"Priceless Specials\" suffered a data breach. Personal data on almost 90k program members was subsequently extensively circulated online and included names, email and IP addresses, phone numbers and partial credit card data. Following the incident, the program was subsequently suspended. Exposed data: email addresses, ip addresses, names, partial credit card data, phone numbers, salutations. The breach dates from Aug 20, 2019; Have I Been Pwned loaded it on Sep 1, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","partial-credit-card-data","phone-numbers","salutations"],"title":"Mastercard Priceless Specials data breach: 89K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mastercardpricelessspecials-data-breach","vendor":"Mastercard Priceless Specials"},{"auto":true,"category":"breach","closedAt":"2019-09-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COINMAMA"],"json":"https://helix.ml/threat-watch/i/coinmama-data-breach.json","latestUpdate":{"date":"2019-08-30","title":"Have I Been Pwned loaded 478K breached Coinmama accounts"},"patchStatus":"no-fix-needed","product":"coinmama.com","severity":"high","severityNote":"478K accounts · passwords exposed","slug":"coinmama-data-breach","stacks":[],"startedAt":"2019-08-30","status":"closed","summary":"In August 2017, the crypto coin brokerage service Coinmama suffered a data breach that impacted 479k subscribers. The breach was discovered in February 2019 with exposed data including email addresses, usernames and passwords stored as MD5 WordPress hashes. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 3, 2017; Have I Been Pwned loaded it on Aug 30, 2019.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Coinmama data breach: 478K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/coinmama-data-breach","vendor":"Coinmama"},{"auto":true,"category":"breach","closedAt":"2019-08-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHEGG"],"json":"https://helix.ml/threat-watch/i/chegg-data-breach.json","latestUpdate":{"date":"2019-08-16","title":"Have I Been Pwned loaded 39.7M breached Chegg accounts"},"patchStatus":"no-fix-needed","product":"chegg.com","severity":"high","severityNote":"39.7M accounts · passwords exposed","slug":"chegg-data-breach","stacks":[],"startedAt":"2019-08-16","status":"closed","summary":"In April 2018, the textbook rental service Chegg suffered a data breach that impacted 40 million subscribers. The exposed data included email addresses, usernames, names and passwords stored as unsalted MD5 hashes. A small number of records also contained physical address or phone number. Exposed data: email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Apr 28, 2018; Have I Been Pwned loaded it on Aug 16, 2019.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Chegg data breach: 39.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/chegg-data-breach","vendor":"Chegg"},{"auto":true,"category":"breach","closedAt":"2019-08-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CRACKEDTO"],"json":"https://helix.ml/threat-watch/i/crackedto-data-breach.json","latestUpdate":{"date":"2019-08-12","title":"Have I Been Pwned loaded 749K breached Cracked.to accounts"},"patchStatus":"no-fix-needed","product":"cracked.to","severity":"high","severityNote":"749K accounts · passwords exposed","slug":"crackedto-data-breach","stacks":[],"startedAt":"2019-08-12","status":"closed","summary":"In July 2019, the hacking website Cracked.to suffered a data breach. There were 749k unique email addresses spread across 321k forum users and other tables in the database. A rival hacking website claimed responsibility for breaching the MyBB based forum which disclosed email and IP addresses, usernames, private messages and passwords stored as bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, private messages, usernames. The breach dates from Jul 21, 2019; Have I Been Pwned loaded it on Aug 12, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"Cracked.to data breach: 749K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/crackedto-data-breach","vendor":"Cracked.to"},{"auto":true,"category":"breach","closedAt":"2019-08-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STOCKX"],"json":"https://helix.ml/threat-watch/i/stockx-data-breach.json","latestUpdate":{"date":"2019-08-10","title":"Have I Been Pwned loaded 6.8M breached StockX accounts"},"patchStatus":"no-fix-needed","product":"stockx.com","severity":"high","severityNote":"6.8M accounts · passwords exposed","slug":"stockx-data-breach","stacks":[],"startedAt":"2019-08-10","status":"closed","summary":"In July 2019, the fashion and sneaker trading platform StockX suffered a data breach which was subsequently sold via a dark webmarketplace. The exposed data included 6.8 million unique email addresses, names, physical addresses, purchases and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, names, passwords, physical addresses, purchases, usernames. The breach dates from Jul 26, 2019; Have I Been Pwned loaded it on Aug 10, 2019.","tags":["data-breach","hibp","email-addresses","names","passwords","physical-addresses","purchases","usernames"],"title":"StockX data breach: 6.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/stockx-data-breach","vendor":"StockX"},{"auto":true,"category":"breach","closedAt":"2019-08-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CANVA"],"json":"https://helix.ml/threat-watch/i/canva-data-breach.json","latestUpdate":{"date":"2019-08-09","title":"Have I Been Pwned loaded 137.3M breached Canva accounts"},"patchStatus":"no-fix-needed","product":"canva.com","severity":"critical","severityNote":"137.3M accounts · passwords exposed","slug":"canva-data-breach","stacks":[],"startedAt":"2019-08-09","status":"closed","summary":"In May 2019, the graphic design tool website Canva suffered a data breach that impacted 137 million subscribers. The exposed data included email addresses, usernames, names, cities of residence and passwords stored as bcrypt hashes for users not using social logins. Exposed data: email addresses, geographic locations, names, passwords, usernames. The breach dates from May 24, 2019; Have I Been Pwned loaded it on Aug 9, 2019.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","usernames"],"title":"Canva data breach: 137.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/canva-data-breach","vendor":"Canva"},{"auto":true,"category":"breach","closedAt":"2019-08-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CAFEPRESS"],"json":"https://helix.ml/threat-watch/i/cafepress-data-breach.json","latestUpdate":{"date":"2019-08-05","title":"Have I Been Pwned loaded 23.2M breached CafePress accounts"},"patchStatus":"no-fix-needed","product":"cafepress.com","severity":"high","severityNote":"23.2M accounts · passwords exposed","slug":"cafepress-data-breach","stacks":[],"startedAt":"2019-08-05","status":"closed","summary":"In February 2019, the custom merchandise retailer CafePress suffered a data breach. The exposed data included 23 million unique email addresses with some records also containing names, physical addresses, phone numbers and passwords stored as SHA-1 hashes. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Feb 20, 2019; Have I Been Pwned loaded it on Aug 5, 2019.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"CafePress data breach: 23.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cafepress-data-breach","vendor":"CafePress"},{"auto":true,"category":"breach","closedAt":"2019-08-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CLUBPENGUINREWRITTENJUL2019"],"json":"https://helix.ml/threat-watch/i/clubpenguinrewrittenjul2019-data-breach.json","latestUpdate":{"date":"2019-07-30","title":"Have I Been Pwned loaded 4.0M breached Club Penguin Rewritten (July 2019) accounts"},"patchStatus":"no-fix-needed","product":"cprewritten.net","severity":"high","severityNote":"4.0M accounts · passwords exposed","slug":"clubpenguinrewrittenjul2019-data-breach","stacks":[],"startedAt":"2019-07-30","status":"closed","summary":"In July 2019, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). In addition to an earlier data breach that impacted 1.7 million accounts, the subsequent breach exposed 4 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 27, 2019; Have I Been Pwned loaded it on Jul 30, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Club Penguin Rewritten (July 2019) data breach: 4.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/clubpenguinrewrittenjul2019-data-breach","vendor":"Club Penguin Rewritten (July 2019)"},{"auto":true,"category":"breach","closedAt":"2019-08-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANIMEPLANET"],"json":"https://helix.ml/threat-watch/i/animeplanet-data-breach.json","latestUpdate":{"date":"2019-07-28","title":"Have I Been Pwned loaded 368K breached Anime-Planet accounts"},"patchStatus":"no-fix-needed","product":"anime-planet.com","severity":"high","severityNote":"368K accounts · passwords exposed","slug":"animeplanet-data-breach","stacks":[],"startedAt":"2019-07-28","status":"closed","summary":"In approximately 2016, the anime website Anime-Planet suffered a data breach that impacted 369k subscribers. The exposed data included usernames, IP and email addresses, dates of birth and passwords stored as unsalted MD5 hashes and for newer accounts, bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Jul 28, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Anime-Planet data breach: 368K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/animeplanet-data-breach","vendor":"Anime-Planet"},{"auto":true,"category":"breach","closedAt":"2019-08-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SNAIL"],"json":"https://helix.ml/threat-watch/i/snail-data-breach.json","latestUpdate":{"date":"2019-07-27","title":"Have I Been Pwned loaded 1.4M breached Snail accounts"},"patchStatus":"no-fix-needed","product":"snail.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"snail-data-breach","stacks":[],"startedAt":"2019-07-27","status":"closed","summary":"In March 2015, the gaming website Snail suffered a data breach that impacted 1.4 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Mar 14, 2015; Have I Been Pwned loaded it on Jul 27, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Snail data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/snail-data-breach","vendor":"Snail"},{"auto":true,"category":"breach","closedAt":"2019-08-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CLASHOFKINGS"],"json":"https://helix.ml/threat-watch/i/clashofkings-data-breach.json","latestUpdate":{"date":"2019-07-27","title":"Have I Been Pwned loaded 1.6M breached Clash of Kings accounts"},"patchStatus":"no-fix-needed","product":"f.elex.com","severity":"high","severityNote":"1.6M accounts · passwords exposed","slug":"clashofkings-data-breach","stacks":[],"startedAt":"2019-07-27","status":"closed","summary":"In July 2016, the forum for the game \"Clash of Kings\" suffered a data breach that impacted 1.6 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 14, 2016; Have I Been Pwned loaded it on Jul 27, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Clash of Kings data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/clashofkings-data-breach","vendor":"Clash of Kings"},{"auto":true,"category":"breach","closedAt":"2019-08-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EPICNPC"],"json":"https://helix.ml/threat-watch/i/epicnpc-data-breach.json","latestUpdate":{"date":"2019-07-27","title":"Have I Been Pwned loaded 408K breached EpicNPC accounts"},"patchStatus":"no-fix-needed","product":"epicnpc.com","severity":"high","severityNote":"408K accounts · passwords exposed","slug":"epicnpc-data-breach","stacks":[],"startedAt":"2019-07-27","status":"closed","summary":"In January 2016, the hacked account reseller EpicNPC suffered a data breach that impacted 409k subscribers. The impacted data included usernames, IP and email addresses and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 2, 2016; Have I Been Pwned loaded it on Jul 27, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"EpicNPC data breach: 408K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/epicnpc-data-breach","vendor":"EpicNPC"},{"auto":true,"category":"breach","closedAt":"2019-08-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMESALAD"],"json":"https://helix.ml/threat-watch/i/gamesalad-data-breach.json","latestUpdate":{"date":"2019-07-21","title":"Have I Been Pwned loaded 1.5M breached GameSalad accounts"},"patchStatus":"no-fix-needed","product":"gamesalad.com","severity":"high","severityNote":"1.5M accounts · passwords exposed","slug":"gamesalad-data-breach","stacks":[],"startedAt":"2019-07-21","status":"closed","summary":"In February 2019, the education and game creation website Game Salad suffered a data breach. The incident impacted 1.5M accounts and exposed email addresses, usernames, IP addresses and passwords stored as SHA-256 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Feb 24, 2019; Have I Been Pwned loaded it on Jul 21, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"GameSalad data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gamesalad-data-breach","vendor":"GameSalad"},{"auto":true,"category":"breach","closedAt":"2019-08-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STRONGHOLDKINGDOMS"],"json":"https://helix.ml/threat-watch/i/strongholdkingdoms-data-breach.json","latestUpdate":{"date":"2019-07-21","title":"Have I Been Pwned loaded 5.2M breached Stronghold Kingdoms accounts"},"patchStatus":"no-fix-needed","product":"strongholdkingdoms.com","severity":"high","severityNote":"5.2M accounts · passwords exposed","slug":"strongholdkingdoms-data-breach","stacks":[],"startedAt":"2019-07-21","status":"closed","summary":"In July 2018, the massive multiplayer online game Stronghold Kingdoms suffered a data breach. Almost 5.2 million accounts were impacted by the incident which exposed emails addresses, usernames and passwords stored as salted SHA-1 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 4, 2018; Have I Been Pwned loaded it on Jul 21, 2019.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Stronghold Kingdoms data breach: 5.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/strongholdkingdoms-data-breach","vendor":"Stronghold Kingdoms"},{"auto":true,"category":"breach","closedAt":"2019-08-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLASHFLASHREVOLUTION2019"],"json":"https://helix.ml/threat-watch/i/flashflashrevolution2019-data-breach.json","latestUpdate":{"date":"2019-07-21","title":"Have I Been Pwned loaded 1.9M breached Flash Flash Revolution (2019 breach) accounts"},"patchStatus":"no-fix-needed","product":"flashflashrevolution.com","severity":"high","severityNote":"1.9M accounts · passwords exposed","slug":"flashflashrevolution2019-data-breach","stacks":[],"startedAt":"2019-07-21","status":"closed","summary":"In July 2019, the music-based rhythm game Flash Flash Revolution suffered a data breach. The 2019 breach imapcted almost 1.9 million members and is in addition to the 2016 data breach of the same service. Email and IP addesses, usernames, dates of birth and salted MD5 hashes were all exposed in the breach. The data was provided with support from dehashed.com. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jul 16, 2019; Have I Been Pwned loaded it on Jul 21, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Flash Flash Revolution (2019 breach) data breach: 1.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/flashflashrevolution2019-data-breach","vendor":"Flash Flash Revolution (2019 breach)"},{"auto":true,"category":"breach","closedAt":"2019-08-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ARMORGAMES"],"json":"https://helix.ml/threat-watch/i/armorgames-data-breach.json","latestUpdate":{"date":"2019-07-20","title":"Have I Been Pwned loaded 10.6M breached Armor Games accounts"},"patchStatus":"no-fix-needed","product":"armorgames.com","severity":"high","severityNote":"10.6M accounts · passwords exposed","slug":"armorgames-data-breach","stacks":[],"startedAt":"2019-07-20","status":"closed","summary":"In January 2019, the game portal website Armor Games suffered a data breach. A total of 10.6 million email addresses were impacted by the breach which also exposed usernames, IP addresses, birthdays of administrator accounts and passwords stored as salted SHA-1 hashes. Exposed data: bios, dates of birth, email addresses, genders, geographic locations, ip addresses, passwords, usernames. The breach dates from Jan 1, 2019; Have I Been Pwned loaded it on Jul 20, 2019.","tags":["data-breach","hibp","bios","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","passwords","usernames"],"title":"Armor Games data breach: 10.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/armorgames-data-breach","vendor":"Armor Games"},{"auto":true,"category":"breach","closedAt":"2019-08-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EATSTREET"],"json":"https://helix.ml/threat-watch/i/eatstreet-data-breach.json","latestUpdate":{"date":"2019-07-19","title":"Have I Been Pwned loaded 6.4M breached EatStreet accounts"},"patchStatus":"no-fix-needed","product":"eatstreet.com","severity":"high","severityNote":"6.4M accounts · passwords exposed · financial data exposed","slug":"eatstreet-data-breach","stacks":[],"startedAt":"2019-07-19","status":"closed","summary":"In May 2019, the online food ordering service EatStreet suffered a data breach affecting 6.4 million customers. An extensive amount of personal data was obtained including names, phone numbers, addresses, partial credit card data and passwords stored as bcrypt hashes. Exposed data: dates of birth, email addresses, genders, names, partial credit card data, passwords, phone numbers, physical addresses, social media profiles. The breach dates from May 3, 2019; Have I Been Pwned loaded it on Jul 19, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","partial-credit-card-data","passwords","phone-numbers","physical-addresses","social-media-profiles"],"title":"EatStreet data breach: 6.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/eatstreet-data-breach","vendor":"EatStreet"},{"auto":true,"category":"breach","closedAt":"2019-08-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ARTVALUE"],"json":"https://helix.ml/threat-watch/i/artvalue-data-breach.json","latestUpdate":{"date":"2019-07-19","title":"Have I Been Pwned loaded 157K breached Artvalue.com accounts"},"patchStatus":"no-fix-needed","product":"artvalue.com","severity":"high","severityNote":"157K accounts · passwords exposed","slug":"artvalue-data-breach","stacks":[],"startedAt":"2019-07-19","status":"closed","summary":"In June 2019, the France-based art valuation website Artvalue.com (now defunct) left their 158k member subscriber base publicly exposed in a text file on their website. The exposed data included names, usernames, email addresses and passwords stored as MD5 hashes. The site operator did not respond when contacted about the incident, although the exposed file was subsequently removed. Exposed data: email addresses, names, passwords, salutations, usernames. The breach dates from Jun 19, 2019; Have I Been Pwned loaded it on Jul 19, 2019.","tags":["data-breach","hibp","email-addresses","names","passwords","salutations","usernames"],"title":"Artvalue.com data breach: 157K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/artvalue-data-breach","vendor":"Artvalue.com"},{"auto":true,"category":"breach","closedAt":"2019-08-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROLL20"],"json":"https://helix.ml/threat-watch/i/roll20-data-breach.json","latestUpdate":{"date":"2019-07-19","title":"Have I Been Pwned loaded 4.0M breached Roll20 accounts"},"patchStatus":"no-fix-needed","product":"roll20.net","severity":"high","severityNote":"4.0M accounts · passwords exposed · financial data exposed","slug":"roll20-data-breach","stacks":[],"startedAt":"2019-07-19","status":"closed","summary":"In December 2018, the tabletop role-playing games website Roll20 suffered a data breach. Almost 4 million customers were impacted by the breach and had email and IP addresses, names, bcrypt hashes of passwords and the last 4 digits of credit cards exposed. Exposed data: email addresses, ip addresses, names, partial credit card data, passwords. The breach dates from Dec 26, 2018; Have I Been Pwned loaded it on Jul 19, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","partial-credit-card-data","passwords"],"title":"Roll20 data breach: 4.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/roll20-data-breach","vendor":"Roll20"},{"auto":true,"category":"breach","closedAt":"2019-08-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANIMOTO"],"json":"https://helix.ml/threat-watch/i/animoto-data-breach.json","latestUpdate":{"date":"2019-07-18","title":"Have I Been Pwned loaded 22.4M breached Animoto accounts"},"patchStatus":"no-fix-needed","product":"animoto.com","severity":"high","severityNote":"22.4M accounts · passwords exposed","slug":"animoto-data-breach","stacks":[],"startedAt":"2019-07-18","status":"closed","summary":"In July 2018, the cloud-based video making service Animoto suffered a data breach. The breach exposed 22 million unique email addresses alongside names, dates of birth, country of origin and salted password hashes. Exposed data: dates of birth, email addresses, geographic locations, names, passwords. The breach dates from Jul 10, 2018; Have I Been Pwned loaded it on Jul 18, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","names","passwords"],"title":"Animoto data breach: 22.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/animoto-data-breach","vendor":"Animoto"},{"auto":true,"category":"breach","closedAt":"2019-08-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YOUNOW"],"json":"https://helix.ml/threat-watch/i/younow-data-breach.json","latestUpdate":{"date":"2019-07-18","title":"Have I Been Pwned loaded 18.2M breached YouNow accounts"},"patchStatus":"no-fix-needed","product":"younow.com","severity":"medium","severityNote":"18.2M accounts","slug":"younow-data-breach","stacks":[],"startedAt":"2019-07-18","status":"closed","summary":"In February 2019, data from the live broadcasting service YouNow appeared for sale on a dark web marketplace. Whilst it's not clear what date the actual breach occurred on, the impacted data included 18M unique email addresses, IP addresses, names, usernames and links to social media profiles. As authentication is performed via social providers, no passwords were exposed in the breach. Many records didn't have associated email addresses thus the unique number is lower than the reported total number of accounts. Exposed data: email addresses, ip addresses, names, social media profiles, usernames. The breach dates from Feb 15, 2019; Have I Been Pwned loaded it on Jul 18, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","social-media-profiles","usernames"],"title":"YouNow data breach: 18.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/younow-data-breach","vendor":"YouNow"},{"auto":true,"category":"breach","closedAt":"2019-08-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BULGARIANNATIONALREVENUEAGENCY"],"json":"https://helix.ml/threat-watch/i/bulgariannationalrevenueagency-data-breach.json","latestUpdate":{"date":"2019-07-18","title":"Have I Been Pwned loaded 471K breached Bulgarian National Revenue Agency accounts"},"patchStatus":"no-fix-needed","product":"nap.bg","severity":"medium","severityNote":"471K accounts","slug":"bulgariannationalrevenueagency-data-breach","stacks":[],"startedAt":"2019-07-18","status":"closed","summary":"In July 2019, a massive data breach of the Bulgarian National Revenue Agency began circulating with data on 5 million people. Allegedly obtained in June, the data was broadly shared online and included taxation information alongside names, phone numbers, physical addresses and 471 thousand unique email addresses. The breach is said to have affected \"nearly all adults in Bulgaria\". Exposed data: email addresses, names, phone numbers, physical addresses, taxation records. The breach dates from Jul 15, 2019; Have I Been Pwned loaded it on Jul 18, 2019.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses","taxation-records"],"title":"Bulgarian National Revenue Agency data breach: 471K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bulgariannationalrevenueagency-data-breach","vendor":"Bulgarian National Revenue Agency"},{"auto":true,"category":"breach","closedAt":"2019-07-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHEIN"],"json":"https://helix.ml/threat-watch/i/shein-data-breach.json","latestUpdate":{"date":"2019-07-17","title":"Have I Been Pwned loaded 39.1M breached SHEIN accounts"},"patchStatus":"no-fix-needed","product":"shein.com","severity":"high","severityNote":"39.1M accounts · passwords exposed","slug":"shein-data-breach","stacks":[],"startedAt":"2019-07-17","status":"closed","summary":"In June 2018, online fashion retailer SHEIN suffered a data breach. The company discovered the breach 2 months later in August then disclosed the incident another month after that. A total of 39 million unique email addresses were found in the breach alongside MD5 password hashes. Exposed data: email addresses, passwords. The breach dates from Jun 1, 2018; Have I Been Pwned loaded it on Jul 17, 2019.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"SHEIN data breach: 39.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/shein-data-breach","vendor":"SHEIN"},{"auto":true,"category":"breach","closedAt":"2019-07-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BLACKSPIGOTMC"],"json":"https://helix.ml/threat-watch/i/blackspigotmc-data-breach.json","latestUpdate":{"date":"2019-07-17","title":"Have I Been Pwned loaded 140K breached BlackSpigotMC accounts"},"patchStatus":"no-fix-needed","product":"blackspigot.com","severity":"high","severityNote":"140K accounts · passwords exposed","slug":"blackspigotmc-data-breach","stacks":[],"startedAt":"2019-07-17","status":"closed","summary":"In July 2019, the hacking website BlackSpigotMC suffered a data breach. The XenForo forum based site was allegedly compromised by a rival hacking website and resulted in 8.5GB of data being leaked including the database and website itself. The exposed data included 140k unique email addresses, usernames, IP addresses, genders, geographic locations and passwords stored as bcrypt hashes. Exposed data: device information, email addresses, genders, geographic locations, ip addresses, passwords, usernames. The breach dates from Jul 14, 2019; Have I Been Pwned loaded it on Jul 17, 2019.","tags":["data-breach","hibp","device-information","email-addresses","genders","geographic-locations","ip-addresses","passwords","usernames"],"title":"BlackSpigotMC data breach: 140K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/blackspigotmc-data-breach","vendor":"BlackSpigotMC"},{"auto":true,"category":"breach","closedAt":"2019-07-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PIZAP"],"json":"https://helix.ml/threat-watch/i/pizap-data-breach.json","latestUpdate":{"date":"2019-07-16","title":"Have I Been Pwned loaded 41.8M breached piZap accounts"},"patchStatus":"no-fix-needed","product":"pizap.com","severity":"high","severityNote":"41.8M accounts · passwords exposed","slug":"pizap-data-breach","stacks":[],"startedAt":"2019-07-16","status":"closed","summary":"In approximately December 2017, the online photo editing site piZap suffered a data breach. The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in February 2019. A total of 42 million unique email addresses were included in the breach alongside names, genders and links to Facebook profiles when the social media platform was used to authenticate to piZap. When accounts were created directly on piZap without using Facebook for authentication, passwords stored as SHA-1 hashes were also exposed. Exposed data: email addresses, genders, geographic locations, names, passwords, social media profiles, usernames, website activity. The breach dates from Dec 7, 2017; Have I Been Pwned loaded it on Jul 16, 2019.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","names","passwords","social-media-profiles","usernames","website-activity"],"title":"piZap data breach: 41.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/pizap-data-breach","vendor":"piZap"},{"auto":true,"category":"breach","closedAt":"2019-07-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NETLOG"],"json":"https://helix.ml/threat-watch/i/netlog-data-breach.json","latestUpdate":{"date":"2019-07-15","title":"Have I Been Pwned loaded 49.0M breached Netlog accounts"},"patchStatus":"no-fix-needed","product":"netlog.com","severity":"high","severityNote":"49.0M accounts · passwords exposed","slug":"netlog-data-breach","stacks":[],"startedAt":"2019-07-15","status":"closed","summary":"In July 2018, the Belgian social networking site Netlog identified a data breach of their systems dating back to November 2012 (PDF). Although the service was discontinued in 2015, the data breach still impacted 49 million subscribers for whom email addresses and plain text passwords were exposed. Exposed data: email addresses, passwords. The breach dates from Nov 1, 2012; Have I Been Pwned loaded it on Jul 15, 2019.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Netlog data breach: 49.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/netlog-data-breach","vendor":"Netlog"},{"auto":true,"category":"breach","closedAt":"2019-07-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EVITE"],"json":"https://helix.ml/threat-watch/i/evite-data-breach.json","latestUpdate":{"date":"2019-07-14","title":"Have I Been Pwned loaded 101.0M breached Evite accounts"},"patchStatus":"no-fix-needed","product":"evite.com","severity":"critical","severityNote":"101.0M accounts · passwords exposed","slug":"evite-data-breach","stacks":[],"startedAt":"2019-07-14","status":"closed","summary":"In April 2019, the social planning website for managing online invitations Evite identified a data breach of their systems. Upon investigation, they found unauthorised access to a database archive dating back to 2013. The exposed data included a total of 101 million unique email addresses, most belonging to recipients of invitations. Members of the service also had names, phone numbers, physical addresses, dates of birth, genders and passwords stored in plain text exposed. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses. The breach dates from Aug 11, 2013; Have I Been Pwned loaded it on Jul 14, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses"],"title":"Evite data breach: 101.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/evite-data-breach","vendor":"Evite"},{"auto":true,"category":"breach","closedAt":"2019-07-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MINDJOLT"],"json":"https://helix.ml/threat-watch/i/mindjolt-data-breach.json","latestUpdate":{"date":"2019-07-13","title":"Have I Been Pwned loaded 28.4M breached Mindjolt accounts"},"patchStatus":"no-fix-needed","product":"mindjolt.com","severity":"medium","severityNote":"28.4M accounts","slug":"mindjolt-data-breach","stacks":[],"startedAt":"2019-07-13","status":"closed","summary":"In March 2019, the online gaming website MindJolt suffered a data breach that exposed 28M unique email addresses. Also impacted were names and dates of birth, but no passwords. Exposed data: dates of birth, email addresses, names. The breach dates from Mar 18, 2019; Have I Been Pwned loaded it on Jul 13, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names"],"title":"Mindjolt data breach: 28.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mindjolt-data-breach","vendor":"Mindjolt"},{"auto":true,"category":"breach","closedAt":"2019-07-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WIENERBUCHEREIEN"],"json":"https://helix.ml/threat-watch/i/wienerbuchereien-data-breach.json","latestUpdate":{"date":"2019-06-28","title":"Have I Been Pwned loaded 224K breached Wiener Büchereien accounts"},"patchStatus":"no-fix-needed","product":"Wiener Büchereien","severity":"medium","severityNote":"224K accounts","slug":"wienerbuchereien-data-breach","stacks":[],"startedAt":"2019-06-28","status":"closed","summary":"In June 2019, the library of Vienna (Wiener Büchereien) suffered a data breach. The compromised data included 224k unique email addresses, names, physical addresses, phone numbers and dates of birth. The breached data was subsequently posted to Twitter by the alleged perpetrator of the breach. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Jun 10, 2019; Have I Been Pwned loaded it on Jun 28, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","phone-numbers","physical-addresses"],"title":"Wiener Büchereien data breach: 224K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wienerbuchereien-data-breach","vendor":"Wiener Büchereien"},{"auto":true,"category":"breach","closedAt":"2019-07-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SOCIALENGINEERED"],"json":"https://helix.ml/threat-watch/i/socialengineered-data-breach.json","latestUpdate":{"date":"2019-06-23","title":"Have I Been Pwned loaded 89K breached Social Engineered accounts"},"patchStatus":"no-fix-needed","product":"socialengineered.net","severity":"high","severityNote":"89K accounts · passwords exposed","slug":"socialengineered-data-breach","stacks":[],"startedAt":"2019-06-23","status":"closed","summary":"In June 2019, the \"Art of Human Hacking\" site Social Engineered suffered a data breach. The breach of the MyBB forum was published on a rival hacking forum and included 89k unique email addresses spread across 55k forum users and other tables in the database. The exposed data also included usernames, IP addresses, private messages and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, private messages, usernames. The breach dates from Jun 13, 2019; Have I Been Pwned loaded it on Jun 23, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"Social Engineered data breach: 89K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/socialengineered-data-breach","vendor":"Social Engineered"},{"auto":true,"category":"breach","closedAt":"2019-06-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:D3SCENE"],"json":"https://helix.ml/threat-watch/i/d3scene-data-breach.json","latestUpdate":{"date":"2019-06-15","title":"Have I Been Pwned loaded 568K breached D3Scene accounts"},"patchStatus":"no-fix-needed","product":"d3scene.com","severity":"high","severityNote":"568K accounts · passwords exposed","slug":"d3scene-data-breach","stacks":[],"startedAt":"2019-06-15","status":"closed","summary":"In January 2016, the gaming website D3Scene, suffered a data breach. The compromised vBulletin forum exposed 569k million email addresses, IP address, usernames and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Jun 15, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"D3Scene data breach: 568K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/d3scene-data-breach","vendor":"D3Scene"},{"auto":true,"category":"breach","closedAt":"2019-06-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EMUPARADISE"],"json":"https://helix.ml/threat-watch/i/emuparadise-data-breach.json","latestUpdate":{"date":"2019-06-09","title":"Have I Been Pwned loaded 1.1M breached Emuparadise accounts"},"patchStatus":"no-fix-needed","product":"emuparadise.me","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"emuparadise-data-breach","stacks":[],"startedAt":"2019-06-09","status":"closed","summary":"In April 2018, the self-proclaimed \"biggest retro gaming website on earth\", Emuparadise, suffered a data breach. The compromised vBulletin forum exposed 1.1 million email addresses, IP address, usernames and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 1, 2018; Have I Been Pwned loaded it on Jun 9, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Emuparadise data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/emuparadise-data-breach","vendor":"Emuparadise"},{"auto":true,"category":"breach","closedAt":"2019-06-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ORDINEAVVOCATIDIROMA"],"json":"https://helix.ml/threat-watch/i/ordineavvocatidiroma-data-breach.json","latestUpdate":{"date":"2019-05-26","title":"Have I Been Pwned loaded 41K breached Ordine Avvocati di Roma accounts"},"patchStatus":"no-fix-needed","product":"ordineavvocatiroma.it","severity":"high","severityNote":"41K accounts · passwords exposed","slug":"ordineavvocatidiroma-data-breach","stacks":[],"startedAt":"2019-05-26","status":"closed","summary":"In May 2019, the Lawyers Order of Rome suffered a data breach by a group claiming to be Anonymous Italy. Data on tens of thousands of Roman lawyers was taken from the breached system and redistributed online. The data included contact information, email addresses and email messages themselves encompassing tens of thousands of unique email addresses. A total of 42k unique addresses appeared in the breach. Exposed data: email addresses, email messages, geographic locations, passwords, phone numbers. The breach dates from May 7, 2019; Have I Been Pwned loaded it on May 26, 2019.","tags":["data-breach","hibp","email-addresses","email-messages","geographic-locations","passwords","phone-numbers"],"title":"Ordine Avvocati di Roma data breach: 41K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ordineavvocatidiroma-data-breach","vendor":"Ordine Avvocati di Roma"},{"auto":true,"category":"breach","closedAt":"2019-06-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OGUSERS"],"json":"https://helix.ml/threat-watch/i/ogusers-data-breach.json","latestUpdate":{"date":"2019-05-19","title":"Have I Been Pwned loaded 161K breached OGUsers (2019 breach) accounts"},"patchStatus":"no-fix-needed","product":"ogusers.com","severity":"high","severityNote":"161K accounts · passwords exposed","slug":"ogusers-data-breach","stacks":[],"startedAt":"2019-05-19","status":"closed","summary":"In May 2019, the account hijacking and SIM swapping forum OGusers suffered a data breach. The breach exposed a database backup from December 2018 which was published on a rival hacking forum. There were 161k unique email addresses spread across 113k forum users and other tables in the database. The exposed data also included usernames, IP addresses, private messages and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, private messages, usernames. The breach dates from Dec 26, 2018; Have I Been Pwned loaded it on May 19, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames"],"title":"OGUsers (2019 breach) data breach: 161K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ogusers-data-breach","vendor":"OGUsers (2019 breach)"},{"auto":true,"category":"breach","closedAt":"2019-05-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:APPARTOO"],"json":"https://helix.ml/threat-watch/i/appartoo-data-breach.json","latestUpdate":{"date":"2019-05-02","title":"Have I Been Pwned loaded 49K breached Appartoo accounts"},"patchStatus":"no-fix-needed","product":"appartoo.com","severity":"high","severityNote":"49K accounts · passwords exposed","slug":"appartoo-data-breach","stacks":[],"startedAt":"2019-05-02","status":"closed","summary":"In March 2017, the French Flatsharing site known as Appartoo suffered a data breach. The incident exposed an extensive amount of personal information on almost 50k members including email addresses, genders, ages, private messages sent between users of the service and passwords stored as SHA-256 hashes. Appartoo advised that all subscribers were notified of the incident in early 2017. Exposed data: ages, auth tokens, email addresses, employment statuses, genders, ip addresses, marital statuses, names, passwords, physical addresses, private messages, social media profiles. The breach dates from Mar 25, 2017; Have I Been Pwned loaded it on May 2, 2019.","tags":["data-breach","hibp","ages","auth-tokens","email-addresses","employment-statuses","genders","ip-addresses","marital-statuses","names","passwords","physical-addresses","private-messages","social-media-profiles"],"title":"Appartoo data breach: 49K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/appartoo-data-breach","vendor":"Appartoo"},{"auto":true,"category":"breach","closedAt":"2019-05-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CLUBPENGUINREWRITTEN"],"json":"https://helix.ml/threat-watch/i/clubpenguinrewritten-data-breach.json","latestUpdate":{"date":"2019-04-23","title":"Have I Been Pwned loaded 1.7M breached Club Penguin Rewritten (January 2018) accounts"},"patchStatus":"no-fix-needed","product":"cprewritten.net","severity":"high","severityNote":"1.7M accounts · passwords exposed","slug":"clubpenguinrewritten-data-breach","stacks":[],"startedAt":"2019-04-23","status":"closed","summary":"In January 2018, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). The incident exposed almost 1.7 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes. When contacted, CPRewritten advised they were aware of the breach and had \"contacted affected users\". Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 21, 2018; Have I Been Pwned loaded it on Apr 23, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Club Penguin Rewritten (January 2018) data breach: 1.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/clubpenguinrewritten-data-breach","vendor":"Club Penguin Rewritten (January 2018)"},{"auto":true,"category":"breach","closedAt":"2019-05-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MORELENET"],"json":"https://helix.ml/threat-watch/i/morelenet-data-breach.json","latestUpdate":{"date":"2019-04-20","title":"Have I Been Pwned loaded 2.5M breached Morele.net accounts"},"patchStatus":"no-fix-needed","product":"morele.net","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"morelenet-data-breach","stacks":[],"startedAt":"2019-04-20","status":"closed","summary":"In October 2018, the Polish e-commerce website Morele.net suffered a data breach. The incident exposed almost 2.5 million unique email addresses alongside phone numbers, names and passwords stored as md5crypt hashes. Exposed data: email addresses, names, passwords, phone numbers. The breach dates from Oct 10, 2018; Have I Been Pwned loaded it on Apr 20, 2019.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers"],"title":"Morele.net data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/morelenet-data-breach","vendor":"Morele.net"},{"auto":true,"category":"breach","closedAt":"2019-05-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BUKALAPAK"],"json":"https://helix.ml/threat-watch/i/bukalapak-data-breach.json","latestUpdate":{"date":"2019-04-18","title":"Have I Been Pwned loaded 13.4M breached Bukalapak accounts"},"patchStatus":"no-fix-needed","product":"bukalapak.com","severity":"high","severityNote":"13.4M accounts · passwords exposed","slug":"bukalapak-data-breach","stacks":[],"startedAt":"2019-04-18","status":"closed","summary":"In March 2019, the Indonesian e-commerce website Bukalapak discovered a data breach of the organisation's backups dating back to October 2017. The incident exposed approximately 13 million unique email addresses alongside IP addresses, names and passwords stored as bcrypt and salted SHA-512 hashes. Exposed data: email addresses, ip addresses, names, passwords, usernames. The breach dates from Oct 23, 2017; Have I Been Pwned loaded it on Apr 18, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","usernames"],"title":"Bukalapak data breach: 13.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bukalapak-data-breach","vendor":"Bukalapak"},{"auto":true,"category":"breach","closedAt":"2019-04-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DATACAMP"],"json":"https://helix.ml/threat-watch/i/datacamp-data-breach.json","latestUpdate":{"date":"2019-04-09","title":"Have I Been Pwned loaded 760K breached DataCamp accounts"},"patchStatus":"no-fix-needed","product":"datacamp.com","severity":"high","severityNote":"760K accounts · passwords exposed","slug":"datacamp-data-breach","stacks":[],"startedAt":"2019-04-09","status":"closed","summary":"In December 2018, the data science website DataCamp suffered a data breach of records dating back to January 2017. The incident exposed 760k unique email and IP addresses along with names and passwords stored as bcrypt hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. Exposed data: email addresses, geographic locations, ip addresses, names, passwords. The breach dates from Jan 30, 2017; Have I Been Pwned loaded it on Apr 9, 2019.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","names","passwords"],"title":"DataCamp data breach: 760K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/datacamp-data-breach","vendor":"DataCamp"},{"auto":true,"category":"breach","closedAt":"2019-04-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KNUDDELS"],"json":"https://helix.ml/threat-watch/i/knuddels-data-breach.json","latestUpdate":{"date":"2019-04-08","title":"Have I Been Pwned loaded 808K breached Knuddels accounts"},"patchStatus":"no-fix-needed","product":"knuddels.de","severity":"high","severityNote":"808K accounts · passwords exposed","slug":"knuddels-data-breach","stacks":[],"startedAt":"2019-04-08","status":"closed","summary":"In September 2018, the German social media website Knuddels suffered a data breach. The incident exposed 808k unique email addresses alongside usernames, real names, the city of the person and their password in plain text. Knuddels was subsequently fined €20k for the breach. Exposed data: email addresses, geographic locations, names, passwords, usernames. The breach dates from Sep 5, 2018; Have I Been Pwned loaded it on Apr 8, 2019.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","usernames"],"title":"Knuddels data breach: 808K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/knuddels-data-breach","vendor":"Knuddels"},{"auto":true,"category":"breach","closedAt":"2019-04-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DEMONFORUMS"],"json":"https://helix.ml/threat-watch/i/demonforums-data-breach.json","latestUpdate":{"date":"2019-04-04","title":"Have I Been Pwned loaded 52K breached Demon Forums accounts"},"patchStatus":"no-fix-needed","product":"demonforums.net","severity":"high","severityNote":"52K accounts · passwords exposed","slug":"demonforums-data-breach","stacks":[],"startedAt":"2019-04-04","status":"closed","summary":"In February 2019, the hacking forum Demon Forums suffered a data breach. The compromise of the vBulletin forum exposed 52k unique email addresses alongside usernames and passwords stored as salted MD5 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Feb 20, 2019; Have I Been Pwned loaded it on Apr 4, 2019.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Demon Forums data breach: 52K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/demonforums-data-breach","vendor":"Demon Forums"},{"auto":true,"category":"breach","closedAt":"2019-04-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EVERYBODYEDITS"],"json":"https://helix.ml/threat-watch/i/everybodyedits-data-breach.json","latestUpdate":{"date":"2019-04-03","title":"Have I Been Pwned loaded 871K breached Everybody Edits accounts"},"patchStatus":"no-fix-needed","product":"everybodyedits.com","severity":"medium","severityNote":"871K accounts","slug":"everybodyedits-data-breach","stacks":[],"startedAt":"2019-04-03","status":"closed","summary":"In March 2019, the multiplayer platform game Everybody Edits suffered a data breach. The incident exposed 871k unique email addresses alongside usernames and IP addresses. The data was subsequently distributed online across a collection of files. Exposed data: email addresses, ip addresses, usernames. The breach dates from Mar 23, 2019; Have I Been Pwned loaded it on Apr 3, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","usernames"],"title":"Everybody Edits data breach: 871K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/everybodyedits-data-breach","vendor":"Everybody Edits"},{"auto":true,"category":"breach","closedAt":"2019-04-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WHITEPAGES"],"json":"https://helix.ml/threat-watch/i/whitepages-data-breach.json","latestUpdate":{"date":"2019-03-27","title":"Have I Been Pwned loaded 11.7M breached Whitepages accounts"},"patchStatus":"no-fix-needed","product":"whitepages.com","severity":"high","severityNote":"11.7M accounts · passwords exposed","slug":"whitepages-data-breach","stacks":[],"startedAt":"2019-03-27","status":"closed","summary":"In mid-2016, the telephone and address directory service Whitepages was among a raft of sites that were breached and their data then sold in early-2019. The data included over 11 million unique email addresses alongside names and passwords stored as either a SHA-1 or bcrypt hash. Exposed data: email addresses, names, passwords. The breach dates from Jun 27, 2016; Have I Been Pwned loaded it on Mar 27, 2019.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"Whitepages data breach: 11.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/whitepages-data-breach","vendor":"Whitepages"},{"auto":true,"category":"breach","closedAt":"2019-04-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:500PX"],"json":"https://helix.ml/threat-watch/i/500px-data-breach.json","latestUpdate":{"date":"2019-03-25","title":"Have I Been Pwned loaded 14.9M breached 500px accounts"},"patchStatus":"no-fix-needed","product":"500px.com","severity":"high","severityNote":"14.9M accounts · passwords exposed","slug":"500px-data-breach","stacks":[],"startedAt":"2019-03-25","status":"closed","summary":"In mid-2018, the online photography community 500px suffered a data breach. The incident exposed almost 15 million unique email addresses alongside names, usernames, genders, dates of birth and either an MD5 or bcrypt password hash. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. Exposed data: dates of birth, email addresses, genders, geographic locations, names, passwords, usernames. The breach dates from Jul 5, 2018; Have I Been Pwned loaded it on Mar 25, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","passwords","usernames"],"title":"500px data breach: 14.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/500px-data-breach","vendor":"500px"},{"auto":true,"category":"breach","closedAt":"2019-04-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOOKMATE"],"json":"https://helix.ml/threat-watch/i/bookmate-data-breach.json","latestUpdate":{"date":"2019-03-22","title":"Have I Been Pwned loaded 3.8M breached Bookmate accounts"},"patchStatus":"no-fix-needed","product":"bookmate.com","severity":"high","severityNote":"3.8M accounts · passwords exposed","slug":"bookmate-data-breach","stacks":[],"startedAt":"2019-03-22","status":"closed","summary":"In mid-2018, the social ebook subscription service Bookmate was among a raft of sites that were breached and their data then sold in early-2019. The data included almost 4 million unique email addresses alongside names, genders, dates of birth and passwords stored as salted SHA-512 hashes. Exposed data: dates of birth, email addresses, genders, geographic locations, names, passwords, usernames. The breach dates from Jul 8, 2018; Have I Been Pwned loaded it on Mar 22, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","passwords","usernames"],"title":"Bookmate data breach: 3.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bookmate-data-breach","vendor":"Bookmate"},{"auto":true,"category":"breach","closedAt":"2019-04-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:8FIT"],"json":"https://helix.ml/threat-watch/i/8fit-data-breach.json","latestUpdate":{"date":"2019-03-21","title":"Have I Been Pwned loaded 15.0M breached 8fit accounts"},"patchStatus":"no-fix-needed","product":"8fit.com","severity":"high","severityNote":"15.0M accounts · passwords exposed","slug":"8fit-data-breach","stacks":[],"startedAt":"2019-03-21","status":"closed","summary":"In July 2018, the health and fitness service 8fit suffered a data breach. The data subsequently appeared for sale on a dark web marketplace in February 2019 and included over 15M unique email addresses alongside names, genders, IP addresses and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, genders, geographic locations, ip addresses, names, passwords. The breach dates from Jul 1, 2018; Have I Been Pwned loaded it on Mar 21, 2019.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","ip-addresses","names","passwords"],"title":"8fit data breach: 15.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/8fit-data-breach","vendor":"8fit"},{"auto":true,"category":"breach","closedAt":"2019-04-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HAUTELOOK"],"json":"https://helix.ml/threat-watch/i/hautelook-data-breach.json","latestUpdate":{"date":"2019-03-21","title":"Have I Been Pwned loaded 28.5M breached HauteLook accounts"},"patchStatus":"no-fix-needed","product":"hautelook.com","severity":"high","severityNote":"28.5M accounts · passwords exposed","slug":"hautelook-data-breach","stacks":[],"startedAt":"2019-03-21","status":"closed","summary":"In mid-2018, the fashion shopping site HauteLook was among a raft of sites that were breached and their data then sold in early-2019. The data included over 28 million unique email addresses alongside names, genders, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, genders, geographic locations, names, passwords. The breach dates from Aug 7, 2018; Have I Been Pwned loaded it on Mar 21, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","passwords"],"title":"HauteLook data breach: 28.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hautelook-data-breach","vendor":"HauteLook"},{"auto":true,"category":"breach","closedAt":"2019-03-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IXIGO"],"json":"https://helix.ml/threat-watch/i/ixigo-data-breach.json","latestUpdate":{"date":"2019-03-17","title":"Have I Been Pwned loaded 17.2M breached ixigo accounts"},"patchStatus":"no-fix-needed","product":"ixigo.com","severity":"high","severityNote":"17.2M accounts · passwords exposed","slug":"ixigo-data-breach","stacks":[],"startedAt":"2019-03-17","status":"closed","summary":"In January 2019, the travel and hotel booking site ixigo suffered a data breach. The data appeared for sale on a dark web marketplace the following month and included over 17M unique email addresses alongside names, genders, phone numbers, connections to Facebook profiles and passwords stored as MD5 hashes. Exposed data: auth tokens, device information, email addresses, genders, names, passwords, phone numbers, salutations, social media profiles, usernames. The breach dates from Jan 3, 2019; Have I Been Pwned loaded it on Mar 17, 2019.","tags":["data-breach","hibp","auth-tokens","device-information","email-addresses","genders","names","passwords","phone-numbers","salutations","social-media-profiles","usernames"],"title":"ixigo data breach: 17.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ixigo-data-breach","vendor":"ixigo"},{"auto":true,"category":"breach","closedAt":"2019-03-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOUZZ"],"json":"https://helix.ml/threat-watch/i/houzz-data-breach.json","latestUpdate":{"date":"2019-03-12","title":"Have I Been Pwned loaded 48.9M breached Houzz accounts"},"patchStatus":"no-fix-needed","product":"houzz.com","severity":"high","severityNote":"48.9M accounts · passwords exposed","slug":"houzz-data-breach","stacks":[],"startedAt":"2019-03-12","status":"closed","summary":"In mid-2018, the housing design website Houzz suffered a data breach. The company learned of the incident later that year then disclosed it to impacted members in February 2019. Almost 49 million unique email addresses were in the breach alongside names, IP addresses, geographic locations and either salted hashes of passwords or links to social media profiles used to authenticate to the service. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, geographic locations, ip addresses, names, passwords, social media profiles, usernames. The breach dates from May 23, 2018; Have I Been Pwned loaded it on Mar 12, 2019.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","names","passwords","social-media-profiles","usernames"],"title":"Houzz data breach: 48.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/houzz-data-breach","vendor":"Houzz"},{"auto":true,"category":"breach","closedAt":"2019-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VERIFICATIONSIO"],"json":"https://helix.ml/threat-watch/i/verificationsio-data-breach.json","latestUpdate":{"date":"2019-03-09","title":"Have I Been Pwned loaded 763.1M breached Verifications.io accounts"},"patchStatus":"no-fix-needed","product":"verifications.io","severity":"high","severityNote":"763.1M accounts","slug":"verificationsio-data-breach","stacks":[],"startedAt":"2019-03-09","status":"closed","summary":"In February 2019, the email address validation service verifications.io suffered a data breach. Discovered by Bob Diachenko and Vinny Troia, the breach was due to the data being stored in a MongoDB instance left publicly facing without a password and resulted in 763 million unique email addresses being exposed. Many records within the data also included additional personal attributes such as names, phone numbers, IP addresses, dates of birth and genders. No passwords were included in the data. The Verifications.io website went offline during the disclosure process, although an archived copy remains viewable. Exposed data: dates of birth, email addresses, employers, genders, geographic locations, ip addresses, job titles, names, phone numbers, physical addresses. The breach dates from Feb 25, 2019; Have I Been Pwned loaded it on Mar 9, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","employers","genders","geographic-locations","ip-addresses","job-titles","names","phone-numbers","physical-addresses"],"title":"Verifications.io data breach: 763.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/verificationsio-data-breach","vendor":"Verifications.io"},{"auto":true,"category":"breach","closedAt":"2019-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHARETHIS"],"json":"https://helix.ml/threat-watch/i/sharethis-data-breach.json","latestUpdate":{"date":"2019-03-03","title":"Have I Been Pwned loaded 41.0M breached ShareThis accounts"},"patchStatus":"no-fix-needed","product":"sharethis.com","severity":"high","severityNote":"41.0M accounts · passwords exposed","slug":"sharethis-data-breach","stacks":[],"startedAt":"2019-03-03","status":"closed","summary":"In July 2018, the social bookmarking and sharing service ShareThis suffered a data breach. The incident exposed 41 million unique email addresses alongside names and in some cases, dates of birth and password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, names, passwords. The breach dates from Jul 9, 2018; Have I Been Pwned loaded it on Mar 3, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords"],"title":"ShareThis data breach: 41.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sharethis-data-breach","vendor":"ShareThis"},{"auto":true,"category":"breach","closedAt":"2019-03-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DUBSMASH"],"json":"https://helix.ml/threat-watch/i/dubsmash-data-breach.json","latestUpdate":{"date":"2019-02-25","title":"Have I Been Pwned loaded 161.7M breached Dubsmash accounts"},"patchStatus":"no-fix-needed","product":"dubsmash.com","severity":"critical","severityNote":"161.7M accounts · passwords exposed","slug":"dubsmash-data-breach","stacks":[],"startedAt":"2019-02-25","status":"closed","summary":"In December 2018, the video messaging service Dubsmash suffered a data breach. The incident exposed 162 million unique email addresses alongside usernames and PBKDF2 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. Exposed data: email addresses, geographic locations, names, passwords, phone numbers, spoken languages, usernames. The breach dates from Dec 1, 2018; Have I Been Pwned loaded it on Feb 25, 2019.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","passwords","phone-numbers","spoken-languages","usernames"],"title":"Dubsmash data breach: 161.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dubsmash-data-breach","vendor":"Dubsmash"},{"auto":true,"category":"breach","closedAt":"2019-03-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYFITNESSPAL"],"json":"https://helix.ml/threat-watch/i/myfitnesspal-data-breach.json","latestUpdate":{"date":"2019-02-21","title":"Have I Been Pwned loaded 143.6M breached MyFitnessPal accounts"},"patchStatus":"no-fix-needed","product":"myfitnesspal.com","severity":"critical","severityNote":"143.6M accounts · passwords exposed","slug":"myfitnesspal-data-breach","stacks":[],"startedAt":"2019-02-21","status":"closed","summary":"In February 2018, the diet and exercise service MyFitnessPal suffered a data breach. The incident exposed 144 million unique email addresses alongside usernames, IP addresses and passwords stored as SHA-1 and bcrypt hashes (the former for earlier accounts, the latter for newer accounts). In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Feb 1, 2018; Have I Been Pwned loaded it on Feb 21, 2019.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"MyFitnessPal data breach: 143.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/myfitnesspal-data-breach","vendor":"MyFitnessPal"},{"auto":true,"category":"breach","closedAt":"2019-03-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYHERITAGE"],"json":"https://helix.ml/threat-watch/i/myheritage-data-breach.json","latestUpdate":{"date":"2019-02-20","title":"Have I Been Pwned loaded 92.0M breached MyHeritage accounts"},"patchStatus":"no-fix-needed","product":"myheritage.com","severity":"high","severityNote":"92.0M accounts · passwords exposed","slug":"myheritage-data-breach","stacks":[],"startedAt":"2019-02-20","status":"closed","summary":"In October 2017, the genealogy website MyHeritage suffered a data breach. The incident was reported 7 months later after a security researcher discovered the data and contacted MyHeritage. In total, more than 92M customer records were exposed and included email addresses and salted SHA-1 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. Exposed data: email addresses, passwords. The breach dates from Oct 26, 2017; Have I Been Pwned loaded it on Feb 20, 2019.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"MyHeritage data breach: 92.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/myheritage-data-breach","vendor":"MyHeritage"},{"auto":true,"category":"breach","closedAt":"2019-03-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EYEEM"],"json":"https://helix.ml/threat-watch/i/eyeem-data-breach.json","latestUpdate":{"date":"2019-02-16","title":"Have I Been Pwned loaded 19.6M breached EyeEm accounts"},"patchStatus":"no-fix-needed","product":"eyeem.com","severity":"high","severityNote":"19.6M accounts · passwords exposed","slug":"eyeem-data-breach","stacks":[],"startedAt":"2019-02-16","status":"closed","summary":"In February 2018, photography website EyeEm suffered a data breach. The breach was identified among a collection of other large incidents and exposed almost 20M unique email addresses, names, usernames, bios and password hashes. Exposed data: bios, email addresses, names, passwords, usernames. The breach dates from Feb 28, 2018; Have I Been Pwned loaded it on Feb 16, 2019.","tags":["data-breach","hibp","bios","email-addresses","names","passwords","usernames"],"title":"EyeEm data breach: 19.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/eyeem-data-breach","vendor":"EyeEm"},{"auto":true,"category":"breach","closedAt":"2019-02-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DEVKITPRO"],"json":"https://helix.ml/threat-watch/i/devkitpro-data-breach.json","latestUpdate":{"date":"2019-02-11","title":"Have I Been Pwned loaded 1508 breached devkitPro accounts"},"patchStatus":"no-fix-needed","product":"devkitpro.org","severity":"high","severityNote":"1508 accounts · passwords exposed","slug":"devkitpro-data-breach","stacks":[],"startedAt":"2019-02-11","status":"closed","summary":"In February 2019, the devkitPro forum suffered a data breach. The phpBB based forum had 1,508 unique email addresses exposed in the breach alongside forum posts, private messages and passwords stored as weak salted hashes. The data breach was self-submitted to HIBP by the forum operator. Exposed data: email addresses, passwords, private messages. The breach dates from Feb 3, 2019; Have I Been Pwned loaded it on Feb 11, 2019.","tags":["data-breach","hibp","email-addresses","passwords","private-messages"],"title":"devkitPro data breach: 1508 accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/devkitpro-data-breach","vendor":"devkitPro"},{"auto":true,"category":"breach","closedAt":"2019-01-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FACEUP"],"json":"https://helix.ml/threat-watch/i/faceup-data-breach.json","latestUpdate":{"date":"2019-01-13","title":"Have I Been Pwned loaded 87K breached FaceUP accounts"},"patchStatus":"no-fix-needed","product":"faceup.dk","severity":"high","severityNote":"87K accounts · passwords exposed","slug":"faceup-data-breach","stacks":[],"startedAt":"2019-01-13","status":"closed","summary":"In 2013, the Danish social media site FaceUP suffered a data breach. The incident exposed 87k unique email addresses alongside genders, dates of birth, names, phone numbers and passwords stored as unsalted MD5 hashes. When notified of the incident, FaceUP advised they had identified a SQL injection vulnerability at the time and forced password resets on impacted customers. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, usernames. The breach dates from Jan 1, 2013; Have I Been Pwned loaded it on Jan 13, 2019.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","usernames"],"title":"FaceUP data breach: 87K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/faceup-data-breach","vendor":"FaceUP"},{"auto":true,"category":"breach","closedAt":"2019-01-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DANGDANG"],"json":"https://helix.ml/threat-watch/i/dangdang-data-breach.json","latestUpdate":{"date":"2019-01-10","title":"Have I Been Pwned loaded 4.8M breached Dangdang accounts"},"patchStatus":"no-fix-needed","product":"dangdang.com","severity":"medium","severityNote":"4.8M accounts","slug":"dangdang-data-breach","stacks":[],"startedAt":"2019-01-10","status":"closed","summary":"In 2011, the Chinese e-commerce site Dangdang suffered a data breach. The incident exposed over 4.8 million unique email addresses which were subsequently traded online over the ensuing years. Exposed data: email addresses. The breach dates from Jun 1, 2011; Have I Been Pwned loaded it on Jan 10, 2019.","tags":["data-breach","hibp","email-addresses"],"title":"Dangdang data breach: 4.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dangdang-data-breach","vendor":"Dangdang"},{"auto":true,"category":"breach","closedAt":"2019-01-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BANNERBIT"],"json":"https://helix.ml/threat-watch/i/bannerbit-data-breach.json","latestUpdate":{"date":"2019-01-08","title":"Have I Been Pwned loaded 213K breached BannerBit accounts"},"patchStatus":"no-fix-needed","product":"bannerbit.com","severity":"high","severityNote":"213K accounts · passwords exposed","slug":"bannerbit-data-breach","stacks":[],"startedAt":"2019-01-08","status":"closed","summary":"In approximately December 2018, the online ad platform BannerBit suffered a data breach. Containing 213k unique email addresses and plain text passwords, the data was provided to HIBP by a third party. Multiple attempts were made to contact BannerBit, but no response was received. Exposed data: email addresses, passwords. The breach dates from Dec 29, 2018; Have I Been Pwned loaded it on Jan 8, 2019.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"BannerBit data breach: 213K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bannerbit-data-breach","vendor":"BannerBit"},{"auto":true,"category":"breach","closedAt":"2019-01-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BLANKMEDIAGAMES"],"json":"https://helix.ml/threat-watch/i/blankmediagames-data-breach.json","latestUpdate":{"date":"2019-01-02","title":"Have I Been Pwned loaded 7.6M breached BlankMediaGames accounts"},"patchStatus":"no-fix-needed","product":"blankmediagames.com","severity":"high","severityNote":"7.6M accounts · passwords exposed","slug":"blankmediagames-data-breach","stacks":[],"startedAt":"2019-01-02","status":"closed","summary":"In December 2018, the Town of Salem website produced by BlankMediaGames suffered a data breach. Reported to HIBP by DeHashed, the data contained 7.6M unique user email addresses alongside usernames, IP addresses, purchase histories and passwords stored as phpass hashes. DeHashed made multiple attempts to contact BlankMediaGames over various channels and many days but had yet to receive a response at the time of publishing. Exposed data: browser user agent details, email addresses, ip addresses, passwords, purchases, usernames, website activity. The breach dates from Dec 28, 2018; Have I Been Pwned loaded it on Jan 2, 2019.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","passwords","purchases","usernames","website-activity"],"title":"BlankMediaGames data breach: 7.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/blankmediagames-data-breach","vendor":"BlankMediaGames"},{"auto":true,"category":"breach","closedAt":"2019-01-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GOLDSILVER"],"json":"https://helix.ml/threat-watch/i/goldsilver-data-breach.json","latestUpdate":{"date":"2018-12-27","title":"Have I Been Pwned loaded 242K breached GoldSilver accounts"},"patchStatus":"no-fix-needed","product":"goldsilver.com","severity":"high","severityNote":"242K accounts · financial data exposed","slug":"goldsilver-data-breach","stacks":[],"startedAt":"2018-12-27","status":"closed","summary":"In October 2018, the bullion education and dealer services site GoldSilver suffered a data breach that exposed 243k unique email addresses spanning customers and mailing list subscribers. An extensive amount of personal information on customers was obtained including names, addresses, phone numbers, purchases and passwords and answers to security questions stored as MD5 hashes. In a small number of cases, passport, social security numbers and partial credit card data was also exposed. The data breach and source code belonging to GoldSilver was publicly posted on a dark web service where it remained months later. When notified about the incident, GoldSilver advised that \"all affected customers have been directly notified\". Exposed data: bank account numbers, email addresses, ip addresses, names, partial credit card data, passport numbers, phone numbers, physical addresses, purchases, security questions and answers, social security numbers. The breach dates from Oct 21, 2018; Have I Been Pwned loaded it on Dec 27, 2018.","tags":["data-breach","hibp","bank-account-numbers","email-addresses","ip-addresses","names","partial-credit-card-data","passport-numbers","phone-numbers","physical-addresses","purchases","security-questions-and-answers","social-security-numbers"],"title":"GoldSilver data breach: 242K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/goldsilver-data-breach","vendor":"GoldSilver"},{"auto":true,"category":"breach","closedAt":"2019-01-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MAPPERY"],"json":"https://helix.ml/threat-watch/i/mappery-data-breach.json","latestUpdate":{"date":"2018-12-18","title":"Have I Been Pwned loaded 205K breached Mappery accounts"},"patchStatus":"no-fix-needed","product":"mappery.com","severity":"high","severityNote":"205K accounts · passwords exposed","slug":"mappery-data-breach","stacks":[],"startedAt":"2018-12-18","status":"closed","summary":"In December 2018, the mapping website Mappery suffered a data breach that exposed over 205k unique email addresses. The incident also exposed usernames, the geographic location of the user and passwords stored as unsalted SHA-1 hashes. No response was received from Mappery when contacted about the incident. Exposed data: email addresses, geographic locations, passwords, usernames. The breach dates from Dec 11, 2018; Have I Been Pwned loaded it on Dec 18, 2018.","tags":["data-breach","hibp","email-addresses","geographic-locations","passwords","usernames"],"title":"Mappery data breach: 205K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mappery-data-breach","vendor":"Mappery"},{"auto":true,"category":"breach","closedAt":"2018-12-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOMBUJEU"],"json":"https://helix.ml/threat-watch/i/bombujeu-data-breach.json","latestUpdate":{"date":"2018-12-10","title":"Have I Been Pwned loaded 575K breached Bombuj.eu accounts"},"patchStatus":"no-fix-needed","product":"bombuj.eu","severity":"high","severityNote":"575K accounts · passwords exposed","slug":"bombujeu-data-breach","stacks":[],"startedAt":"2018-12-10","status":"closed","summary":"In December 2018, the Slovak website for watching movies online for free Bombuj.eu suffered a data breach. The incident exposed over 575k unique email addresses and passwords stored as unsalted MD5 hashes. No response was received from Bombuj.eu when contacted about the incident. Exposed data: email addresses, passwords. The breach dates from Dec 7, 2018; Have I Been Pwned loaded it on Dec 10, 2018.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Bombuj.eu data breach: 575K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bombujeu-data-breach","vendor":"Bombuj.eu"},{"auto":true,"category":"breach","closedAt":"2018-12-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HUB4TECH"],"json":"https://helix.ml/threat-watch/i/hub4tech-data-breach.json","latestUpdate":{"date":"2018-12-09","title":"Have I Been Pwned loaded 36K breached Hub4Tech accounts"},"patchStatus":"no-fix-needed","product":"hub4tech.com","severity":"high","severityNote":"36K accounts · passwords exposed","slug":"hub4tech-data-breach","stacks":[],"startedAt":"2018-12-09","status":"closed","summary":"On an unknown date in approximately 2017, the Indian training and assessment service known as Hub4Tech suffered a data breach via a SQL injection attack. The incident exposed almost 37k unique email addresses and passwords stored as unsalted MD5 hashes. No response was received from Hub4Tech when contacted about the incident. Exposed data: email addresses, passwords. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Dec 9, 2018.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Hub4Tech data breach: 36K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hub4tech-data-breach","vendor":"Hub4Tech"},{"auto":true,"category":"breach","closedAt":"2018-12-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AERSERV"],"json":"https://helix.ml/threat-watch/i/aerserv-data-breach.json","latestUpdate":{"date":"2018-12-06","title":"Have I Been Pwned loaded 66K breached AerServ accounts"},"patchStatus":"no-fix-needed","product":"aerserv.com","severity":"high","severityNote":"66K accounts · passwords exposed","slug":"aerserv-data-breach","stacks":[],"startedAt":"2018-12-06","status":"closed","summary":"In April 2018, the ad management platform known as AerServ suffered a data breach. Acquired by InMobi earlier in the year, the AerServ breach impacted over 66k unique email addresses and also included contact information and passwords stored as salted SHA-512 hashes. The data was publicly posted to Twitter later in 2018 after which InMobi was notified and advised they were aware of the incident. Exposed data: email addresses, employers, job titles, names, passwords, phone numbers, physical addresses. The breach dates from Apr 1, 2018; Have I Been Pwned loaded it on Dec 6, 2018.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","passwords","phone-numbers","physical-addresses"],"title":"AerServ data breach: 66K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/aerserv-data-breach","vendor":"AerServ"},{"auto":true,"category":"breach","closedAt":"2018-12-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YOUVEBEENSCRAPED"],"json":"https://helix.ml/threat-watch/i/youvebeenscraped-data-breach.json","latestUpdate":{"date":"2018-12-06","title":"Have I Been Pwned loaded 66.1M breached You've Been Scraped accounts"},"patchStatus":"no-fix-needed","product":"You've Been Scraped","severity":"high","severityNote":"66.1M accounts","slug":"youvebeenscraped-data-breach","stacks":[],"startedAt":"2018-12-06","status":"closed","summary":"In October and November 2018, security researcher Bob Diachenko identified several unprotected MongoDB instances believed to be hosted by a data aggregator. Containing a total of over 66M records, the owner of the data couldn't be identified but it is believed to have been scraped from LinkedIn hence the title \"You've Been Scraped\". The exposed records included names, both work and personal email addresses, job titles and links to the individuals' LinkedIn profiles. Exposed data: email addresses, employers, geographic locations, job titles, names, social media profiles. The breach dates from Oct 5, 2018; Have I Been Pwned loaded it on Dec 6, 2018.","tags":["data-breach","hibp","email-addresses","employers","geographic-locations","job-titles","names","social-media-profiles"],"title":"You've Been Scraped data breach: 66.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/youvebeenscraped-data-breach","vendor":"You've Been Scraped"},{"auto":true,"category":"breach","closedAt":"2018-12-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FORUMCOMMUNITY"],"json":"https://helix.ml/threat-watch/i/forumcommunity-data-breach.json","latestUpdate":{"date":"2018-12-05","title":"Have I Been Pwned loaded 776K breached ForumCommunity accounts"},"patchStatus":"no-fix-needed","product":"forumcommunity.net","severity":"high","severityNote":"776K accounts · passwords exposed","slug":"forumcommunity-data-breach","stacks":[],"startedAt":"2018-12-05","status":"closed","summary":"In approximately mid-2016, the Italian-based service for creating forums known as ForumCommunity suffered a data breach. The incident impacted over 776k unique email addresses along with usernames and unsalted MD5 password hashes. No response was received from ForumCommunity when contacted. Exposed data: email addresses, passwords, usernames. The breach dates from Jun 1, 2016; Have I Been Pwned loaded it on Dec 5, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"ForumCommunity data breach: 776K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/forumcommunity-data-breach","vendor":"ForumCommunity"},{"auto":true,"category":"breach","closedAt":"2018-12-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TECHNIC"],"json":"https://helix.ml/threat-watch/i/technic-data-breach.json","latestUpdate":{"date":"2018-12-04","title":"Have I Been Pwned loaded 265K breached Technic accounts"},"patchStatus":"no-fix-needed","product":"technicpack.net","severity":"high","severityNote":"265K accounts · passwords exposed","slug":"technic-data-breach","stacks":[],"startedAt":"2018-12-04","status":"closed","summary":"In November 2018, the Minecraft modpack platform known as Technic suffered a data breach. Technic promptly disclosed the breach and advised that the impacted data included over 265k unique users' email and IP addresses, chat logs, private messages and passwords stored as bcrypt hashes with a work factor of 13. Technic self-submitted the breach to HIBP. Exposed data: chat logs, email addresses, ip addresses, passwords, private messages, time zones. The breach dates from Nov 30, 2018; Have I Been Pwned loaded it on Dec 4, 2018.","tags":["data-breach","hibp","chat-logs","email-addresses","ip-addresses","passwords","private-messages","time-zones"],"title":"Technic data breach: 265K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/technic-data-breach","vendor":"Technic"},{"auto":true,"category":"breach","closedAt":"2018-12-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DATAANDLEADS"],"json":"https://helix.ml/threat-watch/i/dataandleads-data-breach.json","latestUpdate":{"date":"2018-11-28","title":"Have I Been Pwned loaded 44.3M breached Data \u0026 Leads accounts"},"patchStatus":"no-fix-needed","product":"datanleads.com","severity":"medium","severityNote":"44.3M accounts","slug":"dataandleads-data-breach","stacks":[],"startedAt":"2018-11-28","status":"closed","summary":"In November 2018, security researcher Bob Diachenko identified an unprotected database believed to be hosted by a data aggregator. Upon further investigation, the data was linked to marketing company Data \u0026 Leads. The exposed Elasticsearch instance contained over 44M unique email addresses along with names, IP and physical addresses, phone numbers and employment information. No response was received from Data \u0026 Leads when contacted by Bob and their site subsequently went offline. Exposed data: email addresses, employers, ip addresses, job titles, names, phone numbers, physical addresses. The breach dates from Nov 14, 2018; Have I Been Pwned loaded it on Nov 28, 2018.","tags":["data-breach","hibp","email-addresses","employers","ip-addresses","job-titles","names","phone-numbers","physical-addresses"],"title":"Data \u0026 Leads data breach: 44.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dataandleads-data-breach","vendor":"Data \u0026 Leads"},{"auto":true,"category":"breach","closedAt":"2018-12-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADAPT"],"json":"https://helix.ml/threat-watch/i/adapt-data-breach.json","latestUpdate":{"date":"2018-11-22","title":"Have I Been Pwned loaded 9.4M breached Adapt accounts"},"patchStatus":"no-fix-needed","product":"adapt.io","severity":"medium","severityNote":"9.4M accounts","slug":"adapt-data-breach","stacks":[],"startedAt":"2018-11-22","status":"closed","summary":"In November 2018, security researcher Bob Diachenko identified an unprotected database hosted by data aggregator \"Adapt\". A provider of \"Fresh Quality Contacts\", the service exposed over 9.3M unique records of individuals and employer information including their names, employers, job titles, contact information and data relating to the employer including organisation description, size and revenue. No response was received from Adapt when contacted. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, social media profiles. The breach dates from Nov 5, 2018; Have I Been Pwned loaded it on Nov 22, 2018.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses","social-media-profiles"],"title":"Adapt data breach: 9.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/adapt-data-breach","vendor":"Adapt"},{"auto":true,"category":"breach","closedAt":"2018-12-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HTHSTUDIOS"],"json":"https://helix.ml/threat-watch/i/hthstudios-data-breach.json","latestUpdate":{"date":"2018-11-20","title":"Have I Been Pwned loaded 411K breached HTH Studios accounts"},"patchStatus":"no-fix-needed","product":"hthstudios.com","severity":"high","severityNote":"411K accounts","slug":"hthstudios-data-breach","stacks":[],"startedAt":"2018-11-20","status":"closed","summary":"In August 2018, the adult furry interactive game creator HTH Studios suffered a data breach impacting multiple repositories of customer data. Several months later, the data surfaced on a popular hacking forum and included 411k unique email addresses along with physical and IP addresses, names, orders, salted SHA-1 and salted MD5 hashes. HTH Studios is aware of the incident. Exposed data: browser user agent details, dates of birth, email addresses, ip addresses, names, phone numbers, physical addresses, purchases, usernames. The breach dates from Aug 24, 2018; Have I Been Pwned loaded it on Nov 20, 2018.","tags":["data-breach","hibp","browser-user-agent-details","dates-of-birth","email-addresses","ip-addresses","names","phone-numbers","physical-addresses","purchases","usernames"],"title":"HTH Studios data breach: 411K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hthstudios-data-breach","vendor":"HTH Studios"},{"auto":true,"category":"breach","closedAt":"2018-12-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KNOWNCIRCLE"],"json":"https://helix.ml/threat-watch/i/knowncircle-data-breach.json","latestUpdate":{"date":"2018-11-17","title":"Have I Been Pwned loaded 2.0M breached KnownCircle accounts"},"patchStatus":"no-fix-needed","product":"knowncircle.com","severity":"high","severityNote":"2.0M accounts · passwords exposed","slug":"knowncircle-data-breach","stacks":[],"startedAt":"2018-11-17","status":"closed","summary":"In approximately April 2016, the \"marketing automation for agents and professional service providers\" company KnownCircle had a large volume of data obtained by an external party. The data belonging to the now defunct service appeared in JSON format and contained gigabytes of data related to the real estate and insurance sectors. The personal data in the breach appears to have primarily been used for marketing purposes, including logs of emails sent and tracking of gift cards. A small number of passwords for KnownCircle staff were also present and were stored as bcrypt hashes. Exposed data: email addresses, email messages, genders, names, passwords, phone numbers, physical addresses. The breach dates from Apr 12, 2016; Have I Been Pwned loaded it on Nov 17, 2018.","tags":["data-breach","hibp","email-addresses","email-messages","genders","names","passwords","phone-numbers","physical-addresses"],"title":"KnownCircle data breach: 2.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/knowncircle-data-breach","vendor":"KnownCircle"},{"auto":true,"category":"breach","closedAt":"2018-12-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ELASTICSEARCHSALESLEADS"],"json":"https://helix.ml/threat-watch/i/elasticsearchsalesleads-data-breach.json","latestUpdate":{"date":"2018-11-17","title":"Have I Been Pwned loaded 5.8M breached Elasticsearch Instance of Sales Leads on AWS accounts"},"patchStatus":"no-fix-needed","product":"Elasticsearch Instance of Sales Leads on AWS","severity":"medium","severityNote":"5.8M accounts","slug":"elasticsearchsalesleads-data-breach","stacks":[],"startedAt":"2018-11-17","status":"closed","summary":"In October 2018, security researcher Bob Diachenko identified multiple exposed databases with hundreds of millions of records. One of those datasets was an Elasticsearch instance on AWS containing sales lead data and 5.8M unique email addresses. The data contained information relating to individuals and the companies they worked for including their names, email addresses and company name and contact information. Despite best efforts, it was not possible to identify the owner of the data hence this breach as been titled \"Elasticsearch Sales Leads\". Exposed data: email addresses, employers, names, physical addresses. The breach dates from Oct 29, 2018; Have I Been Pwned loaded it on Nov 17, 2018.","tags":["data-breach","hibp","email-addresses","employers","names","physical-addresses"],"title":"Elasticsearch Instance of Sales Leads on AWS data breach: 5.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/elasticsearchsalesleads-data-breach","vendor":"Elasticsearch Instance of Sales Leads on AWS"},{"auto":true,"category":"breach","closedAt":"2018-11-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SIAE"],"json":"https://helix.ml/threat-watch/i/siae-data-breach.json","latestUpdate":{"date":"2018-11-07","title":"Have I Been Pwned loaded 14K breached Società Italiana degli Autori ed Editori accounts"},"patchStatus":"no-fix-needed","product":"siae.it","severity":"high","severityNote":"14K accounts · passwords exposed","slug":"siae-data-breach","stacks":[],"startedAt":"2018-11-07","status":"closed","summary":"In November 2018, the Società Italiana degli Autori ed Editori (Italian Society of Authors and Publishers, or SIAE) was hacked, defaced and almost 4GB of data leaked publicly via Twitter. The data included over 14k registered users' names, email addresses and passwords. Exposed data: email addresses, ip addresses, names, passwords, phone numbers. The breach dates from Nov 3, 2018; Have I Been Pwned loaded it on Nov 7, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","phone-numbers"],"title":"Società Italiana degli Autori ed Editori data breach: 14K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/siae-data-breach","vendor":"Società Italiana degli Autori ed Editori"},{"auto":true,"category":"breach","closedAt":"2018-11-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RBXROCKS"],"json":"https://helix.ml/threat-watch/i/rbxrocks-data-breach.json","latestUpdate":{"date":"2018-11-07","title":"Have I Been Pwned loaded 149K breached Rbx.Rocks accounts"},"patchStatus":"no-fix-needed","product":"rbx.rocks","severity":"high","severityNote":"149K accounts · passwords exposed","slug":"rbxrocks-data-breach","stacks":[],"startedAt":"2018-11-07","status":"closed","summary":"In August 2018, the Roblox trading site Rbx.Rocks suffered a data breach. Almost 25k records were sent to HIBP in November and included names, email addresses and passwords stored as bcrypt hashes. In July 2019, a further 125k records emerged bringing the total size of the incident to 150k. The website has since gone offline with a message stating that \"Rbx.Rocks v2.0 is currently under construction\". Exposed data: email addresses, names, passwords. The breach dates from Aug 6, 2018; Have I Been Pwned loaded it on Nov 7, 2018.","tags":["data-breach","hibp","email-addresses","names","passwords"],"title":"Rbx.Rocks data breach: 149K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/rbxrocks-data-breach","vendor":"Rbx.Rocks"},{"auto":true,"category":"breach","closedAt":"2018-11-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WPSANDBOX"],"json":"https://helix.ml/threat-watch/i/wpsandbox-data-breach.json","latestUpdate":{"date":"2018-11-06","title":"Have I Been Pwned loaded 858 breached WPSandbox accounts"},"patchStatus":"no-fix-needed","product":"wpsandbox.io","severity":"high","severityNote":"858 accounts · passwords exposed","slug":"wpsandbox-data-breach","stacks":[],"startedAt":"2018-11-06","status":"closed","summary":"In November 2018, the WordPress sandboxing service that allows people to create temporary websites WP Sandbox discovered their service was being used to host a phishing site attempting to collect Microsoft OneDrive accounts. After identifying the malicious site, WP Sandbox took it offline, contacted the 858 people who provided information to it then self-submitted their addresses to HIBP. The phishing page requested both email addresses and passwords. Exposed data: email addresses, passwords. The breach dates from Nov 4, 2018; Have I Been Pwned loaded it on Nov 6, 2018.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"WPSandbox data breach: 858 accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wpsandbox-data-breach","vendor":"WPSandbox"},{"auto":true,"category":"breach","closedAt":"2018-11-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JOOMLART"],"json":"https://helix.ml/threat-watch/i/joomlart-data-breach.json","latestUpdate":{"date":"2018-11-01","title":"Have I Been Pwned loaded 22K breached JoomlArt accounts"},"patchStatus":"no-fix-needed","product":"joomlart.com","severity":"high","severityNote":"22K accounts · passwords exposed · financial data exposed","slug":"joomlart-data-breach","stacks":[],"startedAt":"2018-11-01","status":"closed","summary":"In January 2018, the Joomla template website JoomlArt inadvertently exposed more than 22k unique customer records in a Jira ticket. The exposed data was from iJoomla and JomSocial, both services that JoomlArt acquired the previous year. The data included usernames, email addresses, purchases and passwords stored as MD5 hashes. When contacted, JoomlArt advised they were aware of the incident and had previously notified impacted parties. Exposed data: email addresses, names, passwords, payment histories, usernames. The breach dates from Jan 30, 2018; Have I Been Pwned loaded it on Nov 1, 2018.","tags":["data-breach","hibp","email-addresses","names","passwords","payment-histories","usernames"],"title":"JoomlArt data breach: 22K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/joomlart-data-breach","vendor":"JoomlArt"},{"auto":true,"category":"breach","closedAt":"2018-11-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MACFORUMS"],"json":"https://helix.ml/threat-watch/i/macforums-data-breach.json","latestUpdate":{"date":"2018-10-29","title":"Have I Been Pwned loaded 326K breached Mac Forums accounts"},"patchStatus":"no-fix-needed","product":"mac-forums.com","severity":"high","severityNote":"326K accounts · passwords exposed","slug":"macforums-data-breach","stacks":[],"startedAt":"2018-10-29","status":"closed","summary":"In July 2016, the self-proclaimed \"Ultimate Source For Your Mac\" website Mac Forums suffered a data breach. The vBulletin-based system exposed over 326k usernames, email and IP addresses, dates of birth and passwords stored as salted MD5 hashes. The data was later discovered being traded on a popular hacking forum. Mac Forums did not respond when contacted about the incident via their contact us form. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jul 3, 2016; Have I Been Pwned loaded it on Oct 29, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Mac Forums data breach: 326K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/macforums-data-breach","vendor":"Mac Forums"},{"auto":true,"category":"breach","closedAt":"2018-11-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BABYNAMES"],"json":"https://helix.ml/threat-watch/i/babynames-data-breach.json","latestUpdate":{"date":"2018-10-24","title":"Have I Been Pwned loaded 846K breached Baby Names accounts"},"patchStatus":"no-fix-needed","product":"babynames.com","severity":"high","severityNote":"846K accounts · passwords exposed","slug":"babynames-data-breach","stacks":[],"startedAt":"2018-10-24","status":"closed","summary":"In approximately 2008, the site to help parents name their children known as Baby Names suffered a data breach. The incident exposed 846k email addresses and passwords stored as salted MD5 hashes. When contacted in October 2018, Baby Names advised that \"the breach happened at least ten years ago\" and that members were notified at the time. Exposed data: email addresses, passwords. The breach dates from Oct 24, 2008; Have I Been Pwned loaded it on Oct 24, 2018.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Baby Names data breach: 846K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/babynames-data-breach","vendor":"Baby Names"},{"auto":true,"category":"breach","closedAt":"2018-11-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WIFELOVERS"],"json":"https://helix.ml/threat-watch/i/wifelovers-data-breach.json","latestUpdate":{"date":"2018-10-20","title":"Have I Been Pwned loaded 1.3M breached Wife Lovers accounts"},"patchStatus":"no-fix-needed","product":"wifelovers.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"wifelovers-data-breach","stacks":[],"startedAt":"2018-10-20","status":"closed","summary":"In October 2018, the site dedicated to posting naked photos and other erotica of wives Wife Lovers suffered a data breach. The underlying database supported a total of 8 different adult websites and contained over 1.2M unique email addresses. Wife Lovers acknowledged the breach which impacted names, usernames, email and IP addresses and passwords hashed using the weak DEScrypt algorithm. The breach has been marked as \"sensitive\" due to the nature of the site. Exposed data: email addresses, ip addresses, names, passwords, usernames. The breach dates from Oct 7, 2018; Have I Been Pwned loaded it on Oct 20, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","usernames"],"title":"Wife Lovers data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wifelovers-data-breach","vendor":"Wife Lovers"},{"auto":true,"category":"breach","closedAt":"2018-10-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FACEPUNCH"],"json":"https://helix.ml/threat-watch/i/facepunch-data-breach.json","latestUpdate":{"date":"2018-10-17","title":"Have I Been Pwned loaded 342K breached Facepunch accounts"},"patchStatus":"no-fix-needed","product":"facepunch.com","severity":"high","severityNote":"342K accounts · passwords exposed","slug":"facepunch-data-breach","stacks":[],"startedAt":"2018-10-17","status":"closed","summary":"In June 2016, the game development studio Facepunch suffered a data breach that exposed 343k users. The breached data included usernames, email and IP addresses, dates of birth and salted MD5 password hashes. Facepunch advised they were aware of the incident and had notified people at the time. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jun 3, 2016; Have I Been Pwned loaded it on Oct 17, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Facepunch data breach: 342K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/facepunch-data-breach","vendor":"Facepunch"},{"auto":true,"category":"breach","closedAt":"2018-10-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:APOLLO"],"json":"https://helix.ml/threat-watch/i/apollo-data-breach.json","latestUpdate":{"date":"2018-10-05","title":"Have I Been Pwned loaded 125.9M breached Apollo accounts"},"patchStatus":"no-fix-needed","product":"apollo.io","severity":"high","severityNote":"125.9M accounts","slug":"apollo-data-breach","stacks":[],"startedAt":"2018-10-05","status":"closed","summary":"In July 2018, the sales engagement startup Apollo left a database containing billions of data points publicly exposed without a password. The data was discovered by security researcher Vinny Troia who subsequently sent a subset of the data containing 126 million unique email addresses to Have I Been Pwned. The data left exposed by Apollo was used in their \"revenue acceleration platform\" and included personal information such as names and email addresses as well as professional information including places of employment, the roles people hold and where they're located. Apollo stressed that the exposed data did not include sensitive information such as passwords, social security numbers or financial data. The Apollo website has a contact form for those looking to get in touch with the organisation. Exposed data: email addresses, employers, geographic locations, job titles, names, phone numbers, salutations, social media profiles. The breach dates from Jul 23, 2018; Have I Been Pwned loaded it on Oct 5, 2018.","tags":["data-breach","hibp","email-addresses","employers","geographic-locations","job-titles","names","phone-numbers","salutations","social-media-profiles"],"title":"Apollo data breach: 125.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/apollo-data-breach","vendor":"Apollo"},{"auto":true,"category":"breach","closedAt":"2018-10-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REALESTATEMOGUL"],"json":"https://helix.ml/threat-watch/i/realestatemogul-data-breach.json","latestUpdate":{"date":"2018-09-24","title":"Have I Been Pwned loaded 307K breached Real Estate Mogul accounts"},"patchStatus":"no-fix-needed","product":"realestatemogul.com","severity":"medium","severityNote":"307K accounts","slug":"realestatemogul-data-breach","stacks":[],"startedAt":"2018-09-24","status":"closed","summary":"In September 2016, the real estate investment site Real Estate Mogul had a Mongo DB instance compromised and 5GB of data downloaded by an unauthorised party. The data contained real estate listings including addresses and the names, phone numbers and 308k unique email addresses of the sellers. Real Estate Mogul was advised of the incident in September 2018 and stated that they \"found no instance of user account credentials like usernames and passwords nor billing information within this file\". Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Sep 6, 2016; Have I Been Pwned loaded it on Sep 24, 2018.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Real Estate Mogul data breach: 307K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/realestatemogul-data-breach","vendor":"Real Estate Mogul"},{"auto":true,"category":"breach","closedAt":"2018-09-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RUSSIANAMERICA"],"json":"https://helix.ml/threat-watch/i/russianamerica-data-breach.json","latestUpdate":{"date":"2018-09-13","title":"Have I Been Pwned loaded 182K breached Russian America accounts"},"patchStatus":"no-fix-needed","product":"russianamerica.com","severity":"high","severityNote":"182K accounts · passwords exposed","slug":"russianamerica-data-breach","stacks":[],"startedAt":"2018-09-13","status":"closed","summary":"In approximately 2017, the website for Russian speakers in America known as Russian America suffered a data breach. The incident exposed 183k unique records including names, email addresses, phone numbers and passwords stored in both plain text and as MD5 hashes. Russian America was contacted about the breach but did not respond. Exposed data: email addresses, names, passwords, phone numbers. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Sep 13, 2018.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers"],"title":"Russian America data breach: 182K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/russianamerica-data-breach","vendor":"Russian America"},{"auto":true,"category":"breach","closedAt":"2018-09-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NAPSGEAR"],"json":"https://helix.ml/threat-watch/i/napsgear-data-breach.json","latestUpdate":{"date":"2018-09-10","title":"Have I Been Pwned loaded 287K breached NapsGear accounts"},"patchStatus":"no-fix-needed","product":"napsgear.org","severity":"high","severityNote":"287K accounts · passwords exposed","slug":"napsgear-data-breach","stacks":[],"startedAt":"2018-09-10","status":"closed","summary":"In October 2015, the anabolic steroids retailer NapsGear suffered a data breach. An extensive amount of personal information on 287k customers was exposed including email addresses, names, addresses, phone numbers, purchase histories and salted MD5 password hashes. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Oct 21, 2015; Have I Been Pwned loaded it on Sep 10, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","purchases"],"title":"NapsGear data breach: 287K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/napsgear-data-breach","vendor":"NapsGear"},{"auto":true,"category":"breach","closedAt":"2018-09-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FRESHMENU"],"json":"https://helix.ml/threat-watch/i/freshmenu-data-breach.json","latestUpdate":{"date":"2018-09-10","title":"Have I Been Pwned loaded 110K breached FreshMenu accounts"},"patchStatus":"no-fix-needed","product":"freshmenu.com","severity":"medium","severityNote":"110K accounts","slug":"freshmenu-data-breach","stacks":[],"startedAt":"2018-09-10","status":"closed","summary":"In July 2016, the India-based food delivery service FreshMenu suffered a data breach. The incident exposed the personal data of over 110k customers and included their names, email addresses, phone numbers, home addresses and order histories. When advised of the incident, FreshMenu acknowledged being already aware of the breach but stated they had decided not to notify impacted customers. Exposed data: device information, email addresses, names, phone numbers, physical addresses, purchases. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Sep 10, 2018.","tags":["data-breach","hibp","device-information","email-addresses","names","phone-numbers","physical-addresses","purchases"],"title":"FreshMenu data breach: 110K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/freshmenu-data-breach","vendor":"FreshMenu"},{"auto":true,"category":"breach","closedAt":"2018-09-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WARMANE"],"json":"https://helix.ml/threat-watch/i/warmane-data-breach.json","latestUpdate":{"date":"2018-09-08","title":"Have I Been Pwned loaded 1.1M breached Warmane accounts"},"patchStatus":"no-fix-needed","product":"warmane.com","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"warmane-data-breach","stacks":[],"startedAt":"2018-09-08","status":"closed","summary":"In approximately December 2016, the online service for World of Warcraft private servers Warmane suffered a data breach. The incident exposed over 1.1M accounts including usernames, email addresses, dates of birth and salted MD5 password hashes. The data was subsequently extensively circulated online and was later provided to HIBP by whitehat security researcher and data analyst Adam Davies. Exposed data: dates of birth, email addresses, passwords, usernames. The breach dates from Dec 1, 2016; Have I Been Pwned loaded it on Sep 8, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","passwords","usernames"],"title":"Warmane data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/warmane-data-breach","vendor":"Warmane"},{"auto":true,"category":"breach","closedAt":"2018-09-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MORTALONLINE"],"json":"https://helix.ml/threat-watch/i/mortalonline-data-breach.json","latestUpdate":{"date":"2018-08-31","title":"Have I Been Pwned loaded 606K breached Mortal Online accounts"},"patchStatus":"no-fix-needed","product":"mortalonline.com","severity":"high","severityNote":"606K accounts · passwords exposed","slug":"mortalonline-data-breach","stacks":[],"startedAt":"2018-08-31","status":"closed","summary":"In June 2018, the massively multiplayer online role-playing game (MMORPG) Mortal Online suffered a data breach. A file containing 570k email addresses and cracked passwords was subsequently distributed online. A larger more complete file containing 607k email addresses with original unsalted MD5 password hashes along with names, usernames and physical addresses was later provided and the original breach in HIBP was updated accordingly. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies. Exposed data: email addresses, names, passwords, physical addresses, usernames. The breach dates from Jun 17, 2018; Have I Been Pwned loaded it on Aug 31, 2018.","tags":["data-breach","hibp","email-addresses","names","passwords","physical-addresses","usernames"],"title":"Mortal Online data breach: 606K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mortalonline-data-breach","vendor":"Mortal Online"},{"auto":true,"category":"breach","closedAt":"2018-09-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SVENSKAMAGIC"],"json":"https://helix.ml/threat-watch/i/svenskamagic-data-breach.json","latestUpdate":{"date":"2018-08-30","title":"Have I Been Pwned loaded 30K breached SvenskaMagic accounts"},"patchStatus":"no-fix-needed","product":"svenskamagic.com","severity":"high","severityNote":"30K accounts · passwords exposed","slug":"svenskamagic-data-breach","stacks":[],"startedAt":"2018-08-30","status":"closed","summary":"Sometime in 2015, the Swedish magic website SvenskaMagic suffered a data breach that exposed over 30k records. The compromised data included usernames, email addresses and MD5 password hashes. The data was self-submitted to HIBP by SvenskaMagic. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 1, 2015; Have I Been Pwned loaded it on Aug 30, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"SvenskaMagic data breach: 30K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/svenskamagic-data-breach","vendor":"SvenskaMagic"},{"auto":true,"category":"breach","closedAt":"2018-09-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ATLASQUANTUM"],"json":"https://helix.ml/threat-watch/i/atlasquantum-data-breach.json","latestUpdate":{"date":"2018-08-27","title":"Have I Been Pwned loaded 261K breached Atlas Quantum accounts"},"patchStatus":"no-fix-needed","product":"atlasquantum.com","severity":"medium","severityNote":"261K accounts","slug":"atlasquantum-data-breach","stacks":[],"startedAt":"2018-08-27","status":"closed","summary":"In August 2018, the cryptocurrency investment platform Atlas Quantum suffered a data breach. The breach leaked the personal data of 261k investors on the platform including their names, phone numbers, email addresses and account balances. Exposed data: account balances, email addresses, names, phone numbers. The breach dates from Aug 25, 2018; Have I Been Pwned loaded it on Aug 27, 2018.","tags":["data-breach","hibp","account-balances","email-addresses","names","phone-numbers"],"title":"Atlas Quantum data breach: 261K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/atlasquantum-data-breach","vendor":"Atlas Quantum"},{"auto":true,"category":"breach","closedAt":"2018-09-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPYFONE"],"json":"https://helix.ml/threat-watch/i/spyfone-data-breach.json","latestUpdate":{"date":"2018-08-24","title":"Have I Been Pwned loaded 44K breached SpyFone accounts"},"patchStatus":"no-fix-needed","product":"spyfone.com","severity":"high","severityNote":"44K accounts · passwords exposed","slug":"spyfone-data-breach","stacks":[],"startedAt":"2018-08-24","status":"closed","summary":"In August 2018, the spyware company SpyFone left terabytes of data publicly exposed. Collected surreptitiously whilst the targets were using their devices, the data included photos, audio recordings, text messages and browsing history which were then exposed via a number of misconfigurations within SpyFone's systems. The data belonged the thousands of SpyFone customers and included 44k unique email addresses, many likely belonging to people the targeted phones had contact with. Exposed data: audio recordings, browsing histories, device information, email addresses, geographic locations, imei numbers, ip addresses, names, passwords, photos, sms messages. The breach dates from Aug 16, 2018; Have I Been Pwned loaded it on Aug 24, 2018.","tags":["data-breach","hibp","audio-recordings","browsing-histories","device-information","email-addresses","geographic-locations","imei-numbers","ip-addresses","names","passwords","photos","sms-messages"],"title":"SpyFone data breach: 44K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/spyfone-data-breach","vendor":"SpyFone"},{"auto":true,"category":"breach","closedAt":"2018-08-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYFHA"],"json":"https://helix.ml/threat-watch/i/myfha-data-breach.json","latestUpdate":{"date":"2018-08-09","title":"Have I Been Pwned loaded 972K breached MyFHA accounts"},"patchStatus":"no-fix-needed","product":"myfha.net","severity":"high","severityNote":"972K accounts · passwords exposed","slug":"myfha-data-breach","stacks":[],"startedAt":"2018-08-09","status":"closed","summary":"In approximately February 2015, the home financing website MyFHA suffered a data breach which disclosed the personal information of nearly 1 million people. The data included extensive personal information relating to home financing including personal contact info, credit statuses, household incomes, loan amounts and notes on personal circumstances, often referring to legal issues, divorces and health conditions. Multiple parties contacted HIBP with the data after which MyFHA was alerted in mid-July and acknowledged the legitimacy of the breach then took the site offline. Exposed data: credit status information, email addresses, income levels, ip addresses, loan information, names, passwords, personal descriptions, physical addresses. The breach dates from Feb 18, 2015; Have I Been Pwned loaded it on Aug 9, 2018.","tags":["data-breach","hibp","credit-status-information","email-addresses","income-levels","ip-addresses","loan-information","names","passwords","personal-descriptions","physical-addresses"],"title":"MyFHA data breach: 972K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/myfha-data-breach","vendor":"MyFHA"},{"auto":true,"category":"breach","closedAt":"2018-08-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LANWAR"],"json":"https://helix.ml/threat-watch/i/lanwar-data-breach.json","latestUpdate":{"date":"2018-08-08","title":"Have I Been Pwned loaded 45K breached Lanwar accounts"},"patchStatus":"no-fix-needed","product":"lanwar.com","severity":"high","severityNote":"45K accounts · passwords exposed","slug":"lanwar-data-breach","stacks":[],"startedAt":"2018-08-08","status":"closed","summary":"In July 2018, staff of the Lanwar gaming site discovered a data breach they believe dates back to sometime over the previous several months. The data contained 45k names, email addresses, usernames and plain text passwords. A Lanwar staff member self-submitted the breach to HIBP and has also contacted the relevant authorities about the incident after identifying a phishing attempt to extort Bitcoin from a user. Exposed data: email addresses, names, passwords, physical addresses, usernames. The breach dates from Jul 28, 2018; Have I Been Pwned loaded it on Aug 8, 2018.","tags":["data-breach","hibp","email-addresses","names","passwords","physical-addresses","usernames"],"title":"Lanwar data breach: 45K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lanwar-data-breach","vendor":"Lanwar"},{"auto":true,"category":"breach","closedAt":"2018-08-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADULTFANFICTION"],"json":"https://helix.ml/threat-watch/i/adultfanfiction-data-breach.json","latestUpdate":{"date":"2018-08-06","title":"Have I Been Pwned loaded 186K breached Adult-FanFiction.Org accounts"},"patchStatus":"no-fix-needed","product":"adult-fanfiction.org","severity":"high","severityNote":"186K accounts · passwords exposed","slug":"adultfanfiction-data-breach","stacks":[],"startedAt":"2018-08-06","status":"closed","summary":"In May 2018, the website for sharing adult-orientated works of fiction known as Adult-FanFiction.Org had 186k records exposed in a data breach. The data contained names, email addresses, dates of birth and passwords stored as both MD5 hashes and plain text. AFF did not respond when contacted about the breach and the site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: dates of birth, email addresses, names, passwords. The breach dates from May 30, 2018; Have I Been Pwned loaded it on Aug 6, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords"],"title":"Adult-FanFiction.Org data breach: 186K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/adultfanfiction-data-breach","vendor":"Adult-FanFiction.Org"},{"auto":true,"category":"breach","closedAt":"2018-08-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WHITEROOM"],"json":"https://helix.ml/threat-watch/i/whiteroom-data-breach.json","latestUpdate":{"date":"2018-07-31","title":"Have I Been Pwned loaded 1.3M breached Fashion Nexus accounts"},"patchStatus":"no-fix-needed","product":"fashionnexus.co.uk","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"whiteroom-data-breach","stacks":[],"startedAt":"2018-07-31","status":"closed","summary":"In July 2018, UK-based ecommerce company Fashion Nexus suffered a data breach which exposed 1.4 million records. Multiple websites developed by sister company White Room Solutions were impacted in the breach amongst which were sites including Jaded London and AX Paris. The various sites exposed in the incident included a range of different data types including names, phone numbers, addresses and passwords stored as a mix of salted MD5 and SHA-1 as well as unsalted MD5 passwords. When asked by reporter Graham Cluley if a public statement on the incident was available, a one-word response of \"No\" was received. Exposed data: browser user agent details, dates of birth, email addresses, genders, ip addresses, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Jul 9, 2018; Have I Been Pwned loaded it on Jul 31, 2018.","tags":["data-breach","hibp","browser-user-agent-details","dates-of-birth","email-addresses","genders","ip-addresses","names","passwords","phone-numbers","physical-addresses","purchases"],"title":"Fashion Nexus data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/whiteroom-data-breach","vendor":"Fashion Nexus"},{"auto":true,"category":"breach","closedAt":"2018-08-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEAGUEOFLEGENDS"],"json":"https://helix.ml/threat-watch/i/leagueoflegends-data-breach.json","latestUpdate":{"date":"2018-07-28","title":"Have I Been Pwned loaded 339K breached League of Legends accounts"},"patchStatus":"no-fix-needed","product":"leagueoflegends.com","severity":"high","severityNote":"339K accounts · passwords exposed","slug":"leagueoflegends-data-breach","stacks":[],"startedAt":"2018-07-28","status":"closed","summary":"In June 2012, the multiplayer online game League of Legends suffered a data breach. At the time, the service had more than 32 million registered accounts and the breach affected various personal data attributes including \"encrypted\" passwords. In 2018, a 339k record subset of the data emerged with email addresses, usernames and plain text passwords, likely cracked from the original cryptographically protected ones. Exposed data: email addresses, passwords, usernames. The breach dates from Jun 11, 2012; Have I Been Pwned loaded it on Jul 28, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"League of Legends data breach: 339K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/leagueoflegends-data-breach","vendor":"League of Legends"},{"auto":true,"category":"breach","closedAt":"2018-08-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EXACTIS"],"json":"https://helix.ml/threat-watch/i/exactis-data-breach.json","latestUpdate":{"date":"2018-07-25","title":"Have I Been Pwned loaded 131.6M breached Exactis accounts"},"patchStatus":"no-fix-needed","product":"exactis.com","severity":"high","severityNote":"131.6M accounts","slug":"exactis-data-breach","stacks":[],"startedAt":"2018-07-25","status":"closed","summary":"In June 2018, the marketing firm Exactis inadvertently publicly leaked 340 million records of personal data. Security researcher Vinny Troia of Night Lion Security discovered the leak contained multiple terabytes of personal information spread across hundreds of separate fields including addresses, phone numbers, family structures and extensive profiling data. The data was collected as part of Exactis' service as a \"compiler and aggregator of premium business \u0026 consumer data\" which they then sell for profiling and marketing purposes. A small subset of the exposed fields were provided to Have I Been Pwned and contained 132 million unique email addresses. Exposed data: credit status information, dates of birth, education levels, email addresses, ethnicities, family structure, financial investments, genders, home ownership statuses, income levels, ip addresses, marital statuses, names, net worths, occupations, personal interests, phone numbers, physical addresses, religions, spoken languages. The breach dates from Jun 1, 2018; Have I Been Pwned loaded it on Jul 25, 2018.","tags":["data-breach","hibp","credit-status-information","dates-of-birth","education-levels","email-addresses","ethnicities","family-structure","financial-investments","genders","home-ownership-statuses","income-levels","ip-addresses","marital-statuses"],"title":"Exactis data breach: 131.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/exactis-data-breach","vendor":"Exactis"},{"auto":true,"category":"breach","closedAt":"2018-08-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FUNNYGAMES"],"json":"https://helix.ml/threat-watch/i/funnygames-data-breach.json","latestUpdate":{"date":"2018-07-24","title":"Have I Been Pwned loaded 764K breached Funny Games accounts"},"patchStatus":"no-fix-needed","product":"funny-games.biz","severity":"high","severityNote":"764K accounts · passwords exposed","slug":"funnygames-data-breach","stacks":[],"startedAt":"2018-07-24","status":"closed","summary":"In April 2018, the online entertainment site Funny Games suffered a data breach that disclosed 764k records including usernames, email and IP addresses and salted MD5 password hashes. The incident was disclosed to Funny Games in July who acknowledged the breach and identified it had been caused by legacy code no longer in use. The record count in the breach constitute approximately half of the user base. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 28, 2018; Have I Been Pwned loaded it on Jul 24, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Funny Games data breach: 764K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/funnygames-data-breach","vendor":"Funny Games"},{"auto":true,"category":"breach","closedAt":"2018-07-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIGHTSHOPE"],"json":"https://helix.ml/threat-watch/i/lightshope-data-breach.json","latestUpdate":{"date":"2018-07-04","title":"Have I Been Pwned loaded 30K breached Light's Hope accounts"},"patchStatus":"no-fix-needed","product":"lightshope.org","severity":"high","severityNote":"30K accounts · passwords exposed","slug":"lightshope-data-breach","stacks":[],"startedAt":"2018-07-04","status":"closed","summary":"In June 2018, the World of Warcraft service Light's Hope suffered a data breach which they subsequently self-submitted to HIBP. Over 30K unique users were impacted and their exposed data included email addresses, dates of birth, private messages and passwords stored as bcrypt hashes. Exposed data: dates of birth, email addresses, geographic locations, ip addresses, passwords, private messages, usernames. The breach dates from Jun 25, 2018; Have I Been Pwned loaded it on Jul 4, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","ip-addresses","passwords","private-messages","usernames"],"title":"Light's Hope data breach: 30K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lightshope-data-breach","vendor":"Light's Hope"},{"auto":true,"category":"breach","closedAt":"2018-07-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YATRA"],"json":"https://helix.ml/threat-watch/i/yatra-data-breach.json","latestUpdate":{"date":"2018-07-04","title":"Have I Been Pwned loaded 5.0M breached Yatra accounts"},"patchStatus":"no-fix-needed","product":"yatra.com","severity":"high","severityNote":"5.0M accounts · passwords exposed","slug":"yatra-data-breach","stacks":[],"startedAt":"2018-07-04","status":"closed","summary":"In September 2013, the Indian bookings website known as Yatra had 5 million records exposed in a data breach. The data contained email and physical addresses, dates of birth and phone numbers along with both PINs and passwords stored in plain text. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: dates of birth, email addresses, names, passwords, phone numbers, physical addresses, pins. The breach dates from Sep 1, 2013; Have I Been Pwned loaded it on Jul 4, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","phone-numbers","physical-addresses","pins"],"title":"Yatra data breach: 5.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/yatra-data-breach","vendor":"Yatra"},{"auto":true,"category":"breach","closedAt":"2018-07-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAADI"],"json":"https://helix.ml/threat-watch/i/gaadi-data-breach.json","latestUpdate":{"date":"2018-07-01","title":"Have I Been Pwned loaded 4.3M breached Gaadi accounts"},"patchStatus":"no-fix-needed","product":"gaadi.com","severity":"high","severityNote":"4.3M accounts · passwords exposed","slug":"gaadi-data-breach","stacks":[],"startedAt":"2018-07-01","status":"closed","summary":"In May 2015, the Indian motoring website known as Gaadi had 4.3 million records exposed in a data breach. The data contained usernames, email and IP addresses, genders, the city of users as well as passwords stored in both plain text and as MD5 hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: email addresses, genders, geographic locations, ip addresses, names, passwords, phone numbers, usernames. The breach dates from May 14, 2015; Have I Been Pwned loaded it on Jul 1, 2018.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","ip-addresses","names","passwords","phone-numbers","usernames"],"title":"Gaadi data breach: 4.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gaadi-data-breach","vendor":"Gaadi"},{"auto":true,"category":"breach","closedAt":"2018-06-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ESTONIA"],"json":"https://helix.ml/threat-watch/i/estonia-data-breach.json","latestUpdate":{"date":"2018-06-11","title":"Have I Been Pwned loaded 655K breached Estonian Citizens (via Estonian Cybercrime Bureau) accounts"},"patchStatus":"no-fix-needed","product":"Estonian Citizens (via Estonian Cybercrime Bureau)","severity":"high","severityNote":"655K accounts · passwords exposed","slug":"estonia-data-breach","stacks":[],"startedAt":"2018-06-11","status":"closed","summary":"In June 2018, the Cybercrime Bureau of the Estonian Central Criminal Police contacted HIBP and asked for assistance in making a data set of 655k email addresses searchable. The Estonian police suspected the email addresses and passwords they obtained were being used to access mailboxes, cryptocurrency exchanges, cloud service accounts and other similar online assets. They've requested that individuals who find themselves in the data set and also identify that cryptocurrency has been stolen contact them at cybercrime@politsei.ee. Exposed data: email addresses, passwords. The breach dates from Jun 7, 2018; Have I Been Pwned loaded it on Jun 11, 2018.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Estonian Citizens (via Estonian Cybercrime Bureau) data breach: 655K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/estonia-data-breach","vendor":"Estonian Citizens (via Estonian Cybercrime Bureau)"},{"auto":true,"category":"breach","closedAt":"2018-06-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LINUXFORUMS"],"json":"https://helix.ml/threat-watch/i/linuxforums-data-breach.json","latestUpdate":{"date":"2018-06-07","title":"Have I Been Pwned loaded 275K breached Linux Forums accounts"},"patchStatus":"no-fix-needed","product":"linuxforums.org","severity":"high","severityNote":"275K accounts · passwords exposed","slug":"linuxforums-data-breach","stacks":[],"startedAt":"2018-06-07","status":"closed","summary":"In May 2018, the Linux Forums website suffered a data breach which resulted in the disclosure of 276k unique email addresses. Running on an old version of vBulletin, the breach also disclosed usernames, IP addresses and salted MD5 password hashes. Linux Forums did not respond to multiple attempts to contact them about the breach. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 1, 2018; Have I Been Pwned loaded it on Jun 7, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Linux Forums data breach: 275K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/linuxforums-data-breach","vendor":"Linux Forums"},{"auto":true,"category":"breach","closedAt":"2018-06-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CREATIVE"],"json":"https://helix.ml/threat-watch/i/creative-data-breach.json","latestUpdate":{"date":"2018-06-07","title":"Have I Been Pwned loaded 483K breached Creative accounts"},"patchStatus":"no-fix-needed","product":"creative.com","severity":"high","severityNote":"483K accounts · passwords exposed","slug":"creative-data-breach","stacks":[],"startedAt":"2018-06-07","status":"closed","summary":"In May 2018, the forum for Singaporean hardware company Creative Technology suffered a data breach which resulted in the disclosure of 483k unique email addresses. Running on an old version of vBulletin, the breach also disclosed usernames, IP addresses and salted MD5 password hashes. After being notified of the incident, Creative permanently shut down the forum. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 1, 2018; Have I Been Pwned loaded it on Jun 7, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Creative data breach: 483K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/creative-data-breach","vendor":"Creative"},{"auto":true,"category":"breach","closedAt":"2018-06-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TICKETFLY"],"json":"https://helix.ml/threat-watch/i/ticketfly-data-breach.json","latestUpdate":{"date":"2018-06-03","title":"Have I Been Pwned loaded 26.2M breached Ticketfly accounts"},"patchStatus":"no-fix-needed","product":"ticketfly.com","severity":"medium","severityNote":"26.2M accounts","slug":"ticketfly-data-breach","stacks":[],"startedAt":"2018-06-03","status":"closed","summary":"In May 2018, the website for the ticket distribution service Ticketfly was defaced by an attacker and was subsequently taken offline. The attacker allegedly requested a ransom to share details of the vulnerability with Ticketfly but did not receive a reply and subsequently posted the breached data online to a publicly accessible location. The data included over 26 million unique email addresses along with names, physical addresses and phone numbers. Whilst there were no passwords in the publicly leaked data, Ticketfly later issued an incident update and stated that \"It is possible, however, that hashed values of password credentials could have been accessed\". Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from May 31, 2018; Have I Been Pwned loaded it on Jun 3, 2018.","tags":["data-breach","hibp","email-addresses","names","phone-numbers","physical-addresses"],"title":"Ticketfly data breach: 26.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ticketfly-data-breach","vendor":"Ticketfly"},{"auto":true,"category":"breach","closedAt":"2018-06-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VIEWFINES"],"json":"https://helix.ml/threat-watch/i/viewfines-data-breach.json","latestUpdate":{"date":"2018-05-24","title":"Have I Been Pwned loaded 777K breached ViewFines accounts"},"patchStatus":"no-fix-needed","product":"viewfines.co.za","severity":"high","severityNote":"777K accounts · passwords exposed","slug":"viewfines-data-breach","stacks":[],"startedAt":"2018-05-24","status":"closed","summary":"In May 2018, the South African website for viewing traffic fines online known as ViewFines suffered a data breach. Over 934k records containing 778k unique email addresses were exposed and included names, phone numbers, government issued IDs and passwords stored in plain text. Exposed data: email addresses, government issued ids, names, passwords, phone numbers. The breach dates from May 7, 2018; Have I Been Pwned loaded it on May 24, 2018.","tags":["data-breach","hibp","email-addresses","government-issued-ids","names","passwords","phone-numbers"],"title":"ViewFines data breach: 777K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/viewfines-data-breach","vendor":"ViewFines"},{"auto":true,"category":"breach","closedAt":"2018-05-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VNG"],"json":"https://helix.ml/threat-watch/i/vng-data-breach.json","latestUpdate":{"date":"2018-04-28","title":"Have I Been Pwned loaded 24.9M breached VNG accounts"},"patchStatus":"no-fix-needed","product":"zing.vn","severity":"high","severityNote":"24.9M accounts · passwords exposed","slug":"vng-data-breach","stacks":[],"startedAt":"2018-04-28","status":"closed","summary":"In April 2018, news broke of a massive data breach impacting the Vietnamese company known as VNG after data was discovered being traded on a popular hacking forum where it was extensively redistributed. The breach dated back to an incident in May of 2015 and included of over 163 million customers. The data in the breach contained a wide range of personal attributes including usernames, birth dates, genders and home addresses along with unsalted MD5 hashes and 25 million unique email addresses. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, email addresses, genders, ip addresses, marital statuses, names, occupations, passwords, phone numbers, physical addresses, usernames. The breach dates from May 19, 2015; Have I Been Pwned loaded it on Apr 28, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","marital-statuses","names","occupations","passwords","phone-numbers","physical-addresses","usernames"],"title":"VNG data breach: 24.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/vng-data-breach","vendor":"VNG"},{"auto":true,"category":"breach","closedAt":"2018-05-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ILIKECHEATS"],"json":"https://helix.ml/threat-watch/i/ilikecheats-data-breach.json","latestUpdate":{"date":"2018-04-22","title":"Have I Been Pwned loaded 188K breached ILikeCheats accounts"},"patchStatus":"no-fix-needed","product":"ilikecheats.net","severity":"high","severityNote":"188K accounts · passwords exposed","slug":"ilikecheats-data-breach","stacks":[],"startedAt":"2018-04-22","status":"closed","summary":"In October 2014, the game cheats website known as ILikeCheats suffered a data breach that exposed 189k accounts. The vBulletin based forum leaked usernames, IP and email addresses and weak MD5 hashes of passwords. The data was provided with support from dehashed.com. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 18, 2014; Have I Been Pwned loaded it on Apr 22, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"ILikeCheats data breach: 188K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ilikecheats-data-breach","vendor":"ILikeCheats"},{"auto":true,"category":"breach","closedAt":"2018-05-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CASHCRATE"],"json":"https://helix.ml/threat-watch/i/cashcrate-data-breach.json","latestUpdate":{"date":"2018-04-20","title":"Have I Been Pwned loaded 6.8M breached CashCrate accounts"},"patchStatus":"no-fix-needed","product":"cashcrate.com","severity":"high","severityNote":"6.8M accounts · passwords exposed","slug":"cashcrate-data-breach","stacks":[],"startedAt":"2018-04-20","status":"closed","summary":"In June 2017, news broke that CashCrate had suffered a data breach exposing 6.8 million records. The breach of the cash-for-surveys site dated back to November 2016 and exposed names, physical addresses, email addresses and passwords stored in plain text for older accounts along with weak MD5 hashes for newer ones. Exposed data: email addresses, names, passwords, physical addresses. The breach dates from Nov 17, 2016; Have I Been Pwned loaded it on Apr 20, 2018.","tags":["data-breach","hibp","email-addresses","names","passwords","physical-addresses"],"title":"CashCrate data breach: 6.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cashcrate-data-breach","vendor":"CashCrate"},{"auto":true,"category":"breach","closedAt":"2018-05-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TARINGA"],"json":"https://helix.ml/threat-watch/i/taringa-data-breach.json","latestUpdate":{"date":"2018-04-19","title":"Have I Been Pwned loaded 28.0M breached Taringa accounts"},"patchStatus":"no-fix-needed","product":"taringa.net","severity":"high","severityNote":"28.0M accounts · passwords exposed","slug":"taringa-data-breach","stacks":[],"startedAt":"2018-04-19","status":"closed","summary":"In September 2017, news broke that Taringa had suffered a data breach exposing 28 million records. Known as \"The Latin American Reddit\", Taringa's breach disclosure notice indicated the incident dated back to August that year. The exposed data included usernames, email addresses and weak MD5 hashes of passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 1, 2017; Have I Been Pwned loaded it on Apr 19, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Taringa data breach: 28.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/taringa-data-breach","vendor":"Taringa"},{"auto":true,"category":"breach","closedAt":"2018-04-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SMOGON"],"json":"https://helix.ml/threat-watch/i/smogon-data-breach.json","latestUpdate":{"date":"2018-04-11","title":"Have I Been Pwned loaded 386K breached Smogon accounts"},"patchStatus":"no-fix-needed","product":"smogon.com","severity":"high","severityNote":"386K accounts · passwords exposed","slug":"smogon-data-breach","stacks":[],"startedAt":"2018-04-11","status":"closed","summary":"In April 2018, the Pokémon website known as Smogon announced they'd suffered a data breach. The breach dated back to September 2017 and affected their XenForo based forum. The exposed data included usernames, email addresses, genders and both bcrypt and MD5 password hashes. Exposed data: email addresses, genders, geographic locations, passwords, usernames, website activity. The breach dates from Sep 10, 2017; Have I Been Pwned loaded it on Apr 11, 2018.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","passwords","usernames","website-activity"],"title":"Smogon data breach: 386K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/smogon-data-breach","vendor":"Smogon"},{"auto":true,"category":"breach","closedAt":"2018-04-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BESTIALITYSEXTABOO"],"json":"https://helix.ml/threat-watch/i/bestialitysextaboo-data-breach.json","latestUpdate":{"date":"2018-03-29","title":"Have I Been Pwned loaded 3204 breached Bestialitysextaboo accounts"},"patchStatus":"no-fix-needed","product":"bestialitysextaboo.com","severity":"high","severityNote":"3204 accounts · passwords exposed","slug":"bestialitysextaboo-data-breach","stacks":[],"startedAt":"2018-03-29","status":"closed","summary":"In March 2018, the animal bestiality website known as Bestialitysextaboo was hacked. A collection of various sites running on the same service were also compromised and details of the hack (including links to the data) were posted on a popular forum. In all, more than 3.2k unique email addresses were included alongside usernames, IP addresses, dates of birth, genders and bcrypt hashes of passwords. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, passwords, private messages, usernames. The breach dates from Mar 19, 2018; Have I Been Pwned loaded it on Mar 29, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","passwords","private-messages","usernames"],"title":"Bestialitysextaboo data breach: 3204 accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bestialitysextaboo-data-breach","vendor":"Bestialitysextaboo"},{"auto":true,"category":"breach","closedAt":"2018-04-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MDPI"],"json":"https://helix.ml/threat-watch/i/mdpi-data-breach.json","latestUpdate":{"date":"2018-03-25","title":"Have I Been Pwned loaded 845K breached MDPI accounts"},"patchStatus":"no-fix-needed","product":"mdpi.com","severity":"medium","severityNote":"845K accounts","slug":"mdpi-data-breach","stacks":[],"startedAt":"2018-03-25","status":"closed","summary":"In August 2016, the Swiss scholarly open access publisher known as MDPI had 17.5GB of data obtained from an unprotected Mongo DB instance. The data contained email exchanges between MDPI and their authors and reviewers which included 845k unique email addresses. MDPI have confirmed that the system has since been protected and that no data of a sensitive nature was impacted. As such, they concluded that notification to their subscribers was not necessary due to the fact that all their authors and reviewers are available online on their website. Exposed data: email addresses, email messages, ip addresses, names. The breach dates from Aug 30, 2016; Have I Been Pwned loaded it on Mar 25, 2018.","tags":["data-breach","hibp","email-addresses","email-messages","ip-addresses","names"],"title":"MDPI data breach: 845K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mdpi-data-breach","vendor":"MDPI"},{"auto":true,"category":"breach","closedAt":"2018-04-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLVS"],"json":"https://helix.ml/threat-watch/i/flvs-data-breach.json","latestUpdate":{"date":"2018-03-18","title":"Have I Been Pwned loaded 542K breached Florida Virtual School accounts"},"patchStatus":"no-fix-needed","product":"flvs.net","severity":"high","severityNote":"542K accounts · passwords exposed","slug":"flvs-data-breach","stacks":[],"startedAt":"2018-03-18","status":"closed","summary":"In March 2018, the Florida Virtual School (FLVS) posted a data breach notification to their website. The school had identified a data breach which had occurred sometime between 6 May 2016 and 12 Feb 2018 and an XML file containing 368k student records was subsequently found circulating. Each record contained student name, date of birth, password, grade, email and parent email resulting in a total of 543k unique email addresses. Due to the prevalence of email addresses belonging to individuals who are still legally children, the data breach has been flagged as \"sensitive\". Exposed data: dates of birth, email addresses, names, passwords, school grades (class levels), usernames. The breach dates from Feb 12, 2018; Have I Been Pwned loaded it on Mar 18, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","school-grades-class-levels","usernames"],"title":"Florida Virtual School data breach: 542K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/flvs-data-breach","vendor":"Florida Virtual School"},{"auto":true,"category":"breach","closedAt":"2018-03-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MANGAFOX"],"json":"https://helix.ml/threat-watch/i/mangafox-data-breach.json","latestUpdate":{"date":"2018-03-17","title":"Have I Been Pwned loaded 1.3M breached MangaFox.me accounts"},"patchStatus":"no-fix-needed","product":"mangafox.me","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"mangafox-data-breach","stacks":[],"startedAt":"2018-03-17","status":"closed","summary":"In approximately July 2016, the manga website known as mangafox.me suffered a data breach. The vBulletin based forum exposed 1.3 million accounts including usernames, email and IP addresses, dates of birth and salted MD5 password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jun 1, 2016; Have I Been Pwned loaded it on Mar 17, 2018.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"MangaFox.me data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mangafox-data-breach","vendor":"MangaFox.me"},{"auto":true,"category":"breach","closedAt":"2018-03-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:XHAMSTER"],"json":"https://helix.ml/threat-watch/i/xhamster-data-breach.json","latestUpdate":{"date":"2018-03-08","title":"Have I Been Pwned loaded 377K breached xHamster accounts"},"patchStatus":"no-fix-needed","product":"xhamster.com","severity":"high","severityNote":"377K accounts · passwords exposed","slug":"xhamster-data-breach","stacks":[],"startedAt":"2018-03-08","status":"closed","summary":"In November 2016, news broke that hackers were trading hundreds of thousands of xHamster porn account details. In total, the data contained almost 380k unique user records including email addresses, usernames and unsalted MD5 password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Nov 28, 2016; Have I Been Pwned loaded it on Mar 8, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"xHamster data breach: 377K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/xhamster-data-breach","vendor":"xHamster"},{"auto":true,"category":"breach","closedAt":"2018-03-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNDERWORLDEMPIRE"],"json":"https://helix.ml/threat-watch/i/underworldempire-data-breach.json","latestUpdate":{"date":"2018-02-19","title":"Have I Been Pwned loaded 428K breached Underworld Empire accounts"},"patchStatus":"no-fix-needed","product":"underworldempireforums.com","severity":"high","severityNote":"428K accounts · passwords exposed","slug":"underworldempire-data-breach","stacks":[],"startedAt":"2018-02-19","status":"closed","summary":"In April 2017, the vBulletin forum for the Underworld Empire game suffered a data breach that exposed 429k accounts. The data was then posted to a hacking forum in mid-February 2018 where it was made available to download. The source data contained IP and email addresses, usernames and salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 25, 2017; Have I Been Pwned loaded it on Feb 19, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Underworld Empire data breach: 428K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/underworldempire-data-breach","vendor":"Underworld Empire"},{"auto":true,"category":"breach","closedAt":"2018-03-02","cveIds":[],"exploited":"unknown","identifiers":["HIBP:8TRACKS"],"json":"https://helix.ml/threat-watch/i/8tracks-data-breach.json","latestUpdate":{"date":"2018-02-16","title":"Have I Been Pwned loaded 18.0M breached 8tracks accounts"},"patchStatus":"no-fix-needed","product":"8tracks.com","severity":"high","severityNote":"18.0M accounts · passwords exposed","slug":"8tracks-data-breach","stacks":[],"startedAt":"2018-02-16","status":"closed","summary":"In June 2017, the online playlists service known as 8Tracks suffered a data breach which impacted 18 million accounts. In their disclosure, 8Tracks advised that \"the vector for the attack was an employee’s GitHub account, which was not secured using two-factor authentication\". Salted SHA-1 password hashes for users who didn't sign up with either Google or Facebook authentication were also included. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies and contained almost 8 million unique email addresses. The complete set of 18M records was later provided by JimScott.Sec@protonmail.com and updated in HIBP accordingly. Exposed data: email addresses, passwords. The breach dates from Jun 27, 2017; Have I Been Pwned loaded it on Feb 16, 2018.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"8tracks data breach: 18.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/8tracks-data-breach","vendor":"8tracks"},{"auto":true,"category":"breach","closedAt":"2018-02-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PLAYGAR"],"json":"https://helix.ml/threat-watch/i/playgar-data-breach.json","latestUpdate":{"date":"2018-02-14","title":"Have I Been Pwned loaded 143K breached Guns and Robots accounts"},"patchStatus":"no-fix-needed","product":"play-gar.com","severity":"high","severityNote":"143K accounts · passwords exposed","slug":"playgar-data-breach","stacks":[],"startedAt":"2018-02-14","status":"closed","summary":"In approximately April 2016, the gaming website Guns and Robots suffered a data breach resulting in the exposure of 143k unique records. The data contained email and IP addresses, usernames and SHA-1 password hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 1, 2016; Have I Been Pwned loaded it on Feb 14, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Guns and Robots data breach: 143K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/playgar-data-breach","vendor":"Guns and Robots"},{"auto":true,"category":"breach","closedAt":"2018-02-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AUTOCENTRUM"],"json":"https://helix.ml/threat-watch/i/autocentrum-data-breach.json","latestUpdate":{"date":"2018-02-09","title":"Have I Been Pwned loaded 143K breached Autocentrum.pl accounts"},"patchStatus":"no-fix-needed","product":"autocentrum.pl","severity":"high","severityNote":"143K accounts · passwords exposed","slug":"autocentrum-data-breach","stacks":[],"startedAt":"2018-02-09","status":"closed","summary":"In February 2018, data belonging to the Polish motoring website autocentrum.pl was found online. The data contained 144k email addresses and plain text passwords. Exposed data: email addresses, passwords. The breach dates from Feb 4, 2018; Have I Been Pwned loaded it on Feb 9, 2018.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Autocentrum.pl data breach: 143K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/autocentrum-data-breach","vendor":"Autocentrum.pl"},{"auto":true,"category":"breach","closedAt":"2018-02-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THETVDB"],"json":"https://helix.ml/threat-watch/i/thetvdb-data-breach.json","latestUpdate":{"date":"2018-01-29","title":"Have I Been Pwned loaded 181K breached TheTVDB.com accounts"},"patchStatus":"no-fix-needed","product":"thetvdb.com","severity":"high","severityNote":"181K accounts · passwords exposed","slug":"thetvdb-data-breach","stacks":[],"startedAt":"2018-01-29","status":"closed","summary":"In November 2017, the open television database known as TheTVDB.com suffered a data breach. The breached data was posted to a hacking forum and included 182k records with usernames, email addresses and MySQL password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Nov 21, 2017; Have I Been Pwned loaded it on Jan 29, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"TheTVDB.com data breach: 181K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/thetvdb-data-breach","vendor":"TheTVDB.com"},{"auto":true,"category":"breach","closedAt":"2018-01-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OPENCSGO"],"json":"https://helix.ml/threat-watch/i/opencsgo-data-breach.json","latestUpdate":{"date":"2018-01-15","title":"Have I Been Pwned loaded 512K breached Open CS:GO accounts"},"patchStatus":"no-fix-needed","product":"opencsgo.com","severity":"medium","severityNote":"512K accounts","slug":"opencsgo-data-breach","stacks":[],"startedAt":"2018-01-15","status":"closed","summary":"In December 2017, the website for purchasing Counter-Strike skins known as Open CS:GO (Counter-Strike: Global Offensive) suffered a data breach (address since redirects to dropgun.com). The 10GB file contained an extensive amount of personal information including email and IP addresses, phone numbers, physical addresses and purchase histories. Numerous attempts were made to contact Open CS:GO about the incident, however no responses were received. Exposed data: avatars, email addresses, ip addresses, phone numbers, physical addresses, purchases, social media profiles, usernames. The breach dates from Nov 28, 2017; Have I Been Pwned loaded it on Jan 15, 2018.","tags":["data-breach","hibp","avatars","email-addresses","ip-addresses","phone-numbers","physical-addresses","purchases","social-media-profiles","usernames"],"title":"Open CS:GO data breach: 512K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/opencsgo-data-breach","vendor":"Open CS:GO"},{"auto":true,"category":"breach","closedAt":"2018-01-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LYRICSMANIA"],"json":"https://helix.ml/threat-watch/i/lyricsmania-data-breach.json","latestUpdate":{"date":"2018-01-15","title":"Have I Been Pwned loaded 109K breached Lyrics Mania accounts"},"patchStatus":"no-fix-needed","product":"lyricsmania.com","severity":"high","severityNote":"109K accounts · passwords exposed","slug":"lyricsmania-data-breach","stacks":[],"startedAt":"2018-01-15","status":"closed","summary":"In December 2017, the song lyrics website known as Lyrics Mania suffered a data breach. The data in the breach included 109k usernames, email addresses and plain text passwords. Numerous attempts were made to contact Lyrics Mania about the incident, however no responses were received. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 21, 2017; Have I Been Pwned loaded it on Jan 15, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Lyrics Mania data breach: 109K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lyricsmania-data-breach","vendor":"Lyrics Mania"},{"auto":true,"category":"breach","closedAt":"2018-01-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEFLYONTHEWALL"],"json":"https://helix.ml/threat-watch/i/theflyonthewall-data-breach.json","latestUpdate":{"date":"2018-01-15","title":"Have I Been Pwned loaded 84K breached The Fly on the Wall accounts"},"patchStatus":"no-fix-needed","product":"theflyonthewall.com","severity":"high","severityNote":"84K accounts · passwords exposed · financial data exposed","slug":"theflyonthewall-data-breach","stacks":[],"startedAt":"2018-01-15","status":"closed","summary":"In December 2017, the stock market news website The Fly on the Wall suffered a data breach. The data in the breach included 84k unique email addresses as well as purchase histories and credit card data. Numerous attempts were made to contact The Fly on the Wall about the incident, however no responses were received. Exposed data: age groups, credit cards, email addresses, genders, names, passwords, phone numbers, physical addresses, purchases, usernames. The breach dates from Dec 31, 2017; Have I Been Pwned loaded it on Jan 15, 2018.","tags":["data-breach","hibp","age-groups","credit-cards","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","purchases","usernames"],"title":"The Fly on the Wall data breach: 84K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/theflyonthewall-data-breach","vendor":"The Fly on the Wall"},{"auto":true,"category":"breach","closedAt":"2018-01-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:2FAST4U"],"json":"https://helix.ml/threat-watch/i/2fast4u-data-breach.json","latestUpdate":{"date":"2018-01-07","title":"Have I Been Pwned loaded 17K breached 2fast4u accounts"},"patchStatus":"no-fix-needed","product":"2fast4u.be","severity":"high","severityNote":"17K accounts · passwords exposed","slug":"2fast4u-data-breach","stacks":[],"startedAt":"2018-01-07","status":"closed","summary":"In December 2017, the Belgian motorcycle forum 2fast4u discovered a data breach of their system. The breach of the vBulletin message board impacted over 17k individual users and exposed email addresses, usersnames and salted MD5 passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 20, 2017; Have I Been Pwned loaded it on Jan 7, 2018.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"2fast4u data breach: 17K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/2fast4u-data-breach","vendor":"2fast4u"},{"auto":true,"category":"breach","closedAt":"2018-01-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HOUNDDAWGS"],"json":"https://helix.ml/threat-watch/i/hounddawgs-data-breach.json","latestUpdate":{"date":"2018-01-03","title":"Have I Been Pwned loaded 45K breached HoundDawgs accounts"},"patchStatus":"no-fix-needed","product":"hounddawgs.org","severity":"high","severityNote":"45K accounts · passwords exposed","slug":"hounddawgs-data-breach","stacks":[],"startedAt":"2018-01-03","status":"closed","summary":"In December 2017, the Danish torrent tracker known as HoundDawgs suffered a data breach. More than 55GB of data was dumped publicly and whilst there was initially contention as to the severity of the incident, the data did indeed contain more than 45k unique email addresses complete extensive logs of torrenting activity, IP addresses and SHA1 passwords. Exposed data: email addresses, ip addresses, passwords, website activity. The breach dates from Dec 30, 2017; Have I Been Pwned loaded it on Jan 3, 2018.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","website-activity"],"title":"HoundDawgs data breach: 45K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hounddawgs-data-breach","vendor":"HoundDawgs"},{"auto":true,"category":"breach","closedAt":"2018-01-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANCESTRY"],"json":"https://helix.ml/threat-watch/i/ancestry-data-breach.json","latestUpdate":{"date":"2017-12-24","title":"Have I Been Pwned loaded 297K breached Ancestry accounts"},"patchStatus":"no-fix-needed","product":"ancestry.com","severity":"high","severityNote":"297K accounts · passwords exposed","slug":"ancestry-data-breach","stacks":[],"startedAt":"2017-12-24","status":"closed","summary":"In November 2015, an Ancestry service known as RootsWeb suffered a data breach. The breach was not discovered until late 2017 when a file containing almost 300k email addresses and plain text passwords was identified. Exposed data: email addresses, passwords. The breach dates from Nov 7, 2015; Have I Been Pwned loaded it on Dec 24, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Ancestry data breach: 297K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ancestry-data-breach","vendor":"Ancestry"},{"auto":true,"category":"breach","closedAt":"2017-12-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NETSHOES"],"json":"https://helix.ml/threat-watch/i/netshoes-data-breach.json","latestUpdate":{"date":"2017-12-10","title":"Have I Been Pwned loaded 499K breached Netshoes accounts"},"patchStatus":"no-fix-needed","product":"netshoes.com.br","severity":"medium","severityNote":"499K accounts","slug":"netshoes-data-breach","stacks":[],"startedAt":"2017-12-10","status":"closed","summary":"In December 2017, the online Brazilian retailer known as Netshoes had half a million records allegedly hacked from their system posted publicly. The company was contacted by local Brazilian media outlet Tecmundo and subsequently advised that no indications have been identified of an invasion of the company's systems. However, Netshoes' own systems successfully confirm the presence of matching identifiers and email addresses from the data set, indicating a high likelihood that the data originated from them. Exposed data: dates of birth, email addresses, names, purchases. The breach dates from Dec 7, 2017; Have I Been Pwned loaded it on Dec 10, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","purchases"],"title":"Netshoes data breach: 499K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/netshoes-data-breach","vendor":"Netshoes"},{"auto":true,"category":"breach","closedAt":"2017-12-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DVDSHOPCH"],"json":"https://helix.ml/threat-watch/i/dvdshopch-data-breach.json","latestUpdate":{"date":"2017-12-10","title":"Have I Been Pwned loaded 67K breached dvd-shop.ch accounts"},"patchStatus":"no-fix-needed","product":"dvd-shop.ch","severity":"high","severityNote":"67K accounts · passwords exposed","slug":"dvdshopch-data-breach","stacks":[],"startedAt":"2017-12-10","status":"closed","summary":"In December 2017, the online Swiss DVD store known as dvd-shop.ch suffered a data breach. The incident led to the exposure of 68k email addresses and plain text passwords. The site has since been updated to indicate that it is currently closed. Exposed data: email addresses, passwords. The breach dates from Dec 5, 2017; Have I Been Pwned loaded it on Dec 10, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"dvd-shop.ch data breach: 67K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dvdshopch-data-breach","vendor":"dvd-shop.ch"},{"auto":true,"category":"breach","closedAt":"2017-12-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CRACKINGFORUM"],"json":"https://helix.ml/threat-watch/i/crackingforum-data-breach.json","latestUpdate":{"date":"2017-12-10","title":"Have I Been Pwned loaded 660K breached CrackingForum accounts"},"patchStatus":"no-fix-needed","product":"crackingforum.com","severity":"high","severityNote":"660K accounts · passwords exposed","slug":"crackingforum-data-breach","stacks":[],"startedAt":"2017-12-10","status":"closed","summary":"In approximately mid-2016, the cracking community forum known as CrackingForum suffered a data breach. The vBulletin based forum exposed 660k email and IP addresses, usernames and salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Dec 10, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"CrackingForum data breach: 660K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/crackingforum-data-breach","vendor":"CrackingForum"},{"auto":true,"category":"breach","closedAt":"2017-12-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AITYPE"],"json":"https://helix.ml/threat-watch/i/aitype-data-breach.json","latestUpdate":{"date":"2017-12-08","title":"Have I Been Pwned loaded 20.6M breached ai.type accounts"},"patchStatus":"no-fix-needed","product":"aitype.com","severity":"medium","severityNote":"20.6M accounts","slug":"aitype-data-breach","stacks":[],"startedAt":"2017-12-08","status":"closed","summary":"In December 2017, the virtual keyboard application ai.type was found to have left a huge amount of data publicly facing in an unsecured MongoDB instance. Discovered by researchers at The Kromtech Security Center, the 577GB data set included extensive personal information including over 20 million unique email addresses, social media profiles and address book contacts. The email addresses alone were provided to HIBP to enable impacted users to assess their exposure. Exposed data: address book contacts, apps installed on devices, cellular network names, dates of birth, device information, email addresses, genders, geographic locations, imei numbers, imsi numbers, ip addresses, names, phone numbers, profile photos, social media profiles. The breach dates from Dec 5, 2017; Have I Been Pwned loaded it on Dec 8, 2017.","tags":["data-breach","hibp","address-book-contacts","apps-installed-on-devices","cellular-network-names","dates-of-birth","device-information","email-addresses","genders","geographic-locations","imei-numbers","imsi-numbers","ip-addresses","names"],"title":"ai.type data breach: 20.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/aitype-data-breach","vendor":"ai.type"},{"auto":true,"category":"breach","closedAt":"2017-12-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IMGUR"],"json":"https://helix.ml/threat-watch/i/imgur-data-breach.json","latestUpdate":{"date":"2017-11-25","title":"Have I Been Pwned loaded 1.7M breached imgur accounts"},"patchStatus":"no-fix-needed","product":"imgur.com","severity":"high","severityNote":"1.7M accounts · passwords exposed","slug":"imgur-data-breach","stacks":[],"startedAt":"2017-11-25","status":"closed","summary":"In September 2013, the online image sharing community imgur suffered a data breach. A selection of the data containing 1.7 million email addresses and passwords surfaced more than 4 years later in November 2017. Although imgur stored passwords as SHA-256 hashes, the data in the breach contained plain text passwords suggesting that many of the original hashes had been cracked. imgur advises that they rolled over to bcrypt hashes in 2016. Exposed data: email addresses, passwords. The breach dates from Sep 1, 2013; Have I Been Pwned loaded it on Nov 25, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"imgur data breach: 1.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/imgur-data-breach","vendor":"imgur"},{"auto":true,"category":"breach","closedAt":"2017-12-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOLT"],"json":"https://helix.ml/threat-watch/i/bolt-data-breach.json","latestUpdate":{"date":"2017-11-24","title":"Have I Been Pwned loaded 995K breached Bolt accounts"},"patchStatus":"no-fix-needed","product":"bolt.cd","severity":"high","severityNote":"995K accounts · passwords exposed","slug":"bolt-data-breach","stacks":[],"startedAt":"2017-11-24","status":"closed","summary":"In approximately March 2017, the file sharing website Bolt suffered a data breach resulting in the exposure of 995k unique user records. The data was sourced from their vBulletin forum and contained email and IP addresses, usernames and salted MD5 password hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Mar 1, 2017; Have I Been Pwned loaded it on Nov 24, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Bolt data breach: 995K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bolt-data-breach","vendor":"Bolt"},{"auto":true,"category":"breach","closedAt":"2017-11-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POLICEONE"],"json":"https://helix.ml/threat-watch/i/policeone-data-breach.json","latestUpdate":{"date":"2017-11-15","title":"Have I Been Pwned loaded 709K breached PoliceOne accounts"},"patchStatus":"no-fix-needed","product":"policeone.com","severity":"high","severityNote":"709K accounts · passwords exposed","slug":"policeone-data-breach","stacks":[],"startedAt":"2017-11-15","status":"closed","summary":"In February 2017, the law enforcement website PoliceOne confirmed they'd suffered a data breach. The breach contained over 700k accounts which appeared for sale by a data broker and included email and IP addresses, usernames and salted MD5 password hashes. The file the data was contained in indicated the original breach dated back to July 2014. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2014; Have I Been Pwned loaded it on Nov 15, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"PoliceOne data breach: 709K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/policeone-data-breach","vendor":"PoliceOne"},{"auto":true,"category":"breach","closedAt":"2017-11-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CAFEMOM"],"json":"https://helix.ml/threat-watch/i/cafemom-data-breach.json","latestUpdate":{"date":"2017-11-09","title":"Have I Been Pwned loaded 2.6M breached CafeMom accounts"},"patchStatus":"no-fix-needed","product":"cafemom.com","severity":"high","severityNote":"2.6M accounts · passwords exposed","slug":"cafemom-data-breach","stacks":[],"startedAt":"2017-11-09","status":"closed","summary":"In 2014, the social network for mothers CafeMom suffered a data breach. The data surfaced alongside a number of other historical breaches including Kickstarter, Bitly and Disqus and contained 2.6 million email addresses and plain text passwords. Exposed data: email addresses, passwords. The breach dates from Apr 10, 2014; Have I Been Pwned loaded it on Nov 9, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"CafeMom data breach: 2.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cafemom-data-breach","vendor":"CafeMom"},{"auto":true,"category":"breach","closedAt":"2017-11-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:JOBSTREET"],"json":"https://helix.ml/threat-watch/i/jobstreet-data-breach.json","latestUpdate":{"date":"2017-10-30","title":"Have I Been Pwned loaded 3.9M breached JobStreet accounts"},"patchStatus":"no-fix-needed","product":"jobstreet.com","severity":"high","severityNote":"3.9M accounts · passwords exposed","slug":"jobstreet-data-breach","stacks":[],"startedAt":"2017-10-30","status":"closed","summary":"In October 2017, the Malaysian website lowyat.net ran a story on a massive set of breached data affecting millions of Malaysians after someone posted it for sale on their forums. The data spanned multiple separate breaches including the JobStreet jobs website which contained almost 4 million unique email addresses. The dates in the breach indicate the incident occurred in March 2012. The data later appeared freely downloadable on a Tor hidden service and contained extensive information on job seekers including names, genders, birth dates, phone numbers, physical addresses and passwords. Exposed data: dates of birth, email addresses, genders, geographic locations, government issued ids, marital statuses, names, nationalities, passwords, phone numbers, physical addresses, usernames. The breach dates from Mar 7, 2012; Have I Been Pwned loaded it on Oct 30, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","government-issued-ids","marital-statuses","names","nationalities","passwords","phone-numbers","physical-addresses","usernames"],"title":"JobStreet data breach: 3.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/jobstreet-data-breach","vendor":"JobStreet"},{"auto":true,"category":"breach","closedAt":"2017-11-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SHOTBOW"],"json":"https://helix.ml/threat-watch/i/shotbow-data-breach.json","latestUpdate":{"date":"2017-10-29","title":"Have I Been Pwned loaded 1.1M breached Shotbow accounts"},"patchStatus":"no-fix-needed","product":"shotbow.net","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"shotbow-data-breach","stacks":[],"startedAt":"2017-10-29","status":"closed","summary":"In May 2016, the multiplayer server for Minecraft service Shotbow announced they'd suffered a data breach. The incident resulted in the exposure of over 1 million unique email addresses, usernames and salted SHA-256 password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from May 9, 2016; Have I Been Pwned loaded it on Oct 29, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Shotbow data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/shotbow-data-breach","vendor":"Shotbow"},{"auto":true,"category":"breach","closedAt":"2017-11-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MASTERDEEDS"],"json":"https://helix.ml/threat-watch/i/masterdeeds-data-breach.json","latestUpdate":{"date":"2017-10-18","title":"Have I Been Pwned loaded 2.3M breached Master Deeds accounts"},"patchStatus":"no-fix-needed","product":"Master Deeds","severity":"medium","severityNote":"2.3M accounts","slug":"masterdeeds-data-breach","stacks":[],"startedAt":"2017-10-18","status":"closed","summary":"In March 2017, a 27GB database backup file named \"Master Deeds\" was sent to HIBP by a supporter of the project. Upon detailed analysis later that year, the file was found to contain the personal data of tens of millions of living and deceased South African residents. The data included extensive personal attributes such as names, addresses, ethnicities, genders, birth dates, government issued personal identification numbers and 2.2 million email addresses. At the time of publishing, it's alleged the data was sourced from Dracore Data Sciences (Dracore is yet to publicly confirm or deny the data was sourced from their systems). On 18 October 2017, the file was found to have been published to a publicly accessible web server where it was located at the root of an IP address with directory listing enabled. The file was dated 8 April 2015. Exposed data: dates of birth, deceased statuses, email addresses, employers, ethnicities, genders, government issued ids, home ownership statuses, job titles, names, nationalities, phone numbers, physical addresses. The breach dates from Mar 14, 2017; Have I Been Pwned loaded it on Oct 18, 2017.","tags":["data-breach","hibp","dates-of-birth","deceased-statuses","email-addresses","employers","ethnicities","genders","government-issued-ids","home-ownership-statuses","job-titles","names","nationalities","phone-numbers"],"title":"Master Deeds data breach: 2.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/masterdeeds-data-breach","vendor":"Master Deeds"},{"auto":true,"category":"breach","closedAt":"2017-10-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WEHEARTIT"],"json":"https://helix.ml/threat-watch/i/weheartit-data-breach.json","latestUpdate":{"date":"2017-10-14","title":"Have I Been Pwned loaded 8.6M breached We Heart It accounts"},"patchStatus":"no-fix-needed","product":"weheartit.com","severity":"high","severityNote":"8.6M accounts · passwords exposed","slug":"weheartit-data-breach","stacks":[],"startedAt":"2017-10-14","status":"closed","summary":"In November 2013, the image-based social network We Heart It suffered a data breach. The incident wasn't discovered until October 2017 when 8.6 million user records were sent to HIBP. The data contained user names, email addresses and password hashes, 80% of which were salted SHA-256 with the remainder being MD5 with no salt. Exposed data: email addresses, passwords, usernames. The breach dates from Nov 3, 2013; Have I Been Pwned loaded it on Oct 14, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"We Heart It data breach: 8.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/weheartit-data-breach","vendor":"We Heart It"},{"auto":true,"category":"breach","closedAt":"2017-10-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DIETCOM"],"json":"https://helix.ml/threat-watch/i/dietcom-data-breach.json","latestUpdate":{"date":"2017-10-13","title":"Have I Been Pwned loaded 1.4M breached diet.com accounts"},"patchStatus":"no-fix-needed","product":"diet.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"dietcom-data-breach","stacks":[],"startedAt":"2017-10-13","status":"closed","summary":"In August 2014, the diet and nutrition website diet.com suffered a data breach resulting in the exposure of 1.4 million unique user records dating back as far as 2004. The data contained email and IP addresses, usernames, plain text passwords and dietary information about the site members including eating habits, BMI and birth date. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: dates of birth, eating habits, email addresses, ip addresses, names, passwords, physical attributes, usernames. The breach dates from Aug 10, 2014; Have I Been Pwned loaded it on Oct 13, 2017.","tags":["data-breach","hibp","dates-of-birth","eating-habits","email-addresses","ip-addresses","names","passwords","physical-attributes","usernames"],"title":"diet.com data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dietcom-data-breach","vendor":"diet.com"},{"auto":true,"category":"breach","closedAt":"2017-10-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VICTORYPHONES"],"json":"https://helix.ml/threat-watch/i/victoryphones-data-breach.json","latestUpdate":{"date":"2017-10-11","title":"Have I Been Pwned loaded 166K breached Victory Phones accounts"},"patchStatus":"no-fix-needed","product":"victoryphones.com","severity":"medium","severityNote":"166K accounts","slug":"victoryphones-data-breach","stacks":[],"startedAt":"2017-10-11","status":"closed","summary":"In January 2017, the automated telephony services company Victory Phones left a Mongo DB database publicly facing without a password. Subsequently, 213GB of data was downloaded by an unauthorised party including names, addresses, phone numbers and over 166k unique email addresses. Exposed data: dates of birth, email addresses, ip addresses, names, phone numbers, physical addresses. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Oct 11, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","phone-numbers","physical-addresses"],"title":"Victory Phones data breach: 166K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/victoryphones-data-breach","vendor":"Victory Phones"},{"auto":true,"category":"breach","closedAt":"2017-10-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ABUSEWITHUS"],"json":"https://helix.ml/threat-watch/i/abusewithus-data-breach.json","latestUpdate":{"date":"2017-10-09","title":"Have I Been Pwned loaded 1.4M breached AbuseWith.Us accounts"},"patchStatus":"no-fix-needed","product":"abusewith.us","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"abusewithus-data-breach","stacks":[],"startedAt":"2017-10-09","status":"closed","summary":"In 2016, the site dedicated to helping people hack email and online gaming accounts known as Abusewith.us suffered multiple data breaches. The site allegedly had an administrator in common with the nefarious LeakedSource site, both of which have since been shut down. The exposed data included more than 1.3 million unique email addresses, often accompanied by usernames, IP addresses and plain text or hashed passwords retrieved from various sources and intended to be used to compromise the victims' accounts. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Oct 9, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"AbuseWith.Us data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/abusewithus-data-breach","vendor":"AbuseWith.Us"},{"auto":true,"category":"breach","closedAt":"2017-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BITLY"],"json":"https://helix.ml/threat-watch/i/bitly-data-breach.json","latestUpdate":{"date":"2017-10-06","title":"Have I Been Pwned loaded 9.3M breached Bitly accounts"},"patchStatus":"no-fix-needed","product":"bitly.com","severity":"high","severityNote":"9.3M accounts · passwords exposed","slug":"bitly-data-breach","stacks":[],"startedAt":"2017-10-06","status":"closed","summary":"In May 2014, the link management company Bitly announced they'd suffered a data breach. The breach contained over 9.3 million unique email addresses, usernames and hashed passwords, most using SHA1 with a small number using bcrypt. Exposed data: email addresses, passwords, usernames. The breach dates from May 8, 2014; Have I Been Pwned loaded it on Oct 6, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Bitly data breach: 9.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bitly-data-breach","vendor":"Bitly"},{"auto":true,"category":"breach","closedAt":"2017-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KICKSTARTER"],"json":"https://helix.ml/threat-watch/i/kickstarter-data-breach.json","latestUpdate":{"date":"2017-10-06","title":"Have I Been Pwned loaded 5.2M breached Kickstarter accounts"},"patchStatus":"no-fix-needed","product":"kickstarter.com","severity":"high","severityNote":"5.2M accounts · passwords exposed","slug":"kickstarter-data-breach","stacks":[],"startedAt":"2017-10-06","status":"closed","summary":"In February 2014, the crowdfunding platform Kickstarter announced they'd suffered a data breach. The breach contained almost 5.2 million unique email addresses, usernames and salted SHA1 hashes of passwords. Exposed data: email addresses, passwords. The breach dates from Feb 16, 2014; Have I Been Pwned loaded it on Oct 6, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Kickstarter data breach: 5.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/kickstarter-data-breach","vendor":"Kickstarter"},{"auto":true,"category":"breach","closedAt":"2017-10-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DISQUS"],"json":"https://helix.ml/threat-watch/i/disqus-data-breach.json","latestUpdate":{"date":"2017-10-06","title":"Have I Been Pwned loaded 17.6M breached Disqus accounts"},"patchStatus":"no-fix-needed","product":"disqus.com","severity":"high","severityNote":"17.6M accounts · passwords exposed","slug":"disqus-data-breach","stacks":[],"startedAt":"2017-10-06","status":"closed","summary":"In October 2017, the blog commenting service Disqus announced they'd suffered a data breach. The breach dated back to July 2012 but wasn't identified until years later when the data finally surfaced. The breach contained over 17.5 million unique email addresses and usernames. Users who created logins on Disqus had salted SHA1 hashes of passwords whilst users who logged in via social providers only had references to those accounts. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 1, 2012; Have I Been Pwned loaded it on Oct 6, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Disqus data breach: 17.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/disqus-data-breach","vendor":"Disqus"},{"auto":true,"category":"breach","closedAt":"2017-10-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STAMINUS"],"json":"https://helix.ml/threat-watch/i/staminus-data-breach.json","latestUpdate":{"date":"2017-10-05","title":"Have I Been Pwned loaded 26K breached Staminus accounts"},"patchStatus":"no-fix-needed","product":"staminus.net","severity":"high","severityNote":"26K accounts · passwords exposed · financial data exposed","slug":"staminus-data-breach","stacks":[],"startedAt":"2017-10-05","status":"closed","summary":"In March 2016, the DDoS protection service Staminus was \"massively hacked\" resulting in an outage of more than 20 hours and the disclosure of customer credentials (with unsalted MD5 hashes), support tickets, credit card numbers and other sensitive data. 27k unique email addresses were found in the data which was subsequently released to the public. Staminus is no longer in operation. Exposed data: credit cards, email addresses, ip addresses, passwords, support tickets, usernames. The breach dates from Mar 11, 2016; Have I Been Pwned loaded it on Oct 5, 2017.","tags":["data-breach","hibp","credit-cards","email-addresses","ip-addresses","passwords","support-tickets","usernames"],"title":"Staminus data breach: 26K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/staminus-data-breach","vendor":"Staminus"},{"auto":true,"category":"breach","closedAt":"2017-10-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:REVERB-NATION"],"json":"https://helix.ml/threat-watch/i/reverb-nation-data-breach.json","latestUpdate":{"date":"2017-10-05","title":"Have I Been Pwned loaded 7.0M breached ReverbNation accounts"},"patchStatus":"no-fix-needed","product":"reverbnation.com","severity":"high","severityNote":"7.0M accounts · passwords exposed","slug":"reverb-nation-data-breach","stacks":[],"startedAt":"2017-10-05","status":"closed","summary":"In January 2014, the online service for assisting musicians to build their careers ReverbNation suffered a data breach which wasn't identified until September the following year. The breach contained over 7 million accounts with unique email addresses and salted SHA1 passwords. Exposed data: email addresses, passwords. The breach dates from Jan 1, 2014; Have I Been Pwned loaded it on Oct 5, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"ReverbNation data breach: 7.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/reverb-nation-data-breach","vendor":"ReverbNation"},{"auto":true,"category":"breach","closedAt":"2017-10-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AKP"],"json":"https://helix.ml/threat-watch/i/akp-data-breach.json","latestUpdate":{"date":"2017-10-01","title":"Have I Been Pwned loaded 917K breached AKP Emails accounts"},"patchStatus":"no-fix-needed","product":"akparti.org.tr","severity":"medium","severityNote":"917K accounts","slug":"akp-data-breach","stacks":[],"startedAt":"2017-10-01","status":"closed","summary":"In July 2016, a hacker known as Phineas Fisher hacked Turkey's ruling party (Justice and Development Party or \"AKP\") and gained access to 300k emails. The full contents of the emails were subsequently published by WikiLeaks and made searchable. HIBP identified over 917k unique email address patterns in the data set, including message IDs and a number of other non-user addresses. Exposed data: email addresses, email messages. The breach dates from Jul 19, 2016; Have I Been Pwned loaded it on Oct 1, 2017.","tags":["data-breach","hibp","email-addresses","email-messages"],"title":"AKP Emails data breach: 917K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/akp-data-breach","vendor":"AKP Emails"},{"auto":true,"category":"breach","closedAt":"2017-09-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MALLCZ"],"json":"https://helix.ml/threat-watch/i/mallcz-data-breach.json","latestUpdate":{"date":"2017-09-04","title":"Have I Been Pwned loaded 735K breached MALL.cz accounts"},"patchStatus":"no-fix-needed","product":"mall.cz","severity":"high","severityNote":"735K accounts · passwords exposed","slug":"mallcz-data-breach","stacks":[],"startedAt":"2017-09-04","status":"closed","summary":"In July 2017, the Czech Republic e-commerce site MALL.cz suffered a data breach after which 735k unique accounts including email addresses, names, phone numbers and passwords were later posted online. Whilst passwords were stored as hashes, a number of different algorithms of varying strength were used over time. All passwords included in the publicly distributed data were in plain text and were likely just those that had been successfully cracked (members with strong passwords don't appear to be included). According to MALL.cz, the breach only impacted accounts created before 2015. Exposed data: email addresses, names, passwords, phone numbers. The breach dates from Jul 27, 2017; Have I Been Pwned loaded it on Sep 4, 2017.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers"],"title":"MALL.cz data breach: 735K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mallcz-data-breach","vendor":"MALL.cz"},{"auto":true,"category":"breach","closedAt":"2017-09-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ZOMATO"],"json":"https://helix.ml/threat-watch/i/zomato-data-breach.json","latestUpdate":{"date":"2017-09-04","title":"Have I Been Pwned loaded 16.5M breached Zomato accounts"},"patchStatus":"no-fix-needed","product":"zomato.com","severity":"high","severityNote":"16.5M accounts · passwords exposed","slug":"zomato-data-breach","stacks":[],"startedAt":"2017-09-04","status":"closed","summary":"In May 2017, the restaurant guide website Zomato was hacked resulting in the exposure of almost 17 million accounts. The data was consequently redistributed online and contains email addresses, usernames and salted MD5 hashes of passwords (the password hash was not present on all accounts). This data was provided to HIBP by whitehat security researcher and data analyst Adam Davies. Exposed data: email addresses, passwords, usernames. The breach dates from May 17, 2017; Have I Been Pwned loaded it on Sep 4, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Zomato data breach: 16.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/zomato-data-breach","vendor":"Zomato"},{"auto":true,"category":"breach","closedAt":"2017-09-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BIOHACKME"],"json":"https://helix.ml/threat-watch/i/biohackme-data-breach.json","latestUpdate":{"date":"2017-08-23","title":"Have I Been Pwned loaded 3402 breached Biohack.me accounts"},"patchStatus":"no-fix-needed","product":"biohack.me","severity":"high","severityNote":"3402 accounts · passwords exposed","slug":"biohackme-data-breach","stacks":[],"startedAt":"2017-08-23","status":"closed","summary":"In December 2016, the forum for the biohacking website Biohack.me suffered a data breach that exposed 3.4k accounts. The data included usernames, email addresses and hashed passwords along with the private messages of forum members. The data was self-submitted to HIBP by the Biohack.me operators. Exposed data: email addresses, passwords, private messages, usernames. The breach dates from Dec 2, 2016; Have I Been Pwned loaded it on Aug 23, 2017.","tags":["data-breach","hibp","email-addresses","passwords","private-messages","usernames"],"title":"Biohack.me data breach: 3402 accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/biohackme-data-breach","vendor":"Biohack.me"},{"auto":true,"category":"breach","closedAt":"2017-09-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BINWEEVILS"],"json":"https://helix.ml/threat-watch/i/binweevils-data-breach.json","latestUpdate":{"date":"2017-08-18","title":"Have I Been Pwned loaded 1.3M breached Bin Weevils accounts"},"patchStatus":"no-fix-needed","product":"binweevils.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"binweevils-data-breach","stacks":[],"startedAt":"2017-08-18","status":"closed","summary":"In September 2014, the online game Bin Weevils suffered a data breach. Whilst originally stating that only usernames and passwords had been exposed, a subsequent story on DataBreaches.net indicated that a more extensive set of personal attributes were impacted (comments there also suggest the data may have come from a later breach). Data matching that pattern was later provided to Have I Been Pwned by @akshayindia6 and included almost 1.3m unique email addresses, genders, ages and plain text passwords. Exposed data: ages, email addresses, genders, ip addresses, passwords, usernames. The breach dates from Sep 1, 2014; Have I Been Pwned loaded it on Aug 18, 2017.","tags":["data-breach","hibp","ages","email-addresses","genders","ip-addresses","passwords","usernames"],"title":"Bin Weevils data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/binweevils-data-breach","vendor":"Bin Weevils"},{"auto":true,"category":"breach","closedAt":"2017-08-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DAILYMOTION"],"json":"https://helix.ml/threat-watch/i/dailymotion-data-breach.json","latestUpdate":{"date":"2017-08-07","title":"Have I Been Pwned loaded 85.2M breached Dailymotion accounts"},"patchStatus":"no-fix-needed","product":"dailymotion.com","severity":"high","severityNote":"85.2M accounts · passwords exposed","slug":"dailymotion-data-breach","stacks":[],"startedAt":"2017-08-07","status":"closed","summary":"In October 2016, the video sharing platform Dailymotion suffered a data breach. The attack led to the exposure of more than 85 million user accounts and included email addresses, usernames and bcrypt hashes of passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Oct 20, 2016; Have I Been Pwned loaded it on Aug 7, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Dailymotion data breach: 85.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dailymotion-data-breach","vendor":"Dailymotion"},{"auto":true,"category":"breach","closedAt":"2017-08-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MCBANS"],"json":"https://helix.ml/threat-watch/i/mcbans-data-breach.json","latestUpdate":{"date":"2017-07-23","title":"Have I Been Pwned loaded 119K breached MCBans accounts"},"patchStatus":"no-fix-needed","product":"mcbans.com","severity":"high","severityNote":"119K accounts · passwords exposed","slug":"mcbans-data-breach","stacks":[],"startedAt":"2017-07-23","status":"closed","summary":"In October 2016, the Minecraft banning service known as MCBans suffered a data breach resulting in the exposure of 120k unique user records. The data contained email and IP addresses, usernames and password hashes of unknown format. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Oct 27, 2016; Have I Been Pwned loaded it on Jul 23, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"MCBans data breach: 119K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mcbans-data-breach","vendor":"MCBans"},{"auto":true,"category":"breach","closedAt":"2017-07-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EVERMOTION"],"json":"https://helix.ml/threat-watch/i/evermotion-data-breach.json","latestUpdate":{"date":"2017-07-02","title":"Have I Been Pwned loaded 435K breached Evermotion accounts"},"patchStatus":"no-fix-needed","product":"evermotion.org","severity":"high","severityNote":"435K accounts · passwords exposed","slug":"evermotion-data-breach","stacks":[],"startedAt":"2017-07-02","status":"closed","summary":"In May 2015, the Polish 3D modelling website known as Evermotion suffered a data breach resulting in the exposure of 435k unique user records. The data was sourced from a vBulletin forum and contained email addresses, usernames, dates of birth and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: dates of birth, email addresses, passwords, usernames. The breach dates from May 7, 2015; Have I Been Pwned loaded it on Jul 2, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","passwords","usernames"],"title":"Evermotion data breach: 435K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/evermotion-data-breach","vendor":"Evermotion"},{"auto":true,"category":"breach","closedAt":"2017-07-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:XPGAMESAVES"],"json":"https://helix.ml/threat-watch/i/xpgamesaves-data-breach.json","latestUpdate":{"date":"2017-07-01","title":"Have I Been Pwned loaded 890K breached XPG accounts"},"patchStatus":"no-fix-needed","product":"xpgamesaves.com","severity":"high","severityNote":"890K accounts · passwords exposed","slug":"xpgamesaves-data-breach","stacks":[],"startedAt":"2017-07-01","status":"closed","summary":"In approximately early 2016, the gaming website Xpgamesaves (XPG) suffered a data breach resulting in the exposure of 890k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory. This data was provided by security researcher and data analyst, Adam Davies. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Jul 1, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"XPG data breach: 890K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/xpgamesaves-data-breach","vendor":"XPG"},{"auto":true,"category":"breach","closedAt":"2017-07-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POWERBOT"],"json":"https://helix.ml/threat-watch/i/powerbot-data-breach.json","latestUpdate":{"date":"2017-07-01","title":"Have I Been Pwned loaded 503K breached Powerbot accounts"},"patchStatus":"no-fix-needed","product":"powerbot.org","severity":"high","severityNote":"503K accounts · passwords exposed","slug":"powerbot-data-breach","stacks":[],"startedAt":"2017-07-01","status":"closed","summary":"In approximately September 2014, the RuneScape bot website Powerbot suffered a data breach resulting in the exposure of over half a million unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 1, 2014; Have I Been Pwned loaded it on Jul 1, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Powerbot data breach: 503K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/powerbot-data-breach","vendor":"Powerbot"},{"auto":true,"category":"breach","closedAt":"2017-07-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PROGRAMMINGFORUMS"],"json":"https://helix.ml/threat-watch/i/programmingforums-data-breach.json","latestUpdate":{"date":"2017-07-01","title":"Have I Been Pwned loaded 707K breached Programming Forums accounts"},"patchStatus":"no-fix-needed","product":"programmingforums.org","severity":"high","severityNote":"707K accounts · passwords exposed","slug":"programmingforums-data-breach","stacks":[],"startedAt":"2017-07-01","status":"closed","summary":"In approximately late 2015, the programming forum at programmingforums.org suffered a data breach resulting in the exposure of 707k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 1, 2015; Have I Been Pwned loaded it on Jul 1, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Programming Forums data breach: 707K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/programmingforums-data-breach","vendor":"Programming Forums"},{"auto":true,"category":"breach","closedAt":"2017-07-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COACHELLA"],"json":"https://helix.ml/threat-watch/i/coachella-data-breach.json","latestUpdate":{"date":"2017-06-27","title":"Have I Been Pwned loaded 599K breached Coachella accounts"},"patchStatus":"no-fix-needed","product":"coachella.com","severity":"high","severityNote":"599K accounts · passwords exposed","slug":"coachella-data-breach","stacks":[],"startedAt":"2017-06-27","status":"closed","summary":"In February 2017, hundreds of thousands of records from the Coachella music festival were discovered being sold online. Allegedly taken from a combination of the main Coachella website and their vBulletin-based message board, the data included almost 600k usernames, IP and email addresses and salted hashes of passwords (MD5 in the case of the message board). Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Feb 22, 2017; Have I Been Pwned loaded it on Jun 27, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Coachella data breach: 599K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/coachella-data-breach","vendor":"Coachella"},{"auto":true,"category":"breach","closedAt":"2017-06-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ABANDONIA"],"json":"https://helix.ml/threat-watch/i/abandonia-data-breach.json","latestUpdate":{"date":"2017-06-05","title":"Have I Been Pwned loaded 776K breached Abandonia (2015) accounts"},"patchStatus":"no-fix-needed","product":"abandonia.com","severity":"high","severityNote":"776K accounts · passwords exposed","slug":"abandonia-data-breach","stacks":[],"startedAt":"2017-06-05","status":"closed","summary":"In November 2015, the gaming website dedicated to classic DOS games Abandonia suffered a data breach resulting in the exposure of 776k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Nov 1, 2015; Have I Been Pwned loaded it on Jun 5, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Abandonia (2015) data breach: 776K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/abandonia-data-breach","vendor":"Abandonia (2015)"},{"auto":true,"category":"breach","closedAt":"2017-06-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EDMODO"],"json":"https://helix.ml/threat-watch/i/edmodo-data-breach.json","latestUpdate":{"date":"2017-06-01","title":"Have I Been Pwned loaded 43.4M breached Edmodo accounts"},"patchStatus":"no-fix-needed","product":"edmodo.com","severity":"high","severityNote":"43.4M accounts · passwords exposed","slug":"edmodo-data-breach","stacks":[],"startedAt":"2017-06-01","status":"closed","summary":"In May 2017, the education platform Edmodo was hacked resulting in the exposure of 77 million records comprised of over 43 million unique customer email addresses. The data was consequently published to a popular hacking forum and made freely available. The records in the breach included usernames, email addresses and bcrypt hashes of passwords. Exposed data: email addresses, passwords, usernames. The breach dates from May 11, 2017; Have I Been Pwned loaded it on Jun 1, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Edmodo data breach: 43.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/edmodo-data-breach","vendor":"Edmodo"},{"auto":true,"category":"breach","closedAt":"2017-06-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DAFONT"],"json":"https://helix.ml/threat-watch/i/dafont-data-breach.json","latestUpdate":{"date":"2017-05-18","title":"Have I Been Pwned loaded 637K breached DaFont accounts"},"patchStatus":"no-fix-needed","product":"dafont.com","severity":"high","severityNote":"637K accounts · passwords exposed","slug":"dafont-data-breach","stacks":[],"startedAt":"2017-05-18","status":"closed","summary":"In May 2017, font sharing site DaFont suffered a data breach resulting in the exposure of 637k records. Allegedly due to a SQL injection vulnerability exploited by multiple parties, the exposed data included usernames, email addresses and passwords stored as MD5 without a salt. Exposed data: email addresses, passwords, usernames. The breach dates from May 16, 2017; Have I Been Pwned loaded it on May 18, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"DaFont data breach: 637K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dafont-data-breach","vendor":"DaFont"},{"auto":true,"category":"breach","closedAt":"2017-05-30","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BELL2017"],"json":"https://helix.ml/threat-watch/i/bell2017-data-breach.json","latestUpdate":{"date":"2017-05-16","title":"Have I Been Pwned loaded 2.2M breached Bell (2017 breach) accounts"},"patchStatus":"no-fix-needed","product":"bell.ca","severity":"high","severityNote":"2.2M accounts · passwords exposed","slug":"bell2017-data-breach","stacks":[],"startedAt":"2017-05-16","status":"closed","summary":"In May 2017, the Bell telecommunications company in Canada suffered a data breach resulting in the exposure of millions of customer records. The data was consequently leaked online with a message from the attacker stating that they were \"releasing a significant portion of Bell.ca's data due to the fact that they have failed to cooperate with us\" and included a threat to leak more. The impacted data included over 2 million unique email addresses and 153k survey results dating back to 2011 and 2012. There were also 162 Bell employee records with more comprehensive personal data including names, phone numbers and plain text \"passcodes\". Bell suffered another breach in 2014 which exposed 40k records. Exposed data: email addresses, geographic locations, ip addresses, job titles, names, passwords, phone numbers, spoken languages, survey results, usernames. The breach dates from May 15, 2017; Have I Been Pwned loaded it on May 16, 2017.","tags":["data-breach","hibp","email-addresses","geographic-locations","ip-addresses","job-titles","names","passwords","phone-numbers","spoken-languages","survey-results","usernames"],"title":"Bell (2017 breach) data breach: 2.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bell2017-data-breach","vendor":"Bell (2017 breach)"},{"auto":true,"category":"breach","closedAt":"2017-05-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RETINAX"],"json":"https://helix.ml/threat-watch/i/retinax-data-breach.json","latestUpdate":{"date":"2017-04-30","title":"Have I Been Pwned loaded 71K breached Retina-X accounts"},"patchStatus":"no-fix-needed","product":"retinax.com","severity":"high","severityNote":"71K accounts · passwords exposed","slug":"retinax-data-breach","stacks":[],"startedAt":"2017-04-30","status":"closed","summary":"In February 2017, the mobile device monitoring software developer Retina-X was hacked and customer data downloaded before being wiped from their servers. The incident was covered in the Motherboard article titled Inside the 'Stalkerware' Surveillance Market, Where Ordinary People Tap Each Other's Phones. The service, used to monitor mobile devices, had 71k email addresses and MD5 hashes with no salt exposed. Retina-X disclosed the incident in a blog post on April 27, 2017. Exposed data: email addresses, passwords. The breach dates from Feb 23, 2017; Have I Been Pwned loaded it on Apr 30, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Retina-X data breach: 71K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/retinax-data-breach","vendor":"Retina-X"},{"auto":true,"category":"breach","closedAt":"2017-05-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:R2-2017"],"json":"https://helix.ml/threat-watch/i/r2-2017-data-breach.json","latestUpdate":{"date":"2017-04-25","title":"Have I Been Pwned loaded 1.0M breached R2 (2017 forum breach) accounts"},"patchStatus":"no-fix-needed","product":"r2games.com","severity":"high","severityNote":"1.0M accounts · passwords exposed","slug":"r2-2017-data-breach","stacks":[],"startedAt":"2017-04-25","status":"closed","summary":"In early 2017, the forum for the gaming website R2 Games was hacked. R2 had previously appeared on HIBP in 2015 after a prior incident. This one exposed over 1 million unique user accounts and corresponding MD5 password hashes with no salt. Exposed data: email addresses, passwords, usernames, website activity. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Apr 25, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames","website-activity"],"title":"R2 (2017 forum breach) data breach: 1.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/r2-2017-data-breach","vendor":"R2 (2017 forum breach)"},{"auto":true,"category":"breach","closedAt":"2017-05-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FASHIONFANTASYGAME"],"json":"https://helix.ml/threat-watch/i/fashionfantasygame-data-breach.json","latestUpdate":{"date":"2017-04-20","title":"Have I Been Pwned loaded 2.4M breached FashionFantasyGame accounts"},"patchStatus":"no-fix-needed","product":"fashionfantasygame.com","severity":"high","severityNote":"2.4M accounts · passwords exposed","slug":"fashionfantasygame-data-breach","stacks":[],"startedAt":"2017-04-20","status":"closed","summary":"In late 2016, the fashion gaming website Fashion Fantasy Game suffered a data breach. The incident exposed 2.3 million unique user accounts and corresponding MD5 password hashes with no salt. The data was contributed to Have I Been Pwned courtesy of rip@creep.im. Exposed data: email addresses, passwords. The breach dates from Dec 1, 2016; Have I Been Pwned loaded it on Apr 20, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"FashionFantasyGame data breach: 2.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/fashionfantasygame-data-breach","vendor":"FashionFantasyGame"},{"auto":true,"category":"breach","closedAt":"2017-04-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YOUKU"],"json":"https://helix.ml/threat-watch/i/youku-data-breach.json","latestUpdate":{"date":"2017-04-15","title":"Have I Been Pwned loaded 91.9M breached Youku accounts"},"patchStatus":"no-fix-needed","product":"youku.com","severity":"high","severityNote":"91.9M accounts · passwords exposed","slug":"youku-data-breach","stacks":[],"startedAt":"2017-04-15","status":"closed","summary":"In late 2016, the online Chinese video service Youku suffered a data breach. The incident exposed 92 million unique user accounts and corresponding MD5 password hashes. The data was contributed to Have I Been Pwned courtesy of rip@creep.im. Exposed data: email addresses, passwords. The breach dates from Dec 1, 2016; Have I Been Pwned loaded it on Apr 15, 2017.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Youku data breach: 91.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/youku-data-breach","vendor":"Youku"},{"auto":true,"category":"breach","closedAt":"2017-04-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HEALTHNOWNETWORKS"],"json":"https://helix.ml/threat-watch/i/healthnownetworks-data-breach.json","latestUpdate":{"date":"2017-04-07","title":"Have I Been Pwned loaded 321K breached Health Now Networks accounts"},"patchStatus":"no-fix-needed","product":"healthnow.co","severity":"medium","severityNote":"321K accounts","slug":"healthnownetworks-data-breach","stacks":[],"startedAt":"2017-04-07","status":"closed","summary":"In March 2017, the telemarketing service Health Now Networks left a database containing hundreds of thousands of medical records exposed. There were over 900,000 records in total containing significant volumes of personal information including names, dates of birth, various medical conditions and operator notes on the individuals' health. The data included over 320k unique email addresses. Exposed data: dates of birth, email addresses, genders, health insurance information, ip addresses, names, personal health data, phone numbers, physical addresses, security questions and answers, social connections. The breach dates from Mar 25, 2017; Have I Been Pwned loaded it on Apr 7, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","health-insurance-information","ip-addresses","names","personal-health-data","phone-numbers","physical-addresses","security-questions-and-answers","social-connections"],"title":"Health Now Networks data breach: 321K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/healthnownetworks-data-breach","vendor":"Health Now Networks"},{"auto":true,"category":"breach","closedAt":"2017-04-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BITCOINTALK"],"json":"https://helix.ml/threat-watch/i/bitcointalk-data-breach.json","latestUpdate":{"date":"2017-03-27","title":"Have I Been Pwned loaded 501K breached Bitcoin Talk accounts"},"patchStatus":"no-fix-needed","product":"bitcointalk.org","severity":"high","severityNote":"501K accounts · passwords exposed","slug":"bitcointalk-data-breach","stacks":[],"startedAt":"2017-03-27","status":"closed","summary":"In May 2015, the Bitcoin forum Bitcoin Talk was hacked and over 500k unique email addresses were exposed. The attack led to the exposure of a raft of personal data including usernames, email and IP addresses, genders, birth dates, security questions and MD5 hashes of their answers plus hashes of the passwords themselves. Exposed data: dates of birth, email addresses, genders, ip addresses, passwords, security questions and answers, usernames, website activity. The breach dates from May 22, 2015; Have I Been Pwned loaded it on Mar 27, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","passwords","security-questions-and-answers","usernames","website-activity"],"title":"Bitcoin Talk data breach: 501K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bitcointalk-data-breach","vendor":"Bitcoin Talk"},{"auto":true,"category":"breach","closedAt":"2017-04-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EVONY"],"json":"https://helix.ml/threat-watch/i/evony-data-breach.json","latestUpdate":{"date":"2017-03-25","title":"Have I Been Pwned loaded 29.4M breached Evony accounts"},"patchStatus":"no-fix-needed","product":"evony.com","severity":"high","severityNote":"29.4M accounts · passwords exposed","slug":"evony-data-breach","stacks":[],"startedAt":"2017-03-25","status":"closed","summary":"In June 2016, the online multiplayer game Evony was hacked and over 29 million unique accounts were exposed. The attack led to the exposure of usernames, email and IP addresses and MD5 hashes of passwords (without salt). Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jun 1, 2016; Have I Been Pwned loaded it on Mar 25, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Evony data breach: 29.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/evony-data-breach","vendor":"Evony"},{"auto":true,"category":"breach","closedAt":"2017-04-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TORRENTINVITES"],"json":"https://helix.ml/threat-watch/i/torrentinvites-data-breach.json","latestUpdate":{"date":"2017-03-22","title":"Have I Been Pwned loaded 352K breached Torrent Invites accounts"},"patchStatus":"no-fix-needed","product":"torrent-invites.com","severity":"high","severityNote":"352K accounts · passwords exposed","slug":"torrentinvites-data-breach","stacks":[],"startedAt":"2017-03-22","status":"closed","summary":"In December 2013, the torrent site Torrent Invites was hacked and over 352k accounts were exposed. The vBulletin forum contained usernames, email and IP addresses, birth dates and salted MD5 hashes of passwords. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Dec 12, 2013; Have I Been Pwned loaded it on Mar 22, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Torrent Invites data breach: 352K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/torrentinvites-data-breach","vendor":"Torrent Invites"},{"auto":true,"category":"breach","closedAt":"2017-04-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SWECLOCKERS"],"json":"https://helix.ml/threat-watch/i/sweclockers-data-breach.json","latestUpdate":{"date":"2017-03-22","title":"Have I Been Pwned loaded 254K breached SweClockers.com accounts"},"patchStatus":"no-fix-needed","product":"sweclockers.com","severity":"high","severityNote":"254K accounts · passwords exposed","slug":"sweclockers-data-breach","stacks":[],"startedAt":"2017-03-22","status":"closed","summary":"In early 2015, the Swedish tech news site SweClockers was hacked and 255k accounts were exposed. The attack led to the exposure of usernames, email addresses and salted hashes of passwords stored with a combination of MD5 and SHA512. Exposed data: email addresses, passwords, usernames. The breach dates from Apr 1, 2015; Have I Been Pwned loaded it on Mar 22, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"SweClockers.com data breach: 254K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sweclockers-data-breach","vendor":"SweClockers.com"},{"auto":true,"category":"breach","closedAt":"2017-04-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HLTV"],"json":"https://helix.ml/threat-watch/i/hltv-data-breach.json","latestUpdate":{"date":"2017-03-22","title":"Have I Been Pwned loaded 611K breached HLTV accounts"},"patchStatus":"no-fix-needed","product":"hltv.org","severity":"high","severityNote":"611K accounts · passwords exposed","slug":"hltv-data-breach","stacks":[],"startedAt":"2017-03-22","status":"closed","summary":"In June 2016, the \"home of competitive Counter Strike\" website HLTV was hacked and 611k accounts were exposed. The attack led to the exposure of names, usernames, email addresses and bcrypt hashes of passwords. Exposed data: email addresses, names, passwords, usernames, website activity. The breach dates from Jun 19, 2016; Have I Been Pwned loaded it on Mar 22, 2017.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames","website-activity"],"title":"HLTV data breach: 611K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hltv-data-breach","vendor":"HLTV"},{"auto":true,"category":"breach","closedAt":"2017-04-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CRIMEAGENCYVBULLETIN"],"json":"https://helix.ml/threat-watch/i/crimeagencyvbulletin-data-breach.json","latestUpdate":{"date":"2017-03-21","title":"Have I Been Pwned loaded 942K breached CrimeAgency vBulletin Hacks accounts"},"patchStatus":"no-fix-needed","product":"CrimeAgency vBulletin Hacks","severity":"high","severityNote":"942K accounts · passwords exposed","slug":"crimeagencyvbulletin-data-breach","stacks":[],"startedAt":"2017-03-21","status":"closed","summary":"In January 2016, a large number of unpatched vBulletin forums were compromised by an actor known as \"CrimeAgency\". A total of 140 forums had data including usernames, email addresses and passwords (predominantly stored as salted MD5 hashes), extracted and then distributed. Refer to the complete list of the forums for further information on which sites were impacted. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 19, 2017; Have I Been Pwned loaded it on Mar 21, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"CrimeAgency vBulletin Hacks data breach: 942K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/crimeagencyvbulletin-data-breach","vendor":"CrimeAgency vBulletin Hacks"},{"auto":true,"category":"breach","closedAt":"2017-03-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SOUNDWAVE"],"json":"https://helix.ml/threat-watch/i/soundwave-data-breach.json","latestUpdate":{"date":"2017-03-17","title":"Have I Been Pwned loaded 130K breached Soundwave accounts"},"patchStatus":"no-fix-needed","product":"soundwave.com","severity":"high","severityNote":"130K accounts · passwords exposed","slug":"soundwave-data-breach","stacks":[],"startedAt":"2017-03-17","status":"closed","summary":"In approximately mid 2015, the music tracking app Soundwave suffered a data breach. The breach stemmed from an incident whereby \"production data had been used to populate the test database\" and was then inadvertently exposed in a MongoDB. The data contained 130k records and included email addresses, dates of birth, genders and MD5 hashes of passwords without a salt. Exposed data: dates of birth, email addresses, genders, geographic locations, names, passwords, social connections. The breach dates from Jul 16, 2015; Have I Been Pwned loaded it on Mar 17, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","names","passwords","social-connections"],"title":"Soundwave data breach: 130K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/soundwave-data-breach","vendor":"Soundwave"},{"auto":true,"category":"breach","closedAt":"2017-03-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WISHBONE"],"json":"https://helix.ml/threat-watch/i/wishbone-data-breach.json","latestUpdate":{"date":"2017-03-15","title":"Have I Been Pwned loaded 2.2M breached Wishbone (2016) accounts"},"patchStatus":"no-fix-needed","product":"wishbone.io","severity":"medium","severityNote":"2.2M accounts","slug":"wishbone-data-breach","stacks":[],"startedAt":"2017-03-15","status":"closed","summary":"In August 2016, the mobile app to \"compare anything\" known as Wishbone suffered a data breach. The data contained 9.4 million records with 2.2 million unique email addresses and was allegedly a subset of the complete data set. The exposed data included genders, birthdates, email addresses and phone numbers for an audience predominantly composed of teenagers and young adults. Exposed data: auth tokens, dates of birth, email addresses, genders, names, phone numbers, usernames. The breach dates from Aug 7, 2016; Have I Been Pwned loaded it on Mar 15, 2017.","tags":["data-breach","hibp","auth-tokens","dates-of-birth","email-addresses","genders","names","phone-numbers","usernames"],"title":"Wishbone (2016) data breach: 2.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wishbone-data-breach","vendor":"Wishbone (2016)"},{"auto":true,"category":"breach","closedAt":"2017-03-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STERKINEKOR"],"json":"https://helix.ml/threat-watch/i/sterkinekor-data-breach.json","latestUpdate":{"date":"2017-03-13","title":"Have I Been Pwned loaded 1.6M breached Ster-Kinekor accounts"},"patchStatus":"no-fix-needed","product":"sterkinekor.co.za","severity":"high","severityNote":"1.6M accounts · passwords exposed","slug":"sterkinekor-data-breach","stacks":[],"startedAt":"2017-03-13","status":"closed","summary":"In 2016, the South African cinema company Ster-Kinekor had a security flaw which leaked a large amount of customer data via an enumeration vulnerability in the API of their old website. Whilst more than 6 million accounts were leaked by the flaw, the exposed data only contained 1.6 million unique email addresses. The data also included extensive personal information such as names, addresses, birthdates, genders and plain text passwords. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, spoken languages. The breach dates from Mar 9, 2017; Have I Been Pwned loaded it on Mar 13, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","spoken-languages"],"title":"Ster-Kinekor data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sterkinekor-data-breach","vendor":"Ster-Kinekor"},{"auto":true,"category":"breach","closedAt":"2017-03-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BTCE"],"json":"https://helix.ml/threat-watch/i/btce-data-breach.json","latestUpdate":{"date":"2017-03-12","title":"Have I Been Pwned loaded 568K breached BTC-E accounts"},"patchStatus":"no-fix-needed","product":"btc-e.com","severity":"high","severityNote":"568K accounts · passwords exposed","slug":"btce-data-breach","stacks":[],"startedAt":"2017-03-12","status":"closed","summary":"In October 2014, the Bitcoin exchange BTC-E was hacked and 568k accounts were exposed. The data included email and IP addresses, wallet balances and hashed passwords. Exposed data: account balances, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Oct 1, 2014; Have I Been Pwned loaded it on Mar 12, 2017.","tags":["data-breach","hibp","account-balances","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"BTC-E data breach: 568K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/btce-data-breach","vendor":"BTC-E"},{"auto":true,"category":"breach","closedAt":"2017-03-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LITTLEMONSTERS"],"json":"https://helix.ml/threat-watch/i/littlemonsters-data-breach.json","latestUpdate":{"date":"2017-03-07","title":"Have I Been Pwned loaded 995K breached Little Monsters accounts"},"patchStatus":"no-fix-needed","product":"littlemonsters.com","severity":"high","severityNote":"995K accounts · passwords exposed","slug":"littlemonsters-data-breach","stacks":[],"startedAt":"2017-03-07","status":"closed","summary":"In approximately January 2017, the Lady Gaga fan site known as \"Little Monsters\" suffered a data breach that impacted 1 million accounts. The data contained usernames, email addresses, dates of birth and bcrypt hashes of passwords. Exposed data: dates of birth, email addresses, passwords, usernames. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Mar 7, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","passwords","usernames"],"title":"Little Monsters data breach: 995K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/littlemonsters-data-breach","vendor":"Little Monsters"},{"auto":true,"category":"breach","closedAt":"2017-03-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CLOUDPETS"],"json":"https://helix.ml/threat-watch/i/cloudpets-data-breach.json","latestUpdate":{"date":"2017-02-27","title":"Have I Been Pwned loaded 583K breached CloudPets accounts"},"patchStatus":"no-fix-needed","product":"cloudpets.com","severity":"high","severityNote":"583K accounts · passwords exposed","slug":"cloudpets-data-breach","stacks":[],"startedAt":"2017-02-27","status":"closed","summary":"In January, the maker of teddy bears that record children's voices and sends them to family and friends via the internet CloudPets left their database publicly exposed and it was subsequently downloaded by external parties (the data was also subject to 3 different ransom demands). 583k records were provided to HIBP via a data trader and included email addresses and bcrypt hashes, but the full extent of user data exposed by the system was over 821k records and also included children's names and references to portrait photos and voice recordings. Exposed data: email addresses, family members' names, passwords. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Feb 27, 2017.","tags":["data-breach","hibp","email-addresses","family-members-names","passwords"],"title":"CloudPets data breach: 583K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cloudpets-data-breach","vendor":"CloudPets"},{"auto":true,"category":"breach","closedAt":"2017-03-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FUNIMATION"],"json":"https://helix.ml/threat-watch/i/funimation-data-breach.json","latestUpdate":{"date":"2017-02-20","title":"Have I Been Pwned loaded 2.5M breached Funimation accounts"},"patchStatus":"no-fix-needed","product":"funimation.com","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"funimation-data-breach","stacks":[],"startedAt":"2017-02-20","status":"closed","summary":"In July 2016, the anime site Funimation suffered a data breach that impacted 2.5 million accounts. The data contained usernames, email addresses, dates of birth and salted SHA1 hashes of passwords. Exposed data: dates of birth, email addresses, passwords, usernames. The breach dates from Jul 1, 2016; Have I Been Pwned loaded it on Feb 20, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","passwords","usernames"],"title":"Funimation data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/funimation-data-breach","vendor":"Funimation"},{"auto":true,"category":"breach","closedAt":"2017-03-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ELANCE"],"json":"https://helix.ml/threat-watch/i/elance-data-breach.json","latestUpdate":{"date":"2017-02-18","title":"Have I Been Pwned loaded 1.3M breached Elance accounts"},"patchStatus":"no-fix-needed","product":"elance.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"elance-data-breach","stacks":[],"startedAt":"2017-02-18","status":"closed","summary":"Sometime in 2009, staffing platform Elance suffered a data breach that impacted 1.3 million accounts. Appearing online 8 years later, the data contained usernames, email addresses, phone numbers and SHA1 hashes of passwords, amongst other personal data. Exposed data: email addresses, employers, geographic locations, passwords, phone numbers, usernames. The breach dates from Jan 1, 2009; Have I Been Pwned loaded it on Feb 18, 2017.","tags":["data-breach","hibp","email-addresses","employers","geographic-locations","passwords","phone-numbers","usernames"],"title":"Elance data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/elance-data-breach","vendor":"Elance"},{"auto":true,"category":"breach","closedAt":"2017-02-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FREEDOMHOSTINGII"],"json":"https://helix.ml/threat-watch/i/freedomhostingii-data-breach.json","latestUpdate":{"date":"2017-02-05","title":"Have I Been Pwned loaded 380K breached Freedom Hosting II accounts"},"patchStatus":"no-fix-needed","product":"fhostingesps6bly.onion","severity":"high","severityNote":"380K accounts · passwords exposed","slug":"freedomhostingii-data-breach","stacks":[],"startedAt":"2017-02-05","status":"closed","summary":"In January 2017, the free hidden service host Freedom Hosting II suffered a data breach. The attack allegedly took down 20% of dark web sites running behind Tor hidden services with the attacker claiming that of the 10,613 impacted sites, more than 50% of the content was child pornography. The hack led to the exposure of MySQL databases for the sites which included a vast amount of information on the hidden services Freedom Hosting II was managing. The impacted data classes far exceeds those listed for the breach and differ between the thousands of impacted sites. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 31, 2017; Have I Been Pwned loaded it on Feb 5, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Freedom Hosting II data breach: 380K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/freedomhostingii-data-breach","vendor":"Freedom Hosting II"},{"auto":true,"category":"breach","closedAt":"2017-02-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HONGFIRE"],"json":"https://helix.ml/threat-watch/i/hongfire-data-breach.json","latestUpdate":{"date":"2017-02-05","title":"Have I Been Pwned loaded 999K breached HongFire accounts"},"patchStatus":"no-fix-needed","product":"hongfire.com","severity":"high","severityNote":"999K accounts · passwords exposed","slug":"hongfire-data-breach","stacks":[],"startedAt":"2017-02-05","status":"closed","summary":"In March 2015, the anime and manga forum HongFire suffered a data breach. The hack of their vBulletin forum led to the exposure of 1 million accounts along with email and IP addresses, usernames, dates of birth and salted MD5 passwords. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Mar 1, 2015; Have I Been Pwned loaded it on Feb 5, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"HongFire data breach: 999K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hongfire-data-breach","vendor":"HongFire"},{"auto":true,"category":"breach","closedAt":"2017-02-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CDPROJEKTRED"],"json":"https://helix.ml/threat-watch/i/cdprojektred-data-breach.json","latestUpdate":{"date":"2017-01-31","title":"Have I Been Pwned loaded 1.9M breached CD Projekt RED accounts"},"patchStatus":"no-fix-needed","product":"cdprojektred.com","severity":"high","severityNote":"1.9M accounts · passwords exposed","slug":"cdprojektred-data-breach","stacks":[],"startedAt":"2017-01-31","status":"closed","summary":"In March 2016, Polish game developer CD Projekt RED suffered a data breach. The hack of their forum led to the exposure of almost 1.9 million accounts along with usernames, email addresses and salted SHA1 passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Mar 1, 2016; Have I Been Pwned loaded it on Jan 31, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"CD Projekt RED data breach: 1.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cdprojektred-data-breach","vendor":"CD Projekt RED"},{"auto":true,"category":"breach","closedAt":"2017-02-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:XBOX360ISO"],"json":"https://helix.ml/threat-watch/i/xbox360iso-data-breach.json","latestUpdate":{"date":"2017-01-29","title":"Have I Been Pwned loaded 1.3M breached Xbox 360 ISO accounts"},"patchStatus":"no-fix-needed","product":"xbox360iso.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"xbox360iso-data-breach","stacks":[],"startedAt":"2017-01-29","status":"closed","summary":"In approximately September 2015, the XBOX 360 forum known as XBOX360 ISO was hacked and 1.2 million accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 25, 2015; Have I Been Pwned loaded it on Jan 29, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Xbox 360 ISO data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/xbox360iso-data-breach","vendor":"Xbox 360 ISO"},{"auto":true,"category":"breach","closedAt":"2017-02-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PSPISO"],"json":"https://helix.ml/threat-watch/i/pspiso-data-breach.json","latestUpdate":{"date":"2017-01-29","title":"Have I Been Pwned loaded 1.3M breached PSP ISO accounts"},"patchStatus":"no-fix-needed","product":"pspiso.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"pspiso-data-breach","stacks":[],"startedAt":"2017-01-29","status":"closed","summary":"In approximately September 2015, the PlayStation PSP forum known as PSP ISO was hacked and almost 1.3 million accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 25, 2015; Have I Been Pwned loaded it on Jan 29, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"PSP ISO data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/pspiso-data-breach","vendor":"PSP ISO"},{"auto":true,"category":"breach","closedAt":"2017-02-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NONNUDEGIRLS"],"json":"https://helix.ml/threat-watch/i/nonnudegirls-data-breach.json","latestUpdate":{"date":"2017-01-25","title":"Have I Been Pwned loaded 75K breached Non Nude Girls accounts"},"patchStatus":"no-fix-needed","product":"nonnudegirls.org","severity":"high","severityNote":"75K accounts · passwords exposed","slug":"nonnudegirls-data-breach","stacks":[],"startedAt":"2017-01-25","status":"closed","summary":"In May 2013, the non-consensual voyeurism site \"Non Nude Girls\" suffered a data breach. The hack of the vBulletin forum led to the exposure of over 75k accounts along with email and IP addresses, names and plain text passwords. Exposed data: email addresses, ip addresses, names, passwords, usernames, website activity. The breach dates from May 21, 2013; Have I Been Pwned loaded it on Jan 25, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","usernames","website-activity"],"title":"Non Nude Girls data breach: 75K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nonnudegirls-data-breach","vendor":"Non Nude Girls"},{"auto":true,"category":"breach","closedAt":"2017-02-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MREXCEL"],"json":"https://helix.ml/threat-watch/i/mrexcel-data-breach.json","latestUpdate":{"date":"2017-01-22","title":"Have I Been Pwned loaded 366K breached MrExcel accounts"},"patchStatus":"no-fix-needed","product":"mrexcel.com","severity":"high","severityNote":"366K accounts · passwords exposed","slug":"mrexcel-data-breach","stacks":[],"startedAt":"2017-01-22","status":"closed","summary":"In December 2016, the forum for the Microsoft Excel tips and solutions site Mr Excel suffered a data breach. The hack of the vBulletin forum led to the exposure of over 366k accounts along with email and IP addresses, dates of birth and salted passwords hashed with MD5. The owner of the MrExcel forum subsequently self-submitted the data to HIBP. Exposed data: dates of birth, email addresses, ip addresses, passwords, social connections, usernames, website activity. The breach dates from Dec 5, 2016; Have I Been Pwned loaded it on Jan 22, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","social-connections","usernames","website-activity"],"title":"MrExcel data breach: 366K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mrexcel-data-breach","vendor":"MrExcel"},{"auto":true,"category":"breach","closedAt":"2017-02-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THECANDIDBOARD"],"json":"https://helix.ml/threat-watch/i/thecandidboard-data-breach.json","latestUpdate":{"date":"2017-01-22","title":"Have I Been Pwned loaded 178K breached The Candid Board accounts"},"patchStatus":"no-fix-needed","product":"thecandidboard.com","severity":"high","severityNote":"178K accounts · passwords exposed","slug":"thecandidboard-data-breach","stacks":[],"startedAt":"2017-01-22","status":"closed","summary":"In September 2015, the non-consensual voyeurism site \"The Candid Board\" suffered a data breach. The hack of the vBulletin forum led to the exposure of over 178k accounts along with email and IP addresses, dates of birth and salted passwords hashed with MD5. Exposed data: dates of birth, email addresses, geographic locations, ip addresses, passwords, usernames, website activity. The breach dates from Sep 3, 2015; Have I Been Pwned loaded it on Jan 22, 2017.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","ip-addresses","passwords","usernames","website-activity"],"title":"The Candid Board data breach: 178K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/thecandidboard-data-breach","vendor":"The Candid Board"},{"auto":true,"category":"breach","closedAt":"2017-01-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QIP"],"json":"https://helix.ml/threat-watch/i/qip-data-breach.json","latestUpdate":{"date":"2017-01-08","title":"Have I Been Pwned loaded 26.2M breached QIP accounts"},"patchStatus":"no-fix-needed","product":"qip.ru","severity":"high","severityNote":"26.2M accounts · passwords exposed","slug":"qip-data-breach","stacks":[],"startedAt":"2017-01-08","status":"closed","summary":"In mid-2011, the Russian instant messaging service known as QIP (Quiet Internet Pager) suffered a data breach. The attack resulted in the disclosure of over 26 million unique accounts including email addresses and passwords with the data eventually appearing in public years later. Exposed data: email addresses, passwords, usernames, website activity. The breach dates from Jun 1, 2011; Have I Been Pwned loaded it on Jan 8, 2017.","tags":["data-breach","hibp","email-addresses","passwords","usernames","website-activity"],"title":"QIP data breach: 26.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/qip-data-breach","vendor":"QIP"},{"auto":true,"category":"breach","closedAt":"2017-01-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POKEMONNEGRO"],"json":"https://helix.ml/threat-watch/i/pokemonnegro-data-breach.json","latestUpdate":{"date":"2017-01-03","title":"Have I Been Pwned loaded 830K breached Pokémon Negro accounts"},"patchStatus":"no-fix-needed","product":"pokemonnegro.com","severity":"high","severityNote":"830K accounts · passwords exposed","slug":"pokemonnegro-data-breach","stacks":[],"startedAt":"2017-01-03","status":"closed","summary":"In approximately October 2016, the Spanish Pokémon site Pokémon Negro suffered a data breach. The attack resulted in the disclosure of 830k accounts including email and IP addresses along with plain text passwords. Pokémon Negro did not respond when contacted about the breach. Exposed data: email addresses, ip addresses, passwords. The breach dates from Oct 1, 2016; Have I Been Pwned loaded it on Jan 3, 2017.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords"],"title":"Pokémon Negro data breach: 830K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/pokemonnegro-data-breach","vendor":"Pokémon Negro"},{"auto":true,"category":"breach","closedAt":"2017-01-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CROSSFIRE"],"json":"https://helix.ml/threat-watch/i/crossfire-data-breach.json","latestUpdate":{"date":"2016-12-28","title":"Have I Been Pwned loaded 12.9M breached Cross Fire accounts"},"patchStatus":"no-fix-needed","product":"cfire.mail.ru","severity":"high","severityNote":"12.9M accounts · passwords exposed","slug":"crossfire-data-breach","stacks":[],"startedAt":"2016-12-28","status":"closed","summary":"In August 2016, the Russian gaming forum known as Cross Fire (or cfire.mail.ru) was hacked along with a number of other forums on the Russian mail provider, mail.ru. The vBulletin forum contained 12.8 million accounts including usernames, email addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 8, 2016; Have I Been Pwned loaded it on Dec 28, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Cross Fire data breach: 12.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/crossfire-data-breach","vendor":"Cross Fire"},{"auto":true,"category":"breach","closedAt":"2017-01-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PARAPA"],"json":"https://helix.ml/threat-watch/i/parapa-data-breach.json","latestUpdate":{"date":"2016-12-28","title":"Have I Been Pwned loaded 4.9M breached Пара Па accounts"},"patchStatus":"no-fix-needed","product":"parapa.mail.ru","severity":"high","severityNote":"4.9M accounts · passwords exposed","slug":"parapa-data-breach","stacks":[],"startedAt":"2016-12-28","status":"closed","summary":"In August 2016, the Russian gaming site known as Пара Па (or parapa.mail.ru) was hacked along with a number of other forums on the Russian mail provider, mail.ru. The vBulletin forum contained 4.9 million accounts including usernames, email addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 8, 2016; Have I Been Pwned loaded it on Dec 28, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Пара Па data breach: 4.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/parapa-data-breach","vendor":"Пара Па"},{"auto":true,"category":"breach","closedAt":"2017-01-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DANIWEB"],"json":"https://helix.ml/threat-watch/i/daniweb-data-breach.json","latestUpdate":{"date":"2016-12-28","title":"Have I Been Pwned loaded 1.1M breached DaniWeb accounts"},"patchStatus":"no-fix-needed","product":"daniweb.com","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"daniweb-data-breach","stacks":[],"startedAt":"2016-12-28","status":"closed","summary":"In late 2015, the technology and social site DaniWeb suffered a data breach. The attack resulted in the disclosure of 1.1 million accounts including email and IP addresses which were also accompanied by salted MD5 hashes of passwords. However, DaniWeb have advised that \"the breached password hashes and salts are incorrect\" and that they have since switched to new infrastructure and software. Exposed data: email addresses, ip addresses, passwords. The breach dates from Dec 1, 2015; Have I Been Pwned loaded it on Dec 28, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords"],"title":"DaniWeb data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/daniweb-data-breach","vendor":"DaniWeb"},{"auto":true,"category":"breach","closedAt":"2017-01-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KIMSUFI"],"json":"https://helix.ml/threat-watch/i/kimsufi-data-breach.json","latestUpdate":{"date":"2016-12-27","title":"Have I Been Pwned loaded 504K breached Kimsufi accounts"},"patchStatus":"no-fix-needed","product":"kimsufi.com","severity":"high","severityNote":"504K accounts · passwords exposed","slug":"kimsufi-data-breach","stacks":[],"startedAt":"2016-12-27","status":"closed","summary":"In mid-2015, the forum for the providers of affordable dedicated servers known as Kimsufi suffered a data breach. The vBulletin forum contained over half a million accounts including usernames, email and IP addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 1, 2015; Have I Been Pwned loaded it on Dec 27, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Kimsufi data breach: 504K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/kimsufi-data-breach","vendor":"Kimsufi"},{"auto":true,"category":"breach","closedAt":"2017-01-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OVH"],"json":"https://helix.ml/threat-watch/i/ovh-data-breach.json","latestUpdate":{"date":"2016-12-27","title":"Have I Been Pwned loaded 452K breached OVH accounts"},"patchStatus":"no-fix-needed","product":"ovh.com","severity":"high","severityNote":"452K accounts · passwords exposed","slug":"ovh-data-breach","stacks":[],"startedAt":"2016-12-27","status":"closed","summary":"In mid-2015, the forum for the hosting provider known as OVH suffered a data breach. The vBulletin forum contained 453k accounts including usernames, email and IP addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 1, 2015; Have I Been Pwned loaded it on Dec 27, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"OVH data breach: 452K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ovh-data-breach","vendor":"OVH"},{"auto":true,"category":"breach","closedAt":"2017-01-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOTOFLEGENDS"],"json":"https://helix.ml/threat-watch/i/botoflegends-data-breach.json","latestUpdate":{"date":"2016-12-27","title":"Have I Been Pwned loaded 238K breached Bot of Legends accounts"},"patchStatus":"no-fix-needed","product":"botoflegends.com","severity":"high","severityNote":"238K accounts · passwords exposed","slug":"botoflegends-data-breach","stacks":[],"startedAt":"2016-12-27","status":"closed","summary":"In November 2014, the forum for Bot of Legends suffered a data breach. The IP.Board forum contained 238k accounts including usernames, email and IP addresses and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Nov 13, 2014; Have I Been Pwned loaded it on Dec 27, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Bot of Legends data breach: 238K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/botoflegends-data-breach","vendor":"Bot of Legends"},{"auto":true,"category":"breach","closedAt":"2017-01-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ETHEREUM"],"json":"https://helix.ml/threat-watch/i/ethereum-data-breach.json","latestUpdate":{"date":"2016-12-20","title":"Have I Been Pwned loaded 16K breached Ethereum accounts"},"patchStatus":"no-fix-needed","product":"ethereum.org","severity":"high","severityNote":"16K accounts · passwords exposed","slug":"ethereum-data-breach","stacks":[],"startedAt":"2016-12-20","status":"closed","summary":"In December 2016, the forum for the public blockchain-based distributed computing platform Ethereum suffered a data breach. The database contained over 16k unique email addresses along with IP addresses, private forum messages and (mostly) bcrypt hashed passwords. Ethereum elected to self-submit the data to HIBP, providing the service with a list of email addresses impacted by the incident. Exposed data: email addresses, ip addresses, passwords, private messages, usernames, website activity. The breach dates from Dec 16, 2016; Have I Been Pwned loaded it on Dec 20, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames","website-activity"],"title":"Ethereum data breach: 16K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ethereum-data-breach","vendor":"Ethereum"},{"auto":true,"category":"breach","closedAt":"2016-12-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PAYASUGYM"],"json":"https://helix.ml/threat-watch/i/payasugym-data-breach.json","latestUpdate":{"date":"2016-12-17","title":"Have I Been Pwned loaded 400K breached PayAsUGym accounts"},"patchStatus":"no-fix-needed","product":"payasugym.com","severity":"high","severityNote":"400K accounts · passwords exposed · financial data exposed","slug":"payasugym-data-breach","stacks":[],"startedAt":"2016-12-17","status":"closed","summary":"In December 2016, an attacker breached PayAsUGym's website exposing over 400k customers' personal data. The data was consequently leaked publicly and broadly distributed via Twitter. The leaked data contained personal information including email addresses and passwords hashed using MD5 without a salt. Exposed data: browser user agent details, email addresses, ip addresses, names, partial credit card data, passwords, phone numbers, website activity. The breach dates from Dec 15, 2016; Have I Been Pwned loaded it on Dec 17, 2016.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","names","partial-credit-card-data","passwords","phone-numbers","website-activity"],"title":"PayAsUGym data breach: 400K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/payasugym-data-breach","vendor":"PayAsUGym"},{"auto":true,"category":"breach","closedAt":"2016-12-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QUINSTREET"],"json":"https://helix.ml/threat-watch/i/quinstreet-data-breach.json","latestUpdate":{"date":"2016-12-17","title":"Have I Been Pwned loaded 4.9M breached QuinStreet accounts"},"patchStatus":"no-fix-needed","product":"quinstreet.com","severity":"high","severityNote":"4.9M accounts · passwords exposed","slug":"quinstreet-data-breach","stacks":[],"startedAt":"2016-12-17","status":"closed","summary":"In approximately late 2015, the maker of \"performance marketing products\" QuinStreet had a number of their online assets compromised. The attack impacted 28 separate sites, predominantly technology forums such as flashkit.com, codeguru.com and webdeveloper.com ( view a full list of sites ). QuinStreet advised that impacted users have been notified and passwords reset. The data contained details on over 4.9 million people and included email addresses, dates of birth and salted MD5 hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Dec 14, 2015; Have I Been Pwned loaded it on Dec 17, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"QuinStreet data breach: 4.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/quinstreet-data-breach","vendor":"QuinStreet"},{"auto":true,"category":"breach","closedAt":"2016-12-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GEEKEDIN"],"json":"https://helix.ml/threat-watch/i/geekedin-data-breach.json","latestUpdate":{"date":"2016-11-17","title":"Have I Been Pwned loaded 1.1M breached GeekedIn accounts"},"patchStatus":"no-fix-needed","product":"geekedin.net","severity":"medium","severityNote":"1.1M accounts","slug":"geekedin-data-breach","stacks":[],"startedAt":"2016-11-17","status":"closed","summary":"In August 2016, the technology recruitment site GeekedIn left a MongoDB database exposed and over 8M records were extracted by an unknown third party. The breached data was originally scraped from GitHub in violation of their terms of use and contained information exposed in public profiles, including over 1 million members' email addresses. Full details on the incident (including how impacted members can see their leaked data) are covered in the blog post on 8 million GitHub profiles were leaked from GeekedIn's MongoDB - here's how to see yours. Exposed data: email addresses, geographic locations, names, professional skills, usernames, years of professional experience. The breach dates from Aug 15, 2016; Have I Been Pwned loaded it on Nov 17, 2016.","tags":["data-breach","hibp","email-addresses","geographic-locations","names","professional-skills","usernames","years-of-professional-experience"],"title":"GeekedIn data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/geekedin-data-breach","vendor":"GeekedIn"},{"auto":true,"category":"breach","closedAt":"2016-11-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ARMYFORCEONLINE"],"json":"https://helix.ml/threat-watch/i/armyforceonline-data-breach.json","latestUpdate":{"date":"2016-11-10","title":"Have I Been Pwned loaded 1.5M breached Army Force Online accounts"},"patchStatus":"no-fix-needed","product":"armyforceonline.com","severity":"high","severityNote":"1.5M accounts · passwords exposed","slug":"armyforceonline-data-breach","stacks":[],"startedAt":"2016-11-10","status":"closed","summary":"In May 2016, the online gaming site Army Force Online suffered a data breach that exposed 1.5M accounts. The breached data was found being regularly traded online and included usernames, email and IP addresses and MD5 passwords. Exposed data: avatars, email addresses, geographic locations, ip addresses, names, passwords, usernames, website activity. The breach dates from May 18, 2016; Have I Been Pwned loaded it on Nov 10, 2016.","tags":["data-breach","hibp","avatars","email-addresses","geographic-locations","ip-addresses","names","passwords","usernames","website-activity"],"title":"Army Force Online data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/armyforceonline-data-breach","vendor":"Army Force Online"},{"auto":true,"category":"breach","closedAt":"2016-11-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CHEAPASSGAMER"],"json":"https://helix.ml/threat-watch/i/cheapassgamer-data-breach.json","latestUpdate":{"date":"2016-11-08","title":"Have I Been Pwned loaded 444K breached CheapAssGamer.com accounts"},"patchStatus":"no-fix-needed","product":"cheapassgamer.com","severity":"high","severityNote":"444K accounts · passwords exposed","slug":"cheapassgamer-data-breach","stacks":[],"startedAt":"2016-11-08","status":"closed","summary":"In approximately mid-2015, the forum for CheapAssGamer.com suffered a data breach. The database from the IP.Board based forum contained 445k accounts including usernames, email and IP addresses and salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2015; Have I Been Pwned loaded it on Nov 8, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"CheapAssGamer.com data breach: 444K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cheapassgamer-data-breach","vendor":"CheapAssGamer.com"},{"auto":true,"category":"breach","closedAt":"2016-11-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LOOKBOOK"],"json":"https://helix.ml/threat-watch/i/lookbook-data-breach.json","latestUpdate":{"date":"2016-11-08","title":"Have I Been Pwned loaded 1.1M breached Lookbook accounts"},"patchStatus":"no-fix-needed","product":"lookbook.nu","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"lookbook-data-breach","stacks":[],"startedAt":"2016-11-08","status":"closed","summary":"In August 2012, the fashion site Lookbook suffered a data breach. The data later appeared listed for sale in June 2016 and included 1.1 million usernames, email and IP addresses, birth dates and plain text passwords. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, usernames, website activity. The breach dates from Aug 24, 2012; Have I Been Pwned loaded it on Nov 8, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","usernames","website-activity"],"title":"Lookbook data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lookbook-data-breach","vendor":"Lookbook"},{"auto":true,"category":"breach","closedAt":"2016-11-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HEROESOFGAIA"],"json":"https://helix.ml/threat-watch/i/heroesofgaia-data-breach.json","latestUpdate":{"date":"2016-11-07","title":"Have I Been Pwned loaded 179K breached Heroes of Gaia accounts"},"patchStatus":"no-fix-needed","product":"heroesofgaia.com","severity":"medium","severityNote":"179K accounts","slug":"heroesofgaia-data-breach","stacks":[],"startedAt":"2016-11-07","status":"closed","summary":"In early 2013, the online fantasy multiplayer game Heroes of Gaia suffered a data breach. The newest records in the data set indicate a breach date of 4 January 2013 and include usernames, IP and email addresses but no passwords. Exposed data: browser user agent details, email addresses, ip addresses, usernames, website activity. The breach dates from Jan 4, 2013; Have I Been Pwned loaded it on Nov 7, 2016.","tags":["data-breach","hibp","browser-user-agent-details","email-addresses","ip-addresses","usernames","website-activity"],"title":"Heroes of Gaia data breach: 179K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/heroesofgaia-data-breach","vendor":"Heroes of Gaia"},{"auto":true,"category":"breach","closedAt":"2016-11-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UNREALENGINE"],"json":"https://helix.ml/threat-watch/i/unrealengine-data-breach.json","latestUpdate":{"date":"2016-11-07","title":"Have I Been Pwned loaded 530K breached Unreal Engine accounts"},"patchStatus":"no-fix-needed","product":"unrealengine.com","severity":"high","severityNote":"530K accounts · passwords exposed","slug":"unrealengine-data-breach","stacks":[],"startedAt":"2016-11-07","status":"closed","summary":"In August 2016, the Unreal Engine Forum suffered a data breach, allegedly due to a SQL injection vulnerability in vBulletin. The attack resulted in the exposure of 530k accounts including usernames, email addresses and salted MD5 hashes of passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 11, 2016; Have I Been Pwned loaded it on Nov 7, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Unreal Engine data breach: 530K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/unrealengine-data-breach","vendor":"Unreal Engine"},{"auto":true,"category":"breach","closedAt":"2016-11-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:EPICGAMES"],"json":"https://helix.ml/threat-watch/i/epicgames-data-breach.json","latestUpdate":{"date":"2016-11-07","title":"Have I Been Pwned loaded 251K breached Epic Games accounts"},"patchStatus":"no-fix-needed","product":"epicgames.com","severity":"high","severityNote":"251K accounts · passwords exposed","slug":"epicgames-data-breach","stacks":[],"startedAt":"2016-11-07","status":"closed","summary":"In August 2016, the Epic Games forum suffered a data breach, allegedly due to a SQL injection vulnerability in vBulletin. The attack resulted in the exposure of 252k accounts including usernames, email addresses and salted MD5 hashes of passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 11, 2016; Have I Been Pwned loaded it on Nov 7, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Epic Games data breach: 251K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/epicgames-data-breach","vendor":"Epic Games"},{"auto":true,"category":"breach","closedAt":"2016-11-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WARINC"],"json":"https://helix.ml/threat-watch/i/warinc-data-breach.json","latestUpdate":{"date":"2016-11-07","title":"Have I Been Pwned loaded 1.0M breached War Inc. accounts"},"patchStatus":"no-fix-needed","product":"thewarinc.com","severity":"high","severityNote":"1.0M accounts · passwords exposed","slug":"warinc-data-breach","stacks":[],"startedAt":"2016-11-07","status":"closed","summary":"In mid-2012, the real-time strategy game War Inc. suffered a data breach. The attack resulted in the exposure of over 1 million accounts including usernames, email addresses and salted MD5 hashes of passwords. Exposed data: email addresses, passwords, usernames, website activity. The breach dates from Jul 4, 2012; Have I Been Pwned loaded it on Nov 7, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames","website-activity"],"title":"War Inc. data breach: 1.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/warinc-data-breach","vendor":"War Inc."},{"auto":true,"category":"breach","closedAt":"2016-11-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UTORRENT"],"json":"https://helix.ml/threat-watch/i/utorrent-data-breach.json","latestUpdate":{"date":"2016-11-05","title":"Have I Been Pwned loaded 395K breached uTorrent accounts"},"patchStatus":"no-fix-needed","product":"utorrent.com","severity":"high","severityNote":"395K accounts · passwords exposed","slug":"utorrent-data-breach","stacks":[],"startedAt":"2016-11-05","status":"closed","summary":"In early 2016, the forum for the uTorrent BitTorrent client suffered a data breach which came to light later in the year. The database from the IP.Board based forum contained 395k accounts including usernames, email addresses and MD5 password hashes without a salt. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 14, 2016; Have I Been Pwned loaded it on Nov 5, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"uTorrent data breach: 395K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/utorrent-data-breach","vendor":"uTorrent"},{"auto":true,"category":"breach","closedAt":"2016-11-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:RAMBLER"],"json":"https://helix.ml/threat-watch/i/rambler-data-breach.json","latestUpdate":{"date":"2016-11-01","title":"Have I Been Pwned loaded 91.4M breached Rambler accounts"},"patchStatus":"no-fix-needed","product":"rambler.ru","severity":"high","severityNote":"91.4M accounts · passwords exposed","slug":"rambler-data-breach","stacks":[],"startedAt":"2016-11-01","status":"closed","summary":"In late 2016, a data dump of almost 100M accounts from Rambler, sometimes referred to as \"The Russian Yahoo\", was discovered being traded online. The data set provided to Have I Been Pwned included 91M unique usernames (which also form part of Rambler email addresses) and plain text passwords. According to Rambler, the data dates back to March 2014. Exposed data: email addresses, passwords, usernames. The breach dates from Mar 1, 2014; Have I Been Pwned loaded it on Nov 1, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Rambler data breach: 91.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/rambler-data-breach","vendor":"Rambler"},{"auto":true,"category":"breach","closedAt":"2016-10-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MODERNBUSINESSSOLUTIONS"],"json":"https://helix.ml/threat-watch/i/modernbusinesssolutions-data-breach.json","latestUpdate":{"date":"2016-10-12","title":"Have I Been Pwned loaded 58.8M breached Modern Business Solutions accounts"},"patchStatus":"no-fix-needed","product":"modbsolutions.com","severity":"high","severityNote":"58.8M accounts","slug":"modernbusinesssolutions-data-breach","stacks":[],"startedAt":"2016-10-12","status":"closed","summary":"In October 2016, a large Mongo DB file containing tens of millions of accounts was shared publicly on Twitter (the file has since been removed). The database contained over 58M unique email addresses along with IP addresses, names, home addresses, genders, job titles, dates of birth and phone numbers. The data was subsequently attributed to \"Modern Business Solutions\", a company that provides data storage and database hosting solutions. They've yet to acknowledge the incident or explain how they came to be in possession of the data. Exposed data: dates of birth, email addresses, genders, ip addresses, job titles, names, phone numbers, physical addresses. The breach dates from Oct 8, 2016; Have I Been Pwned loaded it on Oct 12, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","job-titles","names","phone-numbers","physical-addresses"],"title":"Modern Business Solutions data breach: 58.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/modernbusinesssolutions-data-breach","vendor":"Modern Business Solutions"},{"auto":true,"category":"breach","closedAt":"2016-10-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ATERNOS"],"json":"https://helix.ml/threat-watch/i/aternos-data-breach.json","latestUpdate":{"date":"2016-10-01","title":"Have I Been Pwned loaded 1.4M breached Aternos accounts"},"patchStatus":"no-fix-needed","product":"aternos.org","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"aternos-data-breach","stacks":[],"startedAt":"2016-10-01","status":"closed","summary":"In December 2015, the service for creating and running free Minecraft servers known as Aternos suffered a data breach that impacted 1.4 million subscribers. The data included usernames, email and IP addresses and hashed passwords. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Dec 6, 2015; Have I Been Pwned loaded it on Oct 1, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Aternos data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/aternos-data-breach","vendor":"Aternos"},{"auto":true,"category":"breach","closedAt":"2016-10-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LEET"],"json":"https://helix.ml/threat-watch/i/leet-data-breach.json","latestUpdate":{"date":"2016-09-30","title":"Have I Been Pwned loaded 5.1M breached Leet accounts"},"patchStatus":"no-fix-needed","product":"leet.cc","severity":"high","severityNote":"5.1M accounts · passwords exposed","slug":"leet-data-breach","stacks":[],"startedAt":"2016-09-30","status":"closed","summary":"In August 2016, the service for creating and running Pocket Minecraft edition servers known as Leet was reported as having suffered a data breach that impacted 6 million subscribers. The incident reported by Softpedia had allegedly taken place earlier in the year, although the data set sent to HIBP was dated as recently as early September but contained only 2 million subscribers. The data included usernames, email and IP addresses and SHA512 hashes. A further 3 million accounts were obtained and added to HIBP several days after the initial data was loaded bringing the total to over 5 million. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Sep 10, 2016; Have I Been Pwned loaded it on Sep 30, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Leet data breach: 5.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/leet-data-breach","vendor":"Leet"},{"auto":true,"category":"breach","closedAt":"2016-10-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IDRESSUP"],"json":"https://helix.ml/threat-watch/i/idressup-data-breach.json","latestUpdate":{"date":"2016-09-26","title":"Have I Been Pwned loaded 2.2M breached i-Dressup accounts"},"patchStatus":"no-fix-needed","product":"i-dressup.com","severity":"high","severityNote":"2.2M accounts · passwords exposed","slug":"idressup-data-breach","stacks":[],"startedAt":"2016-09-26","status":"closed","summary":"In June 2016, the teen social site known as i-Dressup was hacked and over 2 million user accounts were exposed. At the time the hack was reported, the i-Dressup operators were not contactable and the underlying SQL injection flaw remained open, allegedly exposing a total of 5.5 million accounts. The breach included email addresses and passwords stored in plain text. Exposed data: email addresses, passwords. The breach dates from Jul 15, 2016; Have I Been Pwned loaded it on Sep 26, 2016.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"i-Dressup data breach: 2.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/idressup-data-breach","vendor":"i-Dressup"},{"auto":true,"category":"breach","closedAt":"2016-10-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GPOTATO"],"json":"https://helix.ml/threat-watch/i/gpotato-data-breach.json","latestUpdate":{"date":"2016-09-24","title":"Have I Been Pwned loaded 2.1M breached gPotato accounts"},"patchStatus":"no-fix-needed","product":"gpotato.com","severity":"high","severityNote":"2.1M accounts · passwords exposed","slug":"gpotato-data-breach","stacks":[],"startedAt":"2016-09-24","status":"closed","summary":"In July 2007, the multiplayer game portal known as gPotato (link to archive of the site at that time) suffered a data breach and over 2 million user accounts were exposed. The site later merged into the Webzen portal where the original accounts still exist today. The exposed data included usernames, email and IP addresses, MD5 hashes and personal attributes such as gender, birth date, physical address and security questions and answers stored in plain text. Exposed data: dates of birth, email addresses, genders, ip addresses, names, passwords, physical addresses, security questions and answers, usernames, website activity. The breach dates from Jul 12, 2007; Have I Been Pwned loaded it on Sep 24, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","ip-addresses","names","passwords","physical-addresses","security-questions-and-answers","usernames","website-activity"],"title":"gPotato data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gpotato-data-breach","vendor":"gPotato"},{"auto":true,"category":"breach","closedAt":"2016-10-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMETUTS"],"json":"https://helix.ml/threat-watch/i/gametuts-data-breach.json","latestUpdate":{"date":"2016-09-23","title":"Have I Been Pwned loaded 2.1M breached GameTuts accounts"},"patchStatus":"no-fix-needed","product":"game-tuts.com","severity":"high","severityNote":"2.1M accounts · passwords exposed","slug":"gametuts-data-breach","stacks":[],"startedAt":"2016-09-23","status":"closed","summary":"Likely in early 2015, the video game website GameTuts suffered a data breach and over 2 million user accounts were exposed. The site later shut down in July 2016 but was identified as having been hosted on a vBulletin forum. The exposed data included usernames, email and IP addresses and salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Mar 1, 2015; Have I Been Pwned loaded it on Sep 23, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"GameTuts data breach: 2.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gametuts-data-breach","vendor":"GameTuts"},{"auto":true,"category":"breach","closedAt":"2016-10-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MODACO"],"json":"https://helix.ml/threat-watch/i/modaco-data-breach.json","latestUpdate":{"date":"2016-09-20","title":"Have I Been Pwned loaded 879K breached MoDaCo accounts"},"patchStatus":"no-fix-needed","product":"modaco.com","severity":"high","severityNote":"879K accounts · passwords exposed","slug":"modaco-data-breach","stacks":[],"startedAt":"2016-09-20","status":"closed","summary":"In approximately January 2016, the UK based Android community known as MoDaCo suffered a data breach which exposed 880k subscriber identities. The data included email and IP addresses, usernames and passwords stored as salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Sep 20, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"MoDaCo data breach: 879K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/modaco-data-breach","vendor":"MoDaCo"},{"auto":true,"category":"breach","closedAt":"2016-10-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LASTFM"],"json":"https://helix.ml/threat-watch/i/lastfm-data-breach.json","latestUpdate":{"date":"2016-09-20","title":"Have I Been Pwned loaded 37.2M breached Last.fm accounts"},"patchStatus":"no-fix-needed","product":"last.fm","severity":"high","severityNote":"37.2M accounts · passwords exposed","slug":"lastfm-data-breach","stacks":[],"startedAt":"2016-09-20","status":"closed","summary":"In March 2012, the music website Last.fm was hacked and 43 million user accounts were exposed. Whilst Last.fm knew of an incident back in 2012, the scale of the hack was not known until the data was released publicly in September 2016. The breach included 37 million unique email addresses, usernames and passwords stored as unsalted MD5 hashes. Exposed data: email addresses, passwords, usernames, website activity. The breach dates from Mar 22, 2012; Have I Been Pwned loaded it on Sep 20, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames","website-activity"],"title":"Last.fm data breach: 37.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lastfm-data-breach","vendor":"Last.fm"},{"auto":true,"category":"breach","closedAt":"2016-09-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ETHEKWINIMUNICIPALITY"],"json":"https://helix.ml/threat-watch/i/ethekwinimunicipality-data-breach.json","latestUpdate":{"date":"2016-09-15","title":"Have I Been Pwned loaded 81K breached eThekwini Municipality accounts"},"patchStatus":"no-fix-needed","product":"eservices.durban.gov.za","severity":"high","severityNote":"81K accounts · passwords exposed","slug":"ethekwinimunicipality-data-breach","stacks":[],"startedAt":"2016-09-15","status":"closed","summary":"In September 2016, the new eThekwini eServices website in South Africa was launched with a number of security holes that lead to the leak of over 98k residents' personal information and utility bills across 82k unique email addresses. Emails were sent prior to launch containing passwords in plain text and the site allowed anyone to download utility bills without sufficient authentication. Various methods of customer data enumeration was possible and phishing attacks began appearing the day after launch. Exposed data: dates of birth, deceased date, email addresses, genders, government issued ids, names, passport numbers, passwords, phone numbers, physical addresses, utility bills. The breach dates from Sep 7, 2016; Have I Been Pwned loaded it on Sep 15, 2016.","tags":["data-breach","hibp","dates-of-birth","deceased-date","email-addresses","genders","government-issued-ids","names","passport-numbers","passwords","phone-numbers","physical-addresses","utility-bills"],"title":"eThekwini Municipality data breach: 81K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ethekwinimunicipality-data-breach","vendor":"eThekwini Municipality"},{"auto":true,"category":"breach","closedAt":"2016-09-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BLUESNAPREGPACK"],"json":"https://helix.ml/threat-watch/i/bluesnapregpack-data-breach.json","latestUpdate":{"date":"2016-09-13","title":"Have I Been Pwned loaded 104K breached Regpack accounts"},"patchStatus":"no-fix-needed","product":"bluesnap.com","severity":"high","severityNote":"104K accounts · financial data exposed","slug":"bluesnapregpack-data-breach","stacks":[],"startedAt":"2016-09-13","status":"closed","summary":"In July 2016, a tweet was posted with a link to an alleged data breach of BlueSnap, a global payment gateway and merchant account provider. The data contained 324k payment records across 105k unique email addresses and included personal attributes such as name, home address and phone number. The data was verified with multiple Have I Been Pwned subscribers who confirmed it also contained valid transactions, partial credit card numbers, expiry dates and CVVs. A downstream consumer of BlueSnap services known as Regpack was subsequently identified as the source of the data after they identified human error had left the transactions exposed on a publicly facing server. A full investigation of the data and statement by Regpack is detailed in the post titled Someone just lost 324k payment records, complete with CVVs. Exposed data: browser user agent details, credit card cvv, email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from May 20, 2016; Have I Been Pwned loaded it on Sep 13, 2016.","tags":["data-breach","hibp","browser-user-agent-details","credit-card-cvv","email-addresses","ip-addresses","names","partial-credit-card-data","phone-numbers","physical-addresses","purchases"],"title":"Regpack data breach: 104K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bluesnapregpack-data-breach","vendor":"Regpack"},{"auto":true,"category":"breach","closedAt":"2016-09-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CLIXSENSE"],"json":"https://helix.ml/threat-watch/i/clixsense-data-breach.json","latestUpdate":{"date":"2016-09-11","title":"Have I Been Pwned loaded 2.4M breached ClixSense accounts"},"patchStatus":"no-fix-needed","product":"clixsense.com","severity":"high","severityNote":"2.4M accounts · passwords exposed · financial data exposed","slug":"clixsense-data-breach","stacks":[],"startedAt":"2016-09-11","status":"closed","summary":"In September 2016, the paid-to-click site ClixSense suffered a data breach which exposed 2.4 million subscriber identities. The breached data was then posted online by the attackers who claimed it was a subset of a larger data breach totalling 6.6 million records. The leaked data was extensive and included names, physical, email and IP addresses, genders and birth dates, account balances and passwords stored as plain text. Exposed data: account balances, dates of birth, email addresses, genders, ip addresses, names, passwords, payment histories, payment methods, physical addresses, usernames, website activity. The breach dates from Sep 4, 2016; Have I Been Pwned loaded it on Sep 11, 2016.","tags":["data-breach","hibp","account-balances","dates-of-birth","email-addresses","genders","ip-addresses","names","passwords","payment-histories","payment-methods","physical-addresses","usernames","website-activity"],"title":"ClixSense data breach: 2.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/clixsense-data-breach","vendor":"ClixSense"},{"auto":true,"category":"breach","closedAt":"2016-09-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POKEBIP"],"json":"https://helix.ml/threat-watch/i/pokebip-data-breach.json","latestUpdate":{"date":"2016-09-09","title":"Have I Been Pwned loaded 657K breached Pokébip accounts"},"patchStatus":"no-fix-needed","product":"pokebip.com","severity":"high","severityNote":"657K accounts · passwords exposed","slug":"pokebip-data-breach","stacks":[],"startedAt":"2016-09-09","status":"closed","summary":"In July 2015, the French Pokémon site Pokébip suffered a data breach which exposed 657k subscriber identities. The data included email and IP addresses, usernames and passwords stored as unsalted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, time zones, usernames, website activity. The breach dates from Jul 28, 2015; Have I Been Pwned loaded it on Sep 9, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","time-zones","usernames","website-activity"],"title":"Pokébip data breach: 657K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/pokebip-data-breach","vendor":"Pokébip"},{"auto":true,"category":"breach","closedAt":"2016-09-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DLH"],"json":"https://helix.ml/threat-watch/i/dlh-data-breach.json","latestUpdate":{"date":"2016-09-07","title":"Have I Been Pwned loaded 3.3M breached DLH.net accounts"},"patchStatus":"no-fix-needed","product":"dlh.net","severity":"high","severityNote":"3.3M accounts · passwords exposed","slug":"dlh-data-breach","stacks":[],"startedAt":"2016-09-07","status":"closed","summary":"In July 2016, the gaming news site DLH.net suffered a data breach which exposed 3.3M subscriber identities. Along with the keys used to redeem and activate games on the Steam platform, the breach also resulted in the exposure of email addresses, birth dates and salted MD5 password hashes. The data was donated to Have I Been Pwned by data breach monitoring service Vigilante.pw. Exposed data: dates of birth, email addresses, names, passwords, usernames, website activity. The breach dates from Jul 31, 2016; Have I Been Pwned loaded it on Sep 7, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","names","passwords","usernames","website-activity"],"title":"DLH.net data breach: 3.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dlh-data-breach","vendor":"DLH.net"},{"auto":true,"category":"breach","closedAt":"2016-09-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SERVERPACT"],"json":"https://helix.ml/threat-watch/i/serverpact-data-breach.json","latestUpdate":{"date":"2016-09-06","title":"Have I Been Pwned loaded 73K breached ServerPact accounts"},"patchStatus":"no-fix-needed","product":"serverpact.com","severity":"high","severityNote":"73K accounts · passwords exposed","slug":"serverpact-data-breach","stacks":[],"startedAt":"2016-09-06","status":"closed","summary":"In mid-2015, the Dutch Minecraft site ServerPact was hacked and 73k accounts were exposed. Along with birth dates, email and IP addresses, the site also exposed SHA1 password hashes with the username as the salt. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Sep 6, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"ServerPact data breach: 73K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/serverpact-data-breach","vendor":"ServerPact"},{"auto":true,"category":"breach","closedAt":"2016-09-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WIIUISO"],"json":"https://helix.ml/threat-watch/i/wiiuiso-data-breach.json","latestUpdate":{"date":"2016-09-06","title":"Have I Been Pwned loaded 458K breached WIIU ISO accounts"},"patchStatus":"no-fix-needed","product":"wiiuiso.com","severity":"high","severityNote":"458K accounts · passwords exposed","slug":"wiiuiso-data-breach","stacks":[],"startedAt":"2016-09-06","status":"closed","summary":"In September 2015, the Nintendo Wii U forum known as WIIU ISO was hacked and 458k accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 25, 2015; Have I Been Pwned loaded it on Sep 6, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"WIIU ISO data breach: 458K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wiiuiso-data-breach","vendor":"WIIU ISO"},{"auto":true,"category":"breach","closedAt":"2016-09-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ONVERSE"],"json":"https://helix.ml/threat-watch/i/onverse-data-breach.json","latestUpdate":{"date":"2016-09-06","title":"Have I Been Pwned loaded 800K breached Onverse accounts"},"patchStatus":"no-fix-needed","product":"onverse.com","severity":"high","severityNote":"800K accounts · passwords exposed","slug":"onverse-data-breach","stacks":[],"startedAt":"2016-09-06","status":"closed","summary":"In January 2016, the online virtual world known as Onverse was hacked and 800k accounts were exposed. Along with email and IP addresses, the site also exposed salted MD5 password hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Sep 6, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Onverse data breach: 800K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/onverse-data-breach","vendor":"Onverse"},{"auto":true,"category":"breach","closedAt":"2016-09-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLASHFLASHREVOLUTION"],"json":"https://helix.ml/threat-watch/i/flashflashrevolution-data-breach.json","latestUpdate":{"date":"2016-09-06","title":"Have I Been Pwned loaded 1.8M breached Flash Flash Revolution (2016 breach) accounts"},"patchStatus":"no-fix-needed","product":"flashflashrevolution.com","severity":"high","severityNote":"1.8M accounts · passwords exposed","slug":"flashflashrevolution-data-breach","stacks":[],"startedAt":"2016-09-06","status":"closed","summary":"In February 2016, the music-based rhythm game known as Flash Flash Revolution was hacked and 1.8M accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Feb 1, 2016; Have I Been Pwned loaded it on Sep 6, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Flash Flash Revolution (2016 breach) data breach: 1.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/flashflashrevolution-data-breach","vendor":"Flash Flash Revolution (2016 breach)"},{"auto":true,"category":"breach","closedAt":"2016-09-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BRAZZERS"],"json":"https://helix.ml/threat-watch/i/brazzers-data-breach.json","latestUpdate":{"date":"2016-09-05","title":"Have I Been Pwned loaded 790K breached Brazzers accounts"},"patchStatus":"no-fix-needed","product":"brazzers.com","severity":"high","severityNote":"790K accounts · passwords exposed","slug":"brazzers-data-breach","stacks":[],"startedAt":"2016-09-05","status":"closed","summary":"In April 2013, the adult website known as Brazzers was hacked and 790k accounts were exposed publicly. Each record included a username, email address and password stored in plain text. The breach was brought to light by the Vigilante.pw data breach reporting site in September 2016. Exposed data: email addresses, passwords, usernames. The breach dates from Apr 1, 2013; Have I Been Pwned loaded it on Sep 5, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Brazzers data breach: 790K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/brazzers-data-breach","vendor":"Brazzers"},{"auto":true,"category":"breach","closedAt":"2016-09-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DROPBOX"],"json":"https://helix.ml/threat-watch/i/dropbox-data-breach.json","latestUpdate":{"date":"2016-08-31","title":"Have I Been Pwned loaded 68.6M breached Dropbox accounts"},"patchStatus":"no-fix-needed","product":"dropbox.com","severity":"high","severityNote":"68.6M accounts · passwords exposed","slug":"dropbox-data-breach","stacks":[],"startedAt":"2016-08-31","status":"closed","summary":"In mid-2012, Dropbox suffered a data breach which exposed the stored credentials of tens of millions of their customers. In August 2016, they forced password resets for customers they believed may be at risk. A large volume of data totalling over 68 million records was subsequently traded online and included email addresses and salted hashes of passwords (half of them SHA1, half of them bcrypt). Exposed data: email addresses, passwords. The breach dates from Jul 1, 2012; Have I Been Pwned loaded it on Aug 31, 2016.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Dropbox data breach: 68.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dropbox-data-breach","vendor":"Dropbox"},{"auto":true,"category":"breach","closedAt":"2016-09-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NIHONOMARU"],"json":"https://helix.ml/threat-watch/i/nihonomaru-data-breach.json","latestUpdate":{"date":"2016-08-30","title":"Have I Been Pwned loaded 1.7M breached Nihonomaru accounts"},"patchStatus":"no-fix-needed","product":"nihonomaru.net","severity":"high","severityNote":"1.7M accounts · passwords exposed","slug":"nihonomaru-data-breach","stacks":[],"startedAt":"2016-08-30","status":"closed","summary":"In late 2015, the anime community known as Nihonomaru had their vBulletin forum hacked and 1.7 million accounts exposed. The compromised data included email and IP addresses, usernames and salted hashes of passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 1, 2015; Have I Been Pwned loaded it on Aug 30, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Nihonomaru data breach: 1.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nihonomaru-data-breach","vendor":"Nihonomaru"},{"auto":true,"category":"breach","closedAt":"2016-09-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INTERPALS"],"json":"https://helix.ml/threat-watch/i/interpals-data-breach.json","latestUpdate":{"date":"2016-08-30","title":"Have I Been Pwned loaded 3.4M breached InterPals accounts"},"patchStatus":"no-fix-needed","product":"interpals.net","severity":"high","severityNote":"3.4M accounts · passwords exposed","slug":"interpals-data-breach","stacks":[],"startedAt":"2016-08-30","status":"closed","summary":"In late 2015, the online penpal site InterPals had their website hacked and 3.4 million accounts exposed. The compromised data included email addresses, geographical locations, birthdates and salted hashes of passwords. Exposed data: dates of birth, email addresses, geographic locations, names, passwords, usernames. The breach dates from Nov 4, 2015; Have I Been Pwned loaded it on Aug 30, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","names","passwords","usernames"],"title":"InterPals data breach: 3.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/interpals-data-breach","vendor":"InterPals"},{"auto":true,"category":"breach","closedAt":"2016-09-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MINECRAFTWORLDMAP"],"json":"https://helix.ml/threat-watch/i/minecraftworldmap-data-breach.json","latestUpdate":{"date":"2016-08-29","title":"Have I Been Pwned loaded 71K breached Minecraft World Map accounts"},"patchStatus":"no-fix-needed","product":"minecraftworldmap.com","severity":"high","severityNote":"71K accounts · passwords exposed","slug":"minecraftworldmap-data-breach","stacks":[],"startedAt":"2016-08-29","status":"closed","summary":"In approximately January 2016, the Minecraft World Map site designed for sharing maps created for the game was hacked and over 71k user accounts were exposed. The data included usernames, email and IP addresses along with salted and hashed passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 15, 2016; Have I Been Pwned loaded it on Aug 29, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Minecraft World Map data breach: 71K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/minecraftworldmap-data-breach","vendor":"Minecraft World Map"},{"auto":true,"category":"breach","closedAt":"2016-09-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GTAGAMING"],"json":"https://helix.ml/threat-watch/i/gtagaming-data-breach.json","latestUpdate":{"date":"2016-08-23","title":"Have I Been Pwned loaded 197K breached GTAGaming accounts"},"patchStatus":"no-fix-needed","product":"gtagaming.com","severity":"high","severityNote":"197K accounts · passwords exposed","slug":"gtagaming-data-breach","stacks":[],"startedAt":"2016-08-23","status":"closed","summary":"In August 2016, the Grand Theft Auto forum GTAGaming was hacked and nearly 200k user accounts were leaked. The vBulletin based forum included usernames, email addresses and password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Aug 1, 2016; Have I Been Pwned loaded it on Aug 23, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"GTAGaming data breach: 197K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gtagaming-data-breach","vendor":"GTAGaming"},{"auto":true,"category":"breach","closedAt":"2016-09-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TERACOD"],"json":"https://helix.ml/threat-watch/i/teracod-data-breach.json","latestUpdate":{"date":"2016-08-22","title":"Have I Been Pwned loaded 97K breached Teracod accounts"},"patchStatus":"no-fix-needed","product":"teracod.org","severity":"high","severityNote":"97K accounts · passwords exposed · financial data exposed","slug":"teracod-data-breach","stacks":[],"startedAt":"2016-08-22","status":"closed","summary":"In May 2015, almost 100k user records were extracted from the Hungarian torrent site known as Teracod. The data was later discovered being torrented itself and included email addresses, passwords, private messages between members and the peering history of IP addresses using the service. Exposed data: avatars, email addresses, ip addresses, passwords, payment histories, private messages, usernames, website activity. The breach dates from May 28, 2016; Have I Been Pwned loaded it on Aug 22, 2016.","tags":["data-breach","hibp","avatars","email-addresses","ip-addresses","passwords","payment-histories","private-messages","usernames","website-activity"],"title":"Teracod data breach: 97K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/teracod-data-breach","vendor":"Teracod"},{"auto":true,"category":"breach","closedAt":"2016-08-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:XAT"],"json":"https://helix.ml/threat-watch/i/xat-data-breach.json","latestUpdate":{"date":"2016-08-05","title":"Have I Been Pwned loaded 6.0M breached xat accounts"},"patchStatus":"no-fix-needed","product":"xat.com","severity":"high","severityNote":"6.0M accounts · passwords exposed","slug":"xat-data-breach","stacks":[],"startedAt":"2016-08-05","status":"closed","summary":"In November 2015, the online chatroom known as \"xat\" was hacked and 6 million user accounts were exposed. Used as a chat engine on websites, the leaked data included usernames, email and IP addresses along with hashed passwords. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Nov 4, 2015; Have I Been Pwned loaded it on Aug 5, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"xat data breach: 6.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/xat-data-breach","vendor":"xat"},{"auto":true,"category":"breach","closedAt":"2016-08-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WARFRAME"],"json":"https://helix.ml/threat-watch/i/warframe-data-breach.json","latestUpdate":{"date":"2016-07-21","title":"Have I Been Pwned loaded 819K breached Warframe accounts"},"patchStatus":"no-fix-needed","product":"warframe.com","severity":"medium","severityNote":"819K accounts","slug":"warframe-data-breach","stacks":[],"startedAt":"2016-07-21","status":"closed","summary":"In November 2014, the online game Warframe was hacked and 819k unique email addresses were exposed. Allegedly due to a SQL injection flaw in Drupal, the attack exposed usernames, email addresses and data in a \"pass\" column which adheres to the salted SHA12 password hashing pattern used by Drupal 7. Digital Extremes (the developers of Warframe), asserts the salted hashes are of \"alias names\" rather than passwords. Exposed data: email addresses, usernames, website activity. The breach dates from Nov 24, 2014; Have I Been Pwned loaded it on Jul 21, 2016.","tags":["data-breach","hibp","email-addresses","usernames","website-activity"],"title":"Warframe data breach: 819K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/warframe-data-breach","vendor":"Warframe"},{"auto":true,"category":"breach","closedAt":"2016-07-29","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRILLIAN"],"json":"https://helix.ml/threat-watch/i/trillian-data-breach.json","latestUpdate":{"date":"2016-07-15","title":"Have I Been Pwned loaded 3.8M breached Trillian accounts"},"patchStatus":"no-fix-needed","product":"trillian.im","severity":"high","severityNote":"3.8M accounts · passwords exposed","slug":"trillian-data-breach","stacks":[],"startedAt":"2016-07-15","status":"closed","summary":"In December 2015, the instant messaging application Trillian suffered a data breach. The breach became known in July 2016 and exposed various personal data attributes including names, email addresses and passwords stored as salted MD5 hashes. Exposed data: dates of birth, email addresses, ip addresses, names, passwords, usernames. The breach dates from Dec 27, 2015; Have I Been Pwned loaded it on Jul 15, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","passwords","usernames"],"title":"Trillian data breach: 3.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/trillian-data-breach","vendor":"Trillian"},{"auto":true,"category":"breach","closedAt":"2016-07-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:17MEDIA"],"json":"https://helix.ml/threat-watch/i/17media-data-breach.json","latestUpdate":{"date":"2016-07-08","title":"Have I Been Pwned loaded 4.0M breached 17 accounts"},"patchStatus":"no-fix-needed","product":"17app.co","severity":"high","severityNote":"4.0M accounts · passwords exposed","slug":"17media-data-breach","stacks":[],"startedAt":"2016-07-08","status":"closed","summary":"In April 2016, customer data obtained from the streaming app known as \"17\" appeared listed for sale on a Tor hidden service marketplace. The data contained over 4 million unique email addresses along with IP addresses, usernames and passwords stored as unsalted MD5 hashes. Exposed data: device information, email addresses, ip addresses, passwords, usernames. The breach dates from Apr 19, 2016; Have I Been Pwned loaded it on Jul 8, 2016.","tags":["data-breach","hibp","device-information","email-addresses","ip-addresses","passwords","usernames"],"title":"17 data breach: 4.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/17media-data-breach","vendor":"17"},{"auto":true,"category":"breach","closedAt":"2016-07-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NEOPETS"],"json":"https://helix.ml/threat-watch/i/neopets-data-breach.json","latestUpdate":{"date":"2016-07-07","title":"Have I Been Pwned loaded 26.9M breached Neopets accounts"},"patchStatus":"no-fix-needed","product":"neopets.com","severity":"high","severityNote":"26.9M accounts · passwords exposed","slug":"neopets-data-breach","stacks":[],"startedAt":"2016-07-07","status":"closed","summary":"In May 2016, a set of breached data originating from the virtual pet website \"Neopets\" was found being traded online. Allegedly hacked \"several years earlier\", the data contains sensitive personal information including birthdates, genders and names as well as almost 27 million unique email addresses. Passwords were stored in plain text and IP addresses were also present in the breach. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, names, passwords, usernames. The breach dates from May 5, 2013; Have I Been Pwned loaded it on Jul 7, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","names","passwords","usernames"],"title":"Neopets data breach: 26.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/neopets-data-breach","vendor":"Neopets"},{"auto":true,"category":"breach","closedAt":"2016-07-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IMESH"],"json":"https://helix.ml/threat-watch/i/imesh-data-breach.json","latestUpdate":{"date":"2016-07-02","title":"Have I Been Pwned loaded 49.5M breached iMesh accounts"},"patchStatus":"no-fix-needed","product":"imesh.com","severity":"high","severityNote":"49.5M accounts · passwords exposed","slug":"imesh-data-breach","stacks":[],"startedAt":"2016-07-02","status":"closed","summary":"In September 2013, the media and file sharing client known as iMesh was hacked and approximately 50M accounts were exposed. The data was later put up for sale on a dark market website in mid-2016 and included email and IP addresses, usernames and salted MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Sep 22, 2013; Have I Been Pwned loaded it on Jul 2, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"iMesh data breach: 49.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/imesh-data-breach","vendor":"iMesh"},{"auto":true,"category":"breach","closedAt":"2016-07-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TIANYA"],"json":"https://helix.ml/threat-watch/i/tianya-data-breach.json","latestUpdate":{"date":"2016-06-30","title":"Have I Been Pwned loaded 29.0M breached Tianya accounts"},"patchStatus":"no-fix-needed","product":"tianya.cn","severity":"medium","severityNote":"29.0M accounts","slug":"tianya-data-breach","stacks":[],"startedAt":"2016-06-30","status":"closed","summary":"In December 2011, China's largest online forum known as Tianya was hacked and tens of millions of accounts were obtained by the attacker. The leaked data included names, usernames and email addresses. Exposed data: email addresses, names, usernames. The breach dates from Dec 26, 2011; Have I Been Pwned loaded it on Jun 30, 2016.","tags":["data-breach","hibp","email-addresses","names","usernames"],"title":"Tianya data breach: 29.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tianya-data-breach","vendor":"Tianya"},{"auto":true,"category":"breach","closedAt":"2016-07-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MUSLIMMATCH"],"json":"https://helix.ml/threat-watch/i/muslimmatch-data-breach.json","latestUpdate":{"date":"2016-06-29","title":"Have I Been Pwned loaded 149K breached Muslim Match accounts"},"patchStatus":"no-fix-needed","product":"muslimmatch.com","severity":"high","severityNote":"149K accounts · passwords exposed","slug":"muslimmatch-data-breach","stacks":[],"startedAt":"2016-06-29","status":"closed","summary":"In June 2016, the Muslim Match dating website had 150k email addresses exposed. The data included private chats and messages between relationship seekers and numerous other personal attributes including passwords hashed with MD5. Exposed data: chat logs, email addresses, geographic locations, ip addresses, passwords, private messages, user statuses, usernames. The breach dates from Jun 24, 2016; Have I Been Pwned loaded it on Jun 29, 2016.","tags":["data-breach","hibp","chat-logs","email-addresses","geographic-locations","ip-addresses","passwords","private-messages","user-statuses","usernames"],"title":"Muslim Match data breach: 149K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/muslimmatch-data-breach","vendor":"Muslim Match"},{"auto":true,"category":"breach","closedAt":"2016-07-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WHMCS"],"json":"https://helix.ml/threat-watch/i/whmcs-data-breach.json","latestUpdate":{"date":"2016-06-28","title":"Have I Been Pwned loaded 134K breached WHMCS accounts"},"patchStatus":"no-fix-needed","product":"whmcs.com","severity":"high","severityNote":"134K accounts · passwords exposed · financial data exposed","slug":"whmcs-data-breach","stacks":[],"startedAt":"2016-06-28","status":"closed","summary":"In May 2012, the web hosting, billing and automation company WHMCS suffered a data breach that exposed 134k email addresses. The breach included extensive information about customers and payment histories including partial credit card numbers. Exposed data: email addresses, email messages, employers, ip addresses, names, partial credit card data, passwords, payment histories, physical addresses, website activity. The breach dates from May 21, 2012; Have I Been Pwned loaded it on Jun 28, 2016.","tags":["data-breach","hibp","email-addresses","email-messages","employers","ip-addresses","names","partial-credit-card-data","passwords","payment-histories","physical-addresses","website-activity"],"title":"WHMCS data breach: 134K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/whmcs-data-breach","vendor":"WHMCS"},{"auto":true,"category":"breach","closedAt":"2016-07-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:UIGGY"],"json":"https://helix.ml/threat-watch/i/uiggy-data-breach.json","latestUpdate":{"date":"2016-06-27","title":"Have I Been Pwned loaded 2.7M breached Uiggy accounts"},"patchStatus":"no-fix-needed","product":"uiggy.com","severity":"medium","severityNote":"2.7M accounts","slug":"uiggy-data-breach","stacks":[],"startedAt":"2016-06-27","status":"closed","summary":"In June 2016, the Facebook application known as Uiggy was hacked and 4.3M accounts were exposed, 2.7M of which had email addresses against them. The leaked accounts also exposed names, genders and the Facebook ID of the owners. Exposed data: email addresses, genders, names, social connections, website activity. The breach dates from Jun 1, 2016; Have I Been Pwned loaded it on Jun 27, 2016.","tags":["data-breach","hibp","email-addresses","genders","names","social-connections","website-activity"],"title":"Uiggy data breach: 2.7M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/uiggy-data-breach","vendor":"Uiggy"},{"auto":true,"category":"breach","closedAt":"2016-06-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VK"],"json":"https://helix.ml/threat-watch/i/vk-data-breach.json","latestUpdate":{"date":"2016-06-09","title":"Have I Been Pwned loaded 93.3M breached VK accounts"},"patchStatus":"no-fix-needed","product":"vk.com","severity":"high","severityNote":"93.3M accounts · passwords exposed","slug":"vk-data-breach","stacks":[],"startedAt":"2016-06-09","status":"closed","summary":"In approximately 2012, the Russian social media site known as VK was hacked and almost 100 million accounts were exposed. The data emerged in June 2016 where it was being sold via a dark market website and included names, phone numbers email addresses and plain text passwords. Exposed data: email addresses, names, passwords, phone numbers. The breach dates from Jan 1, 2012; Have I Been Pwned loaded it on Jun 9, 2016.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers"],"title":"VK data breach: 93.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/vk-data-breach","vendor":"VK"},{"auto":true,"category":"breach","closedAt":"2016-06-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BITTORRENT"],"json":"https://helix.ml/threat-watch/i/bittorrent-data-breach.json","latestUpdate":{"date":"2016-06-08","title":"Have I Been Pwned loaded 34K breached BitTorrent accounts"},"patchStatus":"no-fix-needed","product":"bittorrent.com","severity":"high","severityNote":"34K accounts · passwords exposed","slug":"bittorrent-data-breach","stacks":[],"startedAt":"2016-06-08","status":"closed","summary":"In January 2016, the forum for the popular torrent software BitTorrent was hacked. The IP.Board based forum stored passwords as weak SHA1 salted hashes and the breached data also included usernames, email and IP addresses. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Jun 8, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"BitTorrent data breach: 34K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/bittorrent-data-breach","vendor":"BitTorrent"},{"auto":true,"category":"breach","closedAt":"2016-06-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYSPACE"],"json":"https://helix.ml/threat-watch/i/myspace-data-breach.json","latestUpdate":{"date":"2016-05-31","title":"Have I Been Pwned loaded 359.4M breached MySpace accounts"},"patchStatus":"no-fix-needed","product":"myspace.com","severity":"critical","severityNote":"359.4M accounts · passwords exposed","slug":"myspace-data-breach","stacks":[],"startedAt":"2016-05-31","status":"closed","summary":"In approximately 2008, MySpace suffered a data breach that exposed almost 360 million accounts. In May 2016 the data was offered up for sale on the \"Real Deal\" dark market website and included email addresses, usernames and SHA1 hashes of the first 10 characters of the password converted to lowercase and stored without a salt. The exact breach date is unknown, but analysis of the data suggests it was 8 years before being made public. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 1, 2008; Have I Been Pwned loaded it on May 31, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"MySpace data breach: 359.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/myspace-data-breach","vendor":"MySpace"},{"auto":true,"category":"breach","closedAt":"2016-06-12","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TUMBLR"],"json":"https://helix.ml/threat-watch/i/tumblr-data-breach.json","latestUpdate":{"date":"2016-05-29","title":"Have I Been Pwned loaded 65.5M breached tumblr accounts"},"patchStatus":"no-fix-needed","product":"tumblr.com","severity":"high","severityNote":"65.5M accounts · passwords exposed","slug":"tumblr-data-breach","stacks":[],"startedAt":"2016-05-29","status":"closed","summary":"In early 2013, tumblr suffered a data breach which resulted in the exposure of over 65 million accounts. The data was later put up for sale on a dark market website and included email addresses and passwords stored as salted SHA1 hashes. Exposed data: email addresses, passwords. The breach dates from Feb 28, 2013; Have I Been Pwned loaded it on May 29, 2016.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"tumblr data breach: 65.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/tumblr-data-breach","vendor":"tumblr"},{"auto":true,"category":"breach","closedAt":"2016-06-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLING"],"json":"https://helix.ml/threat-watch/i/fling-data-breach.json","latestUpdate":{"date":"2016-05-28","title":"Have I Been Pwned loaded 40.8M breached Fling accounts"},"patchStatus":"no-fix-needed","product":"fling.com","severity":"high","severityNote":"40.8M accounts · passwords exposed","slug":"fling-data-breach","stacks":[],"startedAt":"2016-05-28","status":"closed","summary":"In 2011, the self-proclaimed \"World's Best Adult Social Network\" website known as Fling was hacked and more than 40 million accounts obtained by the attacker. The breached data included highly sensitive personal attributes such as sexual orientation and sexual interests as well as email addresses and passwords stored in plain text. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, passwords, phone numbers, sexual fetishes, sexual orientations, usernames, website activity. The breach dates from Mar 10, 2011; Have I Been Pwned loaded it on May 28, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","passwords","phone-numbers","sexual-fetishes","sexual-orientations","usernames","website-activity"],"title":"Fling data breach: 40.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/fling-data-breach","vendor":"Fling"},{"auto":true,"category":"breach","closedAt":"2016-06-10","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FURAFFINITY"],"json":"https://helix.ml/threat-watch/i/furaffinity-data-breach.json","latestUpdate":{"date":"2016-05-27","title":"Have I Been Pwned loaded 1.3M breached Fur Affinity accounts"},"patchStatus":"no-fix-needed","product":"furaffinity.net","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"furaffinity-data-breach","stacks":[],"startedAt":"2016-05-27","status":"closed","summary":"In May 2016, the Fur Affinity website for people with an interest in anthropomorphic animal characters (also known as \"furries\") was hacked. The attack exposed 1.2M email addresses (many accounts had a different \"first\" and \"last\" email against them) and hashed passwords. Exposed data: email addresses, passwords, usernames. The breach dates from May 17, 2016; Have I Been Pwned loaded it on May 27, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Fur Affinity data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/furaffinity-data-breach","vendor":"Fur Affinity"},{"auto":true,"category":"breach","closedAt":"2016-06-04","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LINKEDIN"],"json":"https://helix.ml/threat-watch/i/linkedin-data-breach.json","latestUpdate":{"date":"2016-05-21","title":"Have I Been Pwned loaded 164.6M breached LinkedIn accounts"},"patchStatus":"no-fix-needed","product":"linkedin.com","severity":"critical","severityNote":"164.6M accounts · passwords exposed","slug":"linkedin-data-breach","stacks":[],"startedAt":"2016-05-21","status":"closed","summary":"In May 2016, LinkedIn had 164 million email addresses and passwords exposed. Originally hacked in 2012, the data remained out of sight until being offered for sale on a dark market site 4 years later. The passwords in the breach were stored as SHA1 hashes without salt, the vast majority of which were quickly cracked in the days following the release of the data. Exposed data: email addresses, passwords. The breach dates from May 5, 2012; Have I Been Pwned loaded it on May 21, 2016.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"LinkedIn data breach: 164.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/linkedin-data-breach","vendor":"LinkedIn"},{"auto":true,"category":"breach","closedAt":"2016-05-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ROSEBUTTBOARD"],"json":"https://helix.ml/threat-watch/i/rosebuttboard-data-breach.json","latestUpdate":{"date":"2016-05-10","title":"Have I Been Pwned loaded 107K breached Rosebutt Board accounts"},"patchStatus":"no-fix-needed","product":"rosebuttboard.com","severity":"high","severityNote":"107K accounts · passwords exposed","slug":"rosebuttboard-data-breach","stacks":[],"startedAt":"2016-05-10","status":"closed","summary":"Some time prior to May 2016, the forum known as \"Rosebutt Board\" was hacked and 107k accounts were exposed. The self-described \"top one board for anal fisting, prolapse, huge insertions and rosebutt fans\" had email and IP addresses, usernames and weakly stored salted MD5 password hashes hacked from the IP.Board based forum. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 9, 2016; Have I Been Pwned loaded it on May 10, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Rosebutt Board data breach: 107K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/rosebuttboard-data-breach","vendor":"Rosebutt Board"},{"auto":true,"category":"breach","closedAt":"2016-05-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NULLED"],"json":"https://helix.ml/threat-watch/i/nulled-data-breach.json","latestUpdate":{"date":"2016-05-09","title":"Have I Been Pwned loaded 599K breached Nulled.cr accounts"},"patchStatus":"no-fix-needed","product":"nulled.cr","severity":"high","severityNote":"599K accounts · passwords exposed","slug":"nulled-data-breach","stacks":[],"startedAt":"2016-05-09","status":"closed","summary":"In May 2016, the cracking community forum known as Nulled.cr was hacked and 599k user accounts were leaked publicly. The compromised data included email and IP addresses, weak salted MD5 password hashes and hundreds of thousands of private messages between members. Exposed data: dates of birth, email addresses, ip addresses, passwords, private messages, usernames, website activity. The breach dates from May 6, 2016; Have I Been Pwned loaded it on May 9, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","private-messages","usernames","website-activity"],"title":"Nulled.cr data breach: 599K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nulled-data-breach","vendor":"Nulled.cr"},{"auto":true,"category":"breach","closedAt":"2016-05-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QATARNATIONALBANK"],"json":"https://helix.ml/threat-watch/i/qatarnationalbank-data-breach.json","latestUpdate":{"date":"2016-05-01","title":"Have I Been Pwned loaded 88K breached Qatar National Bank accounts"},"patchStatus":"no-fix-needed","product":"qnb.com","severity":"high","severityNote":"88K accounts · passwords exposed · financial data exposed","slug":"qatarnationalbank-data-breach","stacks":[],"startedAt":"2016-05-01","status":"closed","summary":"In July 2015, the Qatar National Bank suffered a data breach which exposed 15k documents totalling 1.4GB and detailing more than 100k accounts with passwords and PINs. The incident was made public some 9 months later in April 2016 when the documents appeared publicly on a file sharing site. Analysis of the breached data suggests the attack began by exploiting a SQL injection flaw in the bank's website. Exposed data: bank account numbers, customer feedback, dates of birth, financial transactions, genders, geographic locations, government issued ids, ip addresses, marital statuses, names, passwords, phone numbers, physical addresses, pins, security questions and answers, spoken languages. The breach dates from Jul 1, 2015; Have I Been Pwned loaded it on May 1, 2016.","tags":["data-breach","hibp","bank-account-numbers","customer-feedback","dates-of-birth","financial-transactions","genders","geographic-locations","government-issued-ids","ip-addresses","marital-statuses","names","passwords","phone-numbers"],"title":"Qatar National Bank data breach: 88K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/qatarnationalbank-data-breach","vendor":"Qatar National Bank"},{"auto":true,"category":"breach","closedAt":"2016-05-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BEAUTIFULPEOPLE"],"json":"https://helix.ml/threat-watch/i/beautifulpeople-data-breach.json","latestUpdate":{"date":"2016-04-25","title":"Have I Been Pwned loaded 1.1M breached Beautiful People accounts"},"patchStatus":"no-fix-needed","product":"beautifulpeople.com","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"beautifulpeople-data-breach","stacks":[],"startedAt":"2016-04-25","status":"closed","summary":"In November 2015, the dating website Beautiful People was hacked and over 1.1M accounts were leaked. The data was being traded in underground circles and included a huge amount of personal information related to dating. Exposed data: beauty ratings, car ownership statuses, dates of birth, drinking habits, education levels, email addresses, genders, geographic locations, home ownership statuses, income levels, ip addresses, job titles, names, passwords, personal descriptions, personal interests, physical attributes, sexual orientations, smoking habits, website activity. The breach dates from Nov 11, 2015; Have I Been Pwned loaded it on Apr 25, 2016.","tags":["data-breach","hibp","beauty-ratings","car-ownership-statuses","dates-of-birth","drinking-habits","education-levels","email-addresses","genders","geographic-locations","home-ownership-statuses","income-levels","ip-addresses","job-titles"],"title":"Beautiful People data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/beautifulpeople-data-breach","vendor":"Beautiful People"},{"auto":true,"category":"breach","closedAt":"2016-05-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIFEBOAT"],"json":"https://helix.ml/threat-watch/i/lifeboat-data-breach.json","latestUpdate":{"date":"2016-04-25","title":"Have I Been Pwned loaded 7.1M breached Lifeboat accounts"},"patchStatus":"no-fix-needed","product":"lbsg.net","severity":"high","severityNote":"7.1M accounts · passwords exposed","slug":"lifeboat-data-breach","stacks":[],"startedAt":"2016-04-25","status":"closed","summary":"In January 2016, the Minecraft community known as Lifeboat was hacked and more than 7 million accounts leaked. Lifeboat knew of the incident for three months before the breach was made public but elected not to advise customers. The leaked data included usernames, email addresses and passwords stored as straight MD5 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 1, 2016; Have I Been Pwned loaded it on Apr 25, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Lifeboat data breach: 7.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lifeboat-data-breach","vendor":"Lifeboat"},{"auto":true,"category":"breach","closedAt":"2016-05-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NAUGHTYAMERICA"],"json":"https://helix.ml/threat-watch/i/naughtyamerica-data-breach.json","latestUpdate":{"date":"2016-04-24","title":"Have I Been Pwned loaded 1.4M breached Naughty America accounts"},"patchStatus":"no-fix-needed","product":"naughtyamerica.com","severity":"high","severityNote":"1.4M accounts · passwords exposed","slug":"naughtyamerica-data-breach","stacks":[],"startedAt":"2016-04-24","status":"closed","summary":"In March 2016, the adult website Naughty America was hacked and the data consequently sold online. The breach included data from numerous systems with various personal identity attributes, the largest of which had passwords stored as easily crackable MD5 hashes. There were 1.4 million unique email addresses in the breach. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Mar 14, 2016; Have I Been Pwned loaded it on Apr 24, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Naughty America data breach: 1.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/naughtyamerica-data-breach","vendor":"Naughty America"},{"auto":true,"category":"breach","closedAt":"2016-05-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRUCKERSMP"],"json":"https://helix.ml/threat-watch/i/truckersmp-data-breach.json","latestUpdate":{"date":"2016-04-24","title":"Have I Been Pwned loaded 83K breached TruckersMP accounts"},"patchStatus":"no-fix-needed","product":"truckersmp.com","severity":"high","severityNote":"83K accounts · passwords exposed","slug":"truckersmp-data-breach","stacks":[],"startedAt":"2016-04-24","status":"closed","summary":"In February 2016, the online trucking simulator mod TruckersMP suffered a data breach which exposed 84k user accounts. In a first for \"Have I Been Pwned\", the breached data was self-submitted directly by the organisation that was breached itself. Exposed data: email addresses, passwords, usernames. The breach dates from Feb 25, 2016; Have I Been Pwned loaded it on Apr 24, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"TruckersMP data breach: 83K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/truckersmp-data-breach","vendor":"TruckersMP"},{"auto":true,"category":"breach","closedAt":"2016-04-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COMELEC"],"json":"https://helix.ml/threat-watch/i/comelec-data-breach.json","latestUpdate":{"date":"2016-04-14","title":"Have I Been Pwned loaded 228K breached COMELEC (Philippines Voters) accounts"},"patchStatus":"no-fix-needed","product":"comelec.gov.ph","severity":"medium","severityNote":"228K accounts","slug":"comelec-data-breach","stacks":[],"startedAt":"2016-04-14","status":"closed","summary":"In March 2016, the Philippines Commission of Elections website (COMELEC) was attacked and defaced, allegedly by Anonymous Philippines. Shortly after, data on 55 million Filipino voters was leaked publicly and included sensitive information such as genders, marital statuses, height and weight and biometric fingerprint data. The breach only included 228k email addresses. Exposed data: biometric data, dates of birth, email addresses, family members' names, genders, job titles, marital statuses, names, passport numbers, phone numbers, physical addresses, physical attributes. The breach dates from Mar 27, 2016; Have I Been Pwned loaded it on Apr 14, 2016.","tags":["data-breach","hibp","biometric-data","dates-of-birth","email-addresses","family-members-names","genders","job-titles","marital-statuses","names","passport-numbers","phone-numbers","physical-addresses","physical-attributes"],"title":"COMELEC (Philippines Voters) data breach: 228K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/comelec-data-breach","vendor":"COMELEC (Philippines Voters)"},{"auto":true,"category":"breach","closedAt":"2016-04-28","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MATE1"],"json":"https://helix.ml/threat-watch/i/mate1-data-breach.json","latestUpdate":{"date":"2016-04-14","title":"Have I Been Pwned loaded 27.4M breached Mate1.com accounts"},"patchStatus":"no-fix-needed","product":"mate1.com","severity":"high","severityNote":"27.4M accounts · passwords exposed","slug":"mate1-data-breach","stacks":[],"startedAt":"2016-04-14","status":"closed","summary":"In February 2016, the dating site mate1.com suffered a huge data breach resulting in the disclosure of over 27 million subscribers' information. The data included deeply personal information about their private lives including drug and alcohol habits, incomes levels and sexual fetishes as well as passwords stored in plain text. Exposed data: astrological signs, dates of birth, drinking habits, drug habits, education levels, email addresses, ethnicities, fitness levels, genders, geographic locations, income levels, job titles, names, parenting plans, passwords, personal descriptions, physical attributes, political views, relationship statuses, religions, sexual fetishes, travel habits, usernames, website activity, work habits. The breach dates from Feb 29, 2016; Have I Been Pwned loaded it on Apr 14, 2016.","tags":["data-breach","hibp","astrological-signs","dates-of-birth","drinking-habits","drug-habits","education-levels","email-addresses","ethnicities","fitness-levels","genders","geographic-locations","income-levels","job-titles"],"title":"Mate1.com data breach: 27.4M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mate1-data-breach","vendor":"Mate1.com"},{"auto":true,"category":"breach","closedAt":"2016-04-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THEFAPPENING"],"json":"https://helix.ml/threat-watch/i/thefappening-data-breach.json","latestUpdate":{"date":"2016-04-13","title":"Have I Been Pwned loaded 179K breached The Fappening accounts"},"patchStatus":"no-fix-needed","product":"thefappening.so","severity":"high","severityNote":"179K accounts · passwords exposed","slug":"thefappening-data-breach","stacks":[],"startedAt":"2016-04-13","status":"closed","summary":"In December 2015, the forum for discussing naked celebrity photos known as \"The Fappening\" (named after the iCloud leaks of 2014) was compromised and 179k accounts were leaked. Exposed member data included usernames, email addresses and salted hashes of passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 1, 2015; Have I Been Pwned loaded it on Apr 13, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"The Fappening data breach: 179K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/thefappening-data-breach","vendor":"The Fappening"},{"auto":true,"category":"breach","closedAt":"2016-03-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DDO"],"json":"https://helix.ml/threat-watch/i/ddo-data-breach.json","latestUpdate":{"date":"2016-03-12","title":"Have I Been Pwned loaded 1.6M breached Dungeons \u0026 Dragons Online accounts"},"patchStatus":"no-fix-needed","product":"ddo.com","severity":"high","severityNote":"1.6M accounts · passwords exposed","slug":"ddo-data-breach","stacks":[],"startedAt":"2016-03-12","status":"closed","summary":"In April 2013, the interactive video game Dungeons \u0026 Dragons Online suffered a data breach that exposed almost 1.6M players' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Apr 2, 2013; Have I Been Pwned loaded it on Mar 12, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Dungeons \u0026 Dragons Online data breach: 1.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ddo-data-breach","vendor":"Dungeons \u0026 Dragons Online"},{"auto":true,"category":"breach","closedAt":"2016-03-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LOTR"],"json":"https://helix.ml/threat-watch/i/lotr-data-breach.json","latestUpdate":{"date":"2016-03-12","title":"Have I Been Pwned loaded 1.1M breached Lord of the Rings Online accounts"},"patchStatus":"no-fix-needed","product":"lotro.com","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"lotr-data-breach","stacks":[],"startedAt":"2016-03-12","status":"closed","summary":"In August 2013, the interactive video game Lord of the Rings Online suffered a data breach that exposed over 1.1M players' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and password hashes. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Aug 1, 2013; Have I Been Pwned loaded it on Mar 12, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Lord of the Rings Online data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lotr-data-breach","vendor":"Lord of the Rings Online"},{"auto":true,"category":"breach","closedAt":"2016-03-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AVAST"],"json":"https://helix.ml/threat-watch/i/avast-data-breach.json","latestUpdate":{"date":"2016-03-12","title":"Have I Been Pwned loaded 422K breached Avast accounts"},"patchStatus":"no-fix-needed","product":"avast.com","severity":"high","severityNote":"422K accounts · passwords exposed","slug":"avast-data-breach","stacks":[],"startedAt":"2016-03-12","status":"closed","summary":"In May 2014, the Avast anti-virus forum was hacked and 423k member records were exposed. The Simple Machines Based forum included usernames, emails and password hashes. Exposed data: email addresses, passwords, usernames. The breach dates from May 26, 2014; Have I Been Pwned loaded it on Mar 12, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Avast data breach: 422K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/avast-data-breach","vendor":"Avast"},{"auto":true,"category":"breach","closedAt":"2016-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SUMOTORRENT"],"json":"https://helix.ml/threat-watch/i/sumotorrent-data-breach.json","latestUpdate":{"date":"2016-03-09","title":"Have I Been Pwned loaded 285K breached Sumo Torrent accounts"},"patchStatus":"no-fix-needed","product":"sumotorrent.sx","severity":"high","severityNote":"285K accounts · passwords exposed","slug":"sumotorrent-data-breach","stacks":[],"startedAt":"2016-03-09","status":"closed","summary":"In June 2014, the torrent site Sumo Torrent was hacked and 285k member records were exposed. The data included IP addresses, email addresses and passwords stored as weak MD5 hashes. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Jun 21, 2014; Have I Been Pwned loaded it on Mar 9, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Sumo Torrent data breach: 285K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sumotorrent-data-breach","vendor":"Sumo Torrent"},{"auto":true,"category":"breach","closedAt":"2016-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SEEDPEER"],"json":"https://helix.ml/threat-watch/i/seedpeer-data-breach.json","latestUpdate":{"date":"2016-03-09","title":"Have I Been Pwned loaded 281K breached Seedpeer accounts"},"patchStatus":"no-fix-needed","product":"seedpeer.eu","severity":"high","severityNote":"281K accounts · passwords exposed","slug":"seedpeer-data-breach","stacks":[],"startedAt":"2016-03-09","status":"closed","summary":"In July 2015, the torrent site Seedpeer was hacked and 282k member records were exposed. The data included usernames, email addresses and passwords stored as weak MD5 hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 12, 2015; Have I Been Pwned loaded it on Mar 9, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Seedpeer data breach: 281K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/seedpeer-data-breach","vendor":"Seedpeer"},{"auto":true,"category":"breach","closedAt":"2016-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MINEFIELD"],"json":"https://helix.ml/threat-watch/i/minefield-data-breach.json","latestUpdate":{"date":"2016-03-09","title":"Have I Been Pwned loaded 188K breached Minefield accounts"},"patchStatus":"no-fix-needed","product":"minefield.fr","severity":"high","severityNote":"188K accounts · passwords exposed","slug":"minefield-data-breach","stacks":[],"startedAt":"2016-03-09","status":"closed","summary":"In June 2015, the French Minecraft server known as Minefield was hacked and 188k member records were exposed. The IP.Board forum included email and IP addresses, birth dates and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Jun 28, 2015; Have I Been Pwned loaded it on Mar 9, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Minefield data breach: 188K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/minefield-data-breach","vendor":"Minefield"},{"auto":true,"category":"breach","closedAt":"2016-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MALWAREBYTES"],"json":"https://helix.ml/threat-watch/i/malwarebytes-data-breach.json","latestUpdate":{"date":"2016-03-09","title":"Have I Been Pwned loaded 111K breached Malwarebytes accounts"},"patchStatus":"no-fix-needed","product":"malwarebytes.org","severity":"high","severityNote":"111K accounts · passwords exposed","slug":"malwarebytes-data-breach","stacks":[],"startedAt":"2016-03-09","status":"closed","summary":"In November 2014, the Malwarebytes forum was hacked and 111k member records were exposed. The IP.Board forum included email and IP addresses, birth dates and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Nov 15, 2014; Have I Been Pwned loaded it on Mar 9, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Malwarebytes data breach: 111K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/malwarebytes-data-breach","vendor":"Malwarebytes"},{"auto":true,"category":"breach","closedAt":"2016-03-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SOLOMID"],"json":"https://helix.ml/threat-watch/i/solomid-data-breach.json","latestUpdate":{"date":"2016-03-09","title":"Have I Been Pwned loaded 442K breached Team SoloMid accounts"},"patchStatus":"no-fix-needed","product":"solomid.net","severity":"high","severityNote":"442K accounts · passwords exposed","slug":"solomid-data-breach","stacks":[],"startedAt":"2016-03-09","status":"closed","summary":"In December 2014, the electronic sports organisation known as Team SoloMid was hacked and 442k members accounts were leaked. The accounts included email and IP addresses, usernames and salted hashes of passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Dec 22, 2014; Have I Been Pwned loaded it on Mar 9, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Team SoloMid data breach: 442K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/solomid-data-breach","vendor":"Team SoloMid"},{"auto":true,"category":"breach","closedAt":"2016-03-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ACNEORG"],"json":"https://helix.ml/threat-watch/i/acneorg-data-breach.json","latestUpdate":{"date":"2016-03-06","title":"Have I Been Pwned loaded 432K breached Acne.org accounts"},"patchStatus":"no-fix-needed","product":"acne.org","severity":"high","severityNote":"432K accounts · passwords exposed","slug":"acneorg-data-breach","stacks":[],"startedAt":"2016-03-06","status":"closed","summary":"In November 2014, the acne website acne.org suffered a data breach that exposed over 430k forum members' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and passwords. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Nov 25, 2014; Have I Been Pwned loaded it on Mar 6, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"Acne.org data breach: 432K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/acneorg-data-breach","vendor":"Acne.org"},{"auto":true,"category":"breach","closedAt":"2016-03-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WILDSTAR"],"json":"https://helix.ml/threat-watch/i/wildstar-data-breach.json","latestUpdate":{"date":"2016-03-06","title":"Have I Been Pwned loaded 738K breached WildStar accounts"},"patchStatus":"no-fix-needed","product":"wildstar-online.com","severity":"high","severityNote":"738K accounts · passwords exposed","slug":"wildstar-data-breach","stacks":[],"startedAt":"2016-03-06","status":"closed","summary":"In July 2015, the IP.Board forum for the gaming website WildStar suffered a data breach that exposed over 738k forum members' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and passwords. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jul 11, 2015; Have I Been Pwned loaded it on Mar 6, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames"],"title":"WildStar data breach: 738K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/wildstar-data-breach","vendor":"WildStar"},{"auto":true,"category":"breach","closedAt":"2016-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NIVAL"],"json":"https://helix.ml/threat-watch/i/nival-data-breach.json","latestUpdate":{"date":"2016-03-03","title":"Have I Been Pwned loaded 1.5M breached Nival accounts"},"patchStatus":"no-fix-needed","product":"nival.com","severity":"medium","severityNote":"1.5M accounts","slug":"nival-data-breach","stacks":[],"startedAt":"2016-03-03","status":"closed","summary":"In February 2016, the Russian gaming company Nival was the target of an attack which was consequently detailed on Reddit. Allegedly protesting \"the foreign policy of Russia in regards to Ukraine\", Nival was one of several Russian sites in the breach and impacted over 1.5M accounts including sensitive personal information. Exposed data: avatars, dates of birth, email addresses, genders, names, spoken languages, usernames, website activity. The breach dates from Feb 29, 2016; Have I Been Pwned loaded it on Mar 3, 2016.","tags":["data-breach","hibp","avatars","dates-of-birth","email-addresses","genders","names","spoken-languages","usernames","website-activity"],"title":"Nival data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nival-data-breach","vendor":"Nival"},{"auto":true,"category":"breach","closedAt":"2016-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MAJORGEEKS"],"json":"https://helix.ml/threat-watch/i/majorgeeks-data-breach.json","latestUpdate":{"date":"2016-03-03","title":"Have I Been Pwned loaded 269K breached MajorGeeks accounts"},"patchStatus":"no-fix-needed","product":"majorgeeks.com","severity":"high","severityNote":"269K accounts · passwords exposed","slug":"majorgeeks-data-breach","stacks":[],"startedAt":"2016-03-03","status":"closed","summary":"In November 2015, almost 270k accounts from the MajorGeeks support forum were breached. The accounts were being actively sold and traded online and included email addresses, salted password hashes and IP addresses. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Nov 15, 2015; Have I Been Pwned loaded it on Mar 3, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"MajorGeeks data breach: 269K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/majorgeeks-data-breach","vendor":"MajorGeeks"},{"auto":true,"category":"breach","closedAt":"2016-03-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:KMRU"],"json":"https://helix.ml/threat-watch/i/kmru-data-breach.json","latestUpdate":{"date":"2016-03-03","title":"Have I Been Pwned loaded 1.5M breached KM.RU accounts"},"patchStatus":"no-fix-needed","product":"km.ru","severity":"medium","severityNote":"1.5M accounts","slug":"kmru-data-breach","stacks":[],"startedAt":"2016-03-03","status":"closed","summary":"In February 2016, the Russian portal and email service KM.RU was the target of an attack which was consequently detailed on Reddit. Allegedly protesting \"the foreign policy of Russia in regards to Ukraine\", KM.RU was one of several Russian sites in the breach and impacted almost 1.5M accounts including sensitive personal information. Exposed data: dates of birth, email addresses, genders, geographic locations, recovery email addresses, security questions and answers, usernames. The breach dates from Feb 29, 2016; Have I Been Pwned loaded it on Mar 3, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","recovery-email-addresses","security-questions-and-answers","usernames"],"title":"KM.RU data breach: 1.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/kmru-data-breach","vendor":"KM.RU"},{"auto":true,"category":"breach","closedAt":"2016-03-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SKTORRENT"],"json":"https://helix.ml/threat-watch/i/sktorrent-data-breach.json","latestUpdate":{"date":"2016-02-23","title":"Have I Been Pwned loaded 117K breached SkTorrent accounts"},"patchStatus":"no-fix-needed","product":"sktorrent.eu","severity":"high","severityNote":"117K accounts · passwords exposed","slug":"sktorrent-data-breach","stacks":[],"startedAt":"2016-02-23","status":"closed","summary":"In February 2016, the Slovak torrent tracking site SkTorrent was hacked and over 117k records leaked online. The data dump included usernames, email addresses and passwords stored in plain text. Exposed data: email addresses, passwords, usernames. The breach dates from Feb 19, 2016; Have I Been Pwned loaded it on Feb 23, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"SkTorrent data breach: 117K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sktorrent-data-breach","vendor":"SkTorrent"},{"auto":true,"category":"breach","closedAt":"2016-03-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IPMART"],"json":"https://helix.ml/threat-watch/i/ipmart-data-breach.json","latestUpdate":{"date":"2016-02-23","title":"Have I Been Pwned loaded 2.5M breached iPmart accounts"},"patchStatus":"no-fix-needed","product":"ipmart-forum.com","severity":"high","severityNote":"2.5M accounts · passwords exposed","slug":"ipmart-data-breach","stacks":[],"startedAt":"2016-02-23","status":"closed","summary":"During 2015, the iPmart forum (now known as Mobi NUKE) was hacked and over 2 million forum members' details were exposed. The vBulletin forum included IP addresses, birth dates and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. A further 368k accounts were added to \"Have I Been Pwned\" in March 2016 bringing the total to over 2.4M. Exposed data: dates of birth, email addresses, passwords, usernames. The breach dates from Jul 1, 2015; Have I Been Pwned loaded it on Feb 23, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","passwords","usernames"],"title":"iPmart data breach: 2.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ipmart-data-breach","vendor":"iPmart"},{"auto":true,"category":"breach","closedAt":"2016-03-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LINUXMINT"],"json":"https://helix.ml/threat-watch/i/linuxmint-data-breach.json","latestUpdate":{"date":"2016-02-22","title":"Have I Been Pwned loaded 144K breached Linux Mint accounts"},"patchStatus":"no-fix-needed","product":"linuxmint.com","severity":"high","severityNote":"144K accounts · passwords exposed","slug":"linuxmint-data-breach","stacks":[],"startedAt":"2016-02-22","status":"closed","summary":"In February 2016, the website for the Linux distro known as Linux Mint was hacked and the ISO infected with a backdoor. The site also ran a phpBB forum which was subsequently put up for sale complete with almost 145k email addresses, passwords and other personal subscriber information. Exposed data: avatars, dates of birth, email addresses, geographic locations, ip addresses, passwords, time zones, website activity. The breach dates from Feb 21, 2016; Have I Been Pwned loaded it on Feb 22, 2016.","tags":["data-breach","hibp","avatars","dates-of-birth","email-addresses","geographic-locations","ip-addresses","passwords","time-zones","website-activity"],"title":"Linux Mint data breach: 144K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/linuxmint-data-breach","vendor":"Linux Mint"},{"auto":true,"category":"breach","closedAt":"2016-02-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:R2GAMES"],"json":"https://helix.ml/threat-watch/i/r2games-data-breach.json","latestUpdate":{"date":"2016-02-09","title":"Have I Been Pwned loaded 22.3M breached R2Games accounts"},"patchStatus":"no-fix-needed","product":"r2games.com","severity":"high","severityNote":"22.3M accounts · passwords exposed","slug":"r2games-data-breach","stacks":[],"startedAt":"2016-02-09","status":"closed","summary":"In late 2015, the gaming website R2Games was hacked and more than 2.1M personal records disclosed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. A further 11M accounts were added to \"Have I Been Pwned\" in March 2016 and another 9M in July 2016 bringing the total to over 22M. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Nov 1, 2015; Have I Been Pwned loaded it on Feb 9, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"R2Games data breach: 22.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/r2games-data-breach","vendor":"R2Games"},{"auto":true,"category":"breach","closedAt":"2016-02-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PLEX"],"json":"https://helix.ml/threat-watch/i/plex-data-breach.json","latestUpdate":{"date":"2016-02-08","title":"Have I Been Pwned loaded 327K breached Plex accounts"},"patchStatus":"no-fix-needed","product":"plex.tv","severity":"high","severityNote":"327K accounts · passwords exposed","slug":"plex-data-breach","stacks":[],"startedAt":"2016-02-08","status":"closed","summary":"In July 2015, the discussion forum for Plex media centre was hacked and over 327k accounts exposed. The IP.Board forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 2, 2015; Have I Been Pwned loaded it on Feb 8, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Plex data breach: 327K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/plex-data-breach","vendor":"Plex"},{"auto":true,"category":"breach","closedAt":"2016-02-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:COMCAST"],"json":"https://helix.ml/threat-watch/i/comcast-data-breach.json","latestUpdate":{"date":"2016-02-08","title":"Have I Been Pwned loaded 616K breached Comcast accounts"},"patchStatus":"no-fix-needed","product":"comcast.net","severity":"high","severityNote":"616K accounts · passwords exposed","slug":"comcast-data-breach","stacks":[],"startedAt":"2016-02-08","status":"closed","summary":"In November 2015, the US internet and cable TV provider Comcast suffered a data breach that exposed 590k customer email addresses and plain text passwords. A further 27k accounts appeared with home addresses with the entire data set being sold on underground forums. Exposed data: email addresses, passwords, physical addresses. The breach dates from Nov 8, 2015; Have I Been Pwned loaded it on Feb 8, 2016.","tags":["data-breach","hibp","email-addresses","passwords","physical-addresses"],"title":"Comcast data breach: 616K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/comcast-data-breach","vendor":"Comcast"},{"auto":true,"category":"breach","closedAt":"2016-02-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PSX-SCENE"],"json":"https://helix.ml/threat-watch/i/psx-scene-data-breach.json","latestUpdate":{"date":"2016-02-07","title":"Have I Been Pwned loaded 341K breached PSX-Scene accounts"},"patchStatus":"no-fix-needed","product":"psx-scene.com","severity":"high","severityNote":"341K accounts · passwords exposed","slug":"psx-scene-data-breach","stacks":[],"startedAt":"2016-02-07","status":"closed","summary":"In approximately February 2015, the Sony Playstation forum known as PSX-Scene was hacked and more than 340k accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Feb 1, 2015; Have I Been Pwned loaded it on Feb 7, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"PSX-Scene data breach: 341K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/psx-scene-data-breach","vendor":"PSX-Scene"},{"auto":true,"category":"breach","closedAt":"2016-02-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PS3HAX"],"json":"https://helix.ml/threat-watch/i/ps3hax-data-breach.json","latestUpdate":{"date":"2016-02-07","title":"Have I Been Pwned loaded 447K breached PS3Hax accounts"},"patchStatus":"no-fix-needed","product":"ps3hax.net","severity":"high","severityNote":"447K accounts · passwords exposed","slug":"ps3hax-data-breach","stacks":[],"startedAt":"2016-02-07","status":"closed","summary":"In approximately July 2015, the Sony Playstation hacks and mods forum known as PS3Hax was hacked and more than 447k accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 1, 2015; Have I Been Pwned loaded it on Feb 7, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"PS3Hax data breach: 447K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ps3hax-data-breach","vendor":"PS3Hax"},{"auto":true,"category":"breach","closedAt":"2016-02-21","cveIds":[],"exploited":"unknown","identifiers":["HIBP:XBOX-SCENE"],"json":"https://helix.ml/threat-watch/i/xbox-scene-data-breach.json","latestUpdate":{"date":"2016-02-07","title":"Have I Been Pwned loaded 432K breached Xbox-Scene accounts"},"patchStatus":"no-fix-needed","product":"xboxscene.com","severity":"high","severityNote":"432K accounts · passwords exposed","slug":"xbox-scene-data-breach","stacks":[],"startedAt":"2016-02-07","status":"closed","summary":"In approximately February 2015, the Xbox forum known as Xbox-Scene was hacked and more than 432k accounts were exposed. The IP.Board forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Feb 1, 2015; Have I Been Pwned loaded it on Feb 7, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Xbox-Scene data breach: 432K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/xbox-scene-data-breach","vendor":"Xbox-Scene"},{"auto":true,"category":"breach","closedAt":"2016-02-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:OWNEDCORE"],"json":"https://helix.ml/threat-watch/i/ownedcore-data-breach.json","latestUpdate":{"date":"2016-02-06","title":"Have I Been Pwned loaded 880K breached OwnedCore accounts"},"patchStatus":"no-fix-needed","product":"OwnedCore.com","severity":"high","severityNote":"880K accounts · passwords exposed","slug":"ownedcore-data-breach","stacks":[],"startedAt":"2016-02-06","status":"closed","summary":"In approximately August 2013, the World of Warcraft exploits forum known as OwnedCore was hacked and more than 880k accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Aug 1, 2013; Have I Been Pwned loaded it on Feb 6, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"OwnedCore data breach: 880K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ownedcore-data-breach","vendor":"OwnedCore"},{"auto":true,"category":"breach","closedAt":"2016-02-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMERZPLANET"],"json":"https://helix.ml/threat-watch/i/gamerzplanet-data-breach.json","latestUpdate":{"date":"2016-02-05","title":"Have I Been Pwned loaded 1.2M breached Gamerzplanet accounts"},"patchStatus":"no-fix-needed","product":"gamerzplanet.net","severity":"high","severityNote":"1.2M accounts · passwords exposed","slug":"gamerzplanet-data-breach","stacks":[],"startedAt":"2016-02-05","status":"closed","summary":"In approximately October 2015, the online gaming forum known as Gamerzplanet was hacked and more than 1.2M accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 23, 2015; Have I Been Pwned loaded it on Feb 5, 2016.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Gamerzplanet data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gamerzplanet-data-breach","vendor":"Gamerzplanet"},{"auto":true,"category":"breach","closedAt":"2016-02-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VBULLETIN"],"json":"https://helix.ml/threat-watch/i/vbulletin-data-breach.json","latestUpdate":{"date":"2016-01-24","title":"Have I Been Pwned loaded 518K breached vBulletin accounts"},"patchStatus":"no-fix-needed","product":"vbulletin.com","severity":"high","severityNote":"518K accounts · passwords exposed","slug":"vbulletin-data-breach","stacks":[],"startedAt":"2016-01-24","status":"closed","summary":"In November 2015, the forum software maker vBulletin suffered a serious data breach. The attack lead to the release of both forum user and customer accounts totalling almost 519k records. The breach included email addresses, birth dates, security questions and answers for customers and salted hashes of passwords for both sources. Exposed data: dates of birth, email addresses, homepage urls, instant messenger identities, ip addresses, passwords, security questions and answers, spoken languages, website activity. The breach dates from Nov 3, 2015; Have I Been Pwned loaded it on Jan 24, 2016.","tags":["data-breach","hibp","dates-of-birth","email-addresses","homepage-urls","instant-messenger-identities","ip-addresses","passwords","security-questions-and-answers","spoken-languages","website-activity"],"title":"vBulletin data breach: 518K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/vbulletin-data-breach","vendor":"vBulletin"},{"auto":true,"category":"breach","closedAt":"2016-02-07","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HEROESOFNEWERTH"],"json":"https://helix.ml/threat-watch/i/heroesofnewerth-data-breach.json","latestUpdate":{"date":"2016-01-24","title":"Have I Been Pwned loaded 8.1M breached Heroes of Newerth accounts"},"patchStatus":"no-fix-needed","product":"heroesofnewerth.com","severity":"high","severityNote":"8.1M accounts · passwords exposed","slug":"heroesofnewerth-data-breach","stacks":[],"startedAt":"2016-01-24","status":"closed","summary":"In December 2012, the multiplayer online battle arena game known as Heroes of Newerth was hacked and over 8 million accounts extracted from the system. The compromised data included usernames, email addresses and passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 17, 2012; Have I Been Pwned loaded it on Jan 24, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Heroes of Newerth data breach: 8.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/heroesofnewerth-data-breach","vendor":"Heroes of Newerth"},{"auto":true,"category":"breach","closedAt":"2016-02-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAMIGO"],"json":"https://helix.ml/threat-watch/i/gamigo-data-breach.json","latestUpdate":{"date":"2016-01-18","title":"Have I Been Pwned loaded 8.2M breached Gamigo accounts"},"patchStatus":"no-fix-needed","product":"gamigo.com","severity":"high","severityNote":"8.2M accounts · passwords exposed","slug":"gamigo-data-breach","stacks":[],"startedAt":"2016-01-18","status":"closed","summary":"In March 2012, the German online game publisher Gamigo was hacked and more than 8 million accounts publicly leaked. The breach included email addresses and passwords stored as weak MD5 hashes with no salt. Exposed data: email addresses, passwords. The breach dates from Mar 1, 2012; Have I Been Pwned loaded it on Jan 18, 2016.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Gamigo data breach: 8.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/gamigo-data-breach","vendor":"Gamigo"},{"auto":true,"category":"breach","closedAt":"2016-01-31","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NEXUSMODS"],"json":"https://helix.ml/threat-watch/i/nexusmods-data-breach.json","latestUpdate":{"date":"2016-01-17","title":"Have I Been Pwned loaded 5.9M breached Nexus Mods accounts"},"patchStatus":"no-fix-needed","product":"nexusmods.com","severity":"high","severityNote":"5.9M accounts · passwords exposed","slug":"nexusmods-data-breach","stacks":[],"startedAt":"2016-01-17","status":"closed","summary":"In December 2015, the game modding site Nexus Mods released a statement notifying users that they had been hacked. They subsequently dated the hack as having occurred in July 2013 although there is evidence to suggest the data was being traded months in advance of that. The breach contained usernames, email addresses and passwords stored as a salted hashes. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 22, 2013; Have I Been Pwned loaded it on Jan 17, 2016.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Nexus Mods data breach: 5.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nexusmods-data-breach","vendor":"Nexus Mods"},{"auto":true,"category":"breach","closedAt":"2016-01-03","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ANDROIDFORUMS"],"json":"https://helix.ml/threat-watch/i/androidforums-data-breach.json","latestUpdate":{"date":"2015-12-20","title":"Have I Been Pwned loaded 745K breached Android Forums accounts"},"patchStatus":"no-fix-needed","product":"androidforums.com","severity":"high","severityNote":"745K accounts · passwords exposed","slug":"androidforums-data-breach","stacks":[],"startedAt":"2015-12-20","status":"closed","summary":"In October 2011, the Android Forums website was hacked and 745k user accounts were subsequently leaked publicly. The compromised data included email addresses, user birth dates and passwords stored as a salted MD5 hash. Exposed data: dates of birth, email addresses, homepage urls, instant messenger identities, ip addresses, passwords. The breach dates from Oct 30, 2011; Have I Been Pwned loaded it on Dec 20, 2015.","tags":["data-breach","hibp","dates-of-birth","email-addresses","homepage-urls","instant-messenger-identities","ip-addresses","passwords"],"title":"Android Forums data breach: 745K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/androidforums-data-breach","vendor":"Android Forums"},{"auto":true,"category":"breach","closedAt":"2015-12-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MONEYBOOKERS"],"json":"https://helix.ml/threat-watch/i/moneybookers-data-breach.json","latestUpdate":{"date":"2015-11-30","title":"Have I Been Pwned loaded 4.5M breached Money Bookers accounts"},"patchStatus":"no-fix-needed","product":"moneybookers.com","severity":"medium","severityNote":"4.5M accounts","slug":"moneybookers-data-breach","stacks":[],"startedAt":"2015-11-30","status":"closed","summary":"Sometime in 2009, the e-wallet service known as Money Bookers suffered a data breach which exposed almost 4.5M customers. Now called Skrill, the breach was not discovered until October 2015 and included names, email addresses, home addresses and IP addresses. Exposed data: dates of birth, email addresses, ip addresses, names, phone numbers, physical addresses. The breach dates from Jan 1, 2009; Have I Been Pwned loaded it on Nov 30, 2015.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","names","phone-numbers","physical-addresses"],"title":"Money Bookers data breach: 4.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/moneybookers-data-breach","vendor":"Money Bookers"},{"auto":true,"category":"breach","closedAt":"2015-12-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NETELLER"],"json":"https://helix.ml/threat-watch/i/neteller-data-breach.json","latestUpdate":{"date":"2015-11-30","title":"Have I Been Pwned loaded 3.6M breached Neteller accounts"},"patchStatus":"no-fix-needed","product":"neteller.com","severity":"medium","severityNote":"3.6M accounts","slug":"neteller-data-breach","stacks":[],"startedAt":"2015-11-30","status":"closed","summary":"In May 2010, the e-wallet service known as Neteller suffered a data breach which exposed over 3.6M customers. The breach was not discovered until October 2015 and included names, email addresses, home addresses and account balances. Exposed data: account balances, dates of birth, email addresses, genders, ip addresses, names, phone numbers, physical addresses, security questions and answers, website activity. The breach dates from May 17, 2010; Have I Been Pwned loaded it on Nov 30, 2015.","tags":["data-breach","hibp","account-balances","dates-of-birth","email-addresses","genders","ip-addresses","names","phone-numbers","physical-addresses","security-questions-and-answers","website-activity"],"title":"Neteller data breach: 3.6M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/neteller-data-breach","vendor":"Neteller"},{"auto":true,"category":"breach","closedAt":"2015-12-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FOXYBINGO"],"json":"https://helix.ml/threat-watch/i/foxybingo-data-breach.json","latestUpdate":{"date":"2015-11-22","title":"Have I Been Pwned loaded 252K breached Foxy Bingo accounts"},"patchStatus":"no-fix-needed","product":"foxybingo.com","severity":"high","severityNote":"252K accounts · passwords exposed","slug":"foxybingo-data-breach","stacks":[],"startedAt":"2015-11-22","status":"closed","summary":"In April 2007, the online gambling site Foxy Bingo was hacked and 252,000 accounts were obtained by the hackers. The breached records were subsequently sold and traded and included personal information data such as plain text passwords, birth dates and home addresses. Exposed data: account balances, browser user agent details, dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, usernames, website activity. The breach dates from Apr 4, 2008; Have I Been Pwned loaded it on Nov 22, 2015.","tags":["data-breach","hibp","account-balances","browser-user-agent-details","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","usernames","website-activity"],"title":"Foxy Bingo data breach: 252K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/foxybingo-data-breach","vendor":"Foxy Bingo"},{"auto":true,"category":"breach","closedAt":"2015-11-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BLACKHATWORLD"],"json":"https://helix.ml/threat-watch/i/blackhatworld-data-breach.json","latestUpdate":{"date":"2015-11-03","title":"Have I Been Pwned loaded 777K breached Black Hat World accounts"},"patchStatus":"no-fix-needed","product":"blackhatworld.com","severity":"high","severityNote":"777K accounts · passwords exposed","slug":"blackhatworld-data-breach","stacks":[],"startedAt":"2015-11-03","status":"closed","summary":"In June 2014, the search engine optimisation forum Black Hat World had three quarters of a million accounts breached from their system. The breach included various personally identifiable attributes which were publicly released in a MySQL database script. Exposed data: dates of birth, email addresses, instant messenger identities, ip addresses, passwords, usernames, website activity. The breach dates from Jun 23, 2014; Have I Been Pwned loaded it on Nov 3, 2015.","tags":["data-breach","hibp","dates-of-birth","email-addresses","instant-messenger-identities","ip-addresses","passwords","usernames","website-activity"],"title":"Black Hat World data breach: 777K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/blackhatworld-data-breach","vendor":"Black Hat World"},{"auto":true,"category":"breach","closedAt":"2015-11-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FFSHRINE"],"json":"https://helix.ml/threat-watch/i/ffshrine-data-breach.json","latestUpdate":{"date":"2015-10-31","title":"Have I Been Pwned loaded 620K breached Final Fantasy Shrine accounts"},"patchStatus":"no-fix-needed","product":"ffshrine.org","severity":"high","severityNote":"620K accounts · passwords exposed","slug":"ffshrine-data-breach","stacks":[],"startedAt":"2015-10-31","status":"closed","summary":"In September 2015, the Final Fantasy discussion forum known as FFShrine was breached and the data dumped publicly. Approximately 620k records were released containing email addresses, IP addresses and salted hashes of passwords. Exposed data: email addresses, passwords, usernames, website activity. The breach dates from Sep 18, 2015; Have I Been Pwned loaded it on Oct 31, 2015.","tags":["data-breach","hibp","email-addresses","passwords","usernames","website-activity"],"title":"Final Fantasy Shrine data breach: 620K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ffshrine-data-breach","vendor":"Final Fantasy Shrine"},{"auto":true,"category":"breach","closedAt":"2015-11-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MAC-TORRENTS"],"json":"https://helix.ml/threat-watch/i/mac-torrents-data-breach.json","latestUpdate":{"date":"2015-10-31","title":"Have I Been Pwned loaded 93K breached Mac-Torrents accounts"},"patchStatus":"no-fix-needed","product":"mac-torrents.com","severity":"high","severityNote":"93K accounts · passwords exposed","slug":"mac-torrents-data-breach","stacks":[],"startedAt":"2015-10-31","status":"closed","summary":"In October 2015, the torrent site Mac-Torrents was hacked and almost 94k usernames, email addresses and passwords were leaked. The passwords were hashed with MD5 and no salt. Exposed data: email addresses, passwords, usernames. The breach dates from Oct 31, 2015; Have I Been Pwned loaded it on Oct 31, 2015.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Mac-Torrents data breach: 93K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mac-torrents-data-breach","vendor":"Mac-Torrents"},{"auto":true,"category":"breach","closedAt":"2015-11-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PHPFREAKS"],"json":"https://helix.ml/threat-watch/i/phpfreaks-data-breach.json","latestUpdate":{"date":"2015-10-30","title":"Have I Been Pwned loaded 173K breached PHP Freaks accounts"},"patchStatus":"no-fix-needed","product":"phpfreaks.com","severity":"high","severityNote":"173K accounts · passwords exposed","slug":"phpfreaks-data-breach","stacks":[],"startedAt":"2015-10-30","status":"closed","summary":"In October 2015, the PHP discussion board PHP Freaks was hacked and 173k user accounts were publicly leaked. The breach included multiple personal data attributes as well as salted and hashed passwords. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Oct 27, 2015; Have I Been Pwned loaded it on Oct 30, 2015.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"PHP Freaks data breach: 173K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/phpfreaks-data-breach","vendor":"PHP Freaks"},{"auto":true,"category":"breach","closedAt":"2015-11-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MPGH"],"json":"https://helix.ml/threat-watch/i/mpgh-data-breach.json","latestUpdate":{"date":"2015-10-26","title":"Have I Been Pwned loaded 3.1M breached MPGH accounts"},"patchStatus":"no-fix-needed","product":"mpgh.net","severity":"high","severityNote":"3.1M accounts · passwords exposed","slug":"mpgh-data-breach","stacks":[],"startedAt":"2015-10-26","status":"closed","summary":"In October 2015, the multiplayer game hacking website MPGH was hacked and 3.1 million user accounts disclosed. The vBulletin forum breach contained usernames, email addresses, IP addresses and salted hashes of passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Oct 22, 2015; Have I Been Pwned loaded it on Oct 26, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"MPGH data breach: 3.1M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mpgh-data-breach","vendor":"MPGH"},{"auto":true,"category":"breach","closedAt":"2015-11-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:000WEBHOST"],"json":"https://helix.ml/threat-watch/i/000webhost-data-breach.json","latestUpdate":{"date":"2015-10-26","title":"Have I Been Pwned loaded 14.9M breached 000webhost accounts"},"patchStatus":"no-fix-needed","product":"000webhost.com","severity":"high","severityNote":"14.9M accounts · passwords exposed","slug":"000webhost-data-breach","stacks":[],"startedAt":"2015-10-26","status":"closed","summary":"In approximately March 2015, the free web hosting provider 000webhost suffered a major data breach that exposed almost 15 million customer records. The data was sold and traded before 000webhost was alerted in October. The breach included names, email addresses and plain text passwords. Exposed data: email addresses, ip addresses, names, passwords. The breach dates from Mar 1, 2015; Have I Been Pwned loaded it on Oct 26, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords"],"title":"000webhost data breach: 14.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/000webhost-data-breach","vendor":"000webhost"},{"auto":true,"category":"breach","closedAt":"2015-10-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PADDYPOWER"],"json":"https://helix.ml/threat-watch/i/paddypower-data-breach.json","latestUpdate":{"date":"2015-10-11","title":"Have I Been Pwned loaded 590K breached Paddy Power accounts"},"patchStatus":"no-fix-needed","product":"paddypower.com","severity":"medium","severityNote":"590K accounts","slug":"paddypower-data-breach","stacks":[],"startedAt":"2015-10-11","status":"closed","summary":"In October 2010, the Irish bookmaker Paddy Power suffered a data breach that exposed 750,000 customer records with nearly 600,000 unique email addresses. The breach was not disclosed until July 2014 and contained extensive personal information including names, addresses, phone numbers and plain text security questions and answers. Exposed data: account balances, dates of birth, email addresses, ip addresses, names, phone numbers, physical addresses, security questions and answers, usernames, website activity. The breach dates from Oct 25, 2010; Have I Been Pwned loaded it on Oct 11, 2015.","tags":["data-breach","hibp","account-balances","dates-of-birth","email-addresses","ip-addresses","names","phone-numbers","physical-addresses","security-questions-and-answers","usernames","website-activity"],"title":"Paddy Power data breach: 590K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/paddypower-data-breach","vendor":"Paddy Power"},{"auto":true,"category":"breach","closedAt":"2015-10-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYVIDSTER"],"json":"https://helix.ml/threat-watch/i/myvidster-data-breach.json","latestUpdate":{"date":"2015-10-10","title":"Have I Been Pwned loaded 19K breached MyVidster (2015) accounts"},"patchStatus":"no-fix-needed","product":"myvidster.com","severity":"high","severityNote":"19K accounts · passwords exposed","slug":"myvidster-data-breach","stacks":[],"startedAt":"2015-10-10","status":"closed","summary":"In August 2015, the social video sharing and bookmarking site MyVidster was hacked and nearly 20,000 accounts were dumped online. The dump included usernames, email addresses and hashed passwords. Exposed data: email addresses, passwords, usernames. The breach dates from Aug 15, 2015; Have I Been Pwned loaded it on Oct 10, 2015.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"MyVidster (2015) data breach: 19K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/myvidster-data-breach","vendor":"MyVidster (2015)"},{"auto":true,"category":"breach","closedAt":"2015-10-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PATREON"],"json":"https://helix.ml/threat-watch/i/patreon-data-breach.json","latestUpdate":{"date":"2015-10-02","title":"Have I Been Pwned loaded 2.3M breached Patreon accounts"},"patchStatus":"no-fix-needed","product":"patreon.com","severity":"high","severityNote":"2.3M accounts · passwords exposed · financial data exposed","slug":"patreon-data-breach","stacks":[],"startedAt":"2015-10-02","status":"closed","summary":"In October 2015, the crowdfunding site Patreon was hacked and over 16GB of data was released publicly. The dump included almost 14GB of database records with more than 2.3M unique email addresses, millions of personal messages and passwords stored as bcrypt hashes. Exposed data: email addresses, passwords, payment histories, physical addresses, private messages, website activity. The breach dates from Oct 1, 2015; Have I Been Pwned loaded it on Oct 2, 2015.","tags":["data-breach","hibp","email-addresses","passwords","payment-histories","physical-addresses","private-messages","website-activity"],"title":"Patreon data breach: 2.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/patreon-data-breach","vendor":"Patreon"},{"auto":true,"category":"breach","closedAt":"2015-09-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ASHLEYMADISON"],"json":"https://helix.ml/threat-watch/i/ashleymadison-data-breach.json","latestUpdate":{"date":"2015-08-18","title":"Have I Been Pwned loaded 30.8M breached Ashley Madison accounts"},"patchStatus":"no-fix-needed","product":"ashleymadison.com","severity":"high","severityNote":"30.8M accounts · passwords exposed · financial data exposed","slug":"ashleymadison-data-breach","stacks":[],"startedAt":"2015-08-18","status":"closed","summary":"In July 2015, the infidelity website Ashley Madison suffered a serious data breach. The attackers threatened Ashley Madison with the full disclosure of the breach unless the service was shut down. One month later, the database was dumped including more than 30M unique email addresses. This breach has been classed as \"sensitive\" and is not publicly searchable, although individuals may discover if they've been impacted by registering for notifications. Read about this approach in detail. Exposed data: dates of birth, email addresses, ethnicities, genders, names, passwords, payment histories, phone numbers, physical addresses, security questions and answers, sexual orientations, usernames, website activity. The breach dates from Jul 19, 2015; Have I Been Pwned loaded it on Aug 18, 2015.","tags":["data-breach","hibp","dates-of-birth","email-addresses","ethnicities","genders","names","passwords","payment-histories","phone-numbers","physical-addresses","security-questions-and-answers","sexual-orientations","usernames"],"title":"Ashley Madison data breach: 30.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ashleymadison-data-breach","vendor":"Ashley Madison"},{"auto":true,"category":"breach","closedAt":"2015-08-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:XSPLIT"],"json":"https://helix.ml/threat-watch/i/xsplit-data-breach.json","latestUpdate":{"date":"2015-08-08","title":"Have I Been Pwned loaded 3.0M breached XSplit accounts"},"patchStatus":"no-fix-needed","product":"xsplit.com","severity":"high","severityNote":"3.0M accounts · passwords exposed","slug":"xsplit-data-breach","stacks":[],"startedAt":"2015-08-08","status":"closed","summary":"In November 2013, the makers of gaming live streaming and recording software XSplit was compromised in an online attack. The data breach leaked almost 3M names, email addresses, usernames and hashed passwords. Exposed data: email addresses, names, passwords, usernames. The breach dates from Nov 7, 2013; Have I Been Pwned loaded it on Aug 8, 2015.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"XSplit data breach: 3.0M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/xsplit-data-breach","vendor":"XSplit"},{"auto":true,"category":"breach","closedAt":"2015-08-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YOUPORN"],"json":"https://helix.ml/threat-watch/i/youporn-data-breach.json","latestUpdate":{"date":"2015-07-30","title":"Have I Been Pwned loaded 1.3M breached YouPorn accounts"},"patchStatus":"no-fix-needed","product":"youporn.com","severity":"high","severityNote":"1.3M accounts · passwords exposed","slug":"youporn-data-breach","stacks":[],"startedAt":"2015-07-30","status":"closed","summary":"In February 2012, the adult website YouPorn had over 1.3M user accounts exposed in a data breach. The publicly released data included both email addresses and plain text passwords. Exposed data: email addresses, passwords. The breach dates from Feb 21, 2012; Have I Been Pwned loaded it on Jul 30, 2015.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"YouPorn data breach: 1.3M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/youporn-data-breach","vendor":"YouPorn"},{"auto":true,"category":"breach","closedAt":"2015-07-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HACKINGTEAM"],"json":"https://helix.ml/threat-watch/i/hackingteam-data-breach.json","latestUpdate":{"date":"2015-07-12","title":"Have I Been Pwned loaded 32K breached Hacking Team accounts"},"patchStatus":"no-fix-needed","product":"hackingteam.com","severity":"medium","severityNote":"32K accounts","slug":"hackingteam-data-breach","stacks":[],"startedAt":"2015-07-12","status":"closed","summary":"In July 2015, the Italian security firm Hacking Team suffered a major data breach that resulted in over 400GB of their data being posted online via a torrent. The data searchable on \"Have I Been Pwned?\" is from 189GB worth of PST mail folders in the dump. The contents of the PST files is searchable on Wikileaks. Exposed data: email addresses, email messages. The breach dates from Jul 6, 2015; Have I Been Pwned loaded it on Jul 12, 2015.","tags":["data-breach","hibp","email-addresses","email-messages"],"title":"Hacking Team data breach: 32K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hackingteam-data-breach","vendor":"Hacking Team"},{"auto":true,"category":"breach","closedAt":"2015-07-23","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HEMMAKVALL"],"json":"https://helix.ml/threat-watch/i/hemmakvall-data-breach.json","latestUpdate":{"date":"2015-07-09","title":"Have I Been Pwned loaded 47K breached Hemmakväll accounts"},"patchStatus":"no-fix-needed","product":"hemmakvall.se","severity":"high","severityNote":"47K accounts · passwords exposed","slug":"hemmakvall-data-breach","stacks":[],"startedAt":"2015-07-09","status":"closed","summary":"In July 2015, the Swedish video store chain Hemmakväll was hacked and nearly 50k records dumped publicly. The disclosed data included various attributes of their customers including email and physical addresses, names and phone numbers. Passwords were also leaked, stored with a weak MD5 hashing algorithm. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jul 8, 2015; Have I Been Pwned loaded it on Jul 9, 2015.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Hemmakväll data breach: 47K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hemmakvall-data-breach","vendor":"Hemmakväll"},{"auto":true,"category":"breach","closedAt":"2015-07-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MYREPOSPACE"],"json":"https://helix.ml/threat-watch/i/myrepospace-data-breach.json","latestUpdate":{"date":"2015-07-08","title":"Have I Been Pwned loaded 252K breached myRepoSpace accounts"},"patchStatus":"no-fix-needed","product":"myrepospace.com","severity":"high","severityNote":"252K accounts · passwords exposed","slug":"myrepospace-data-breach","stacks":[],"startedAt":"2015-07-08","status":"closed","summary":"In July 2015, the Cydia repository known as myRepoSpace was hacked and user data leaked publicly. Cydia is designed to facilitate the installation of apps on jailbroken iOS devices. The repository service was allegedly hacked by @its_not_herpes and 0x8badfl00d in retaliation for the service refusing to remove pirated tweaks. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jul 6, 2015; Have I Been Pwned loaded it on Jul 8, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"myRepoSpace data breach: 252K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/myrepospace-data-breach","vendor":"myRepoSpace"},{"auto":true,"category":"breach","closedAt":"2015-07-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MINECRAFTPOCKETEDITIONFORUM"],"json":"https://helix.ml/threat-watch/i/minecraftpocketeditionforum-data-breach.json","latestUpdate":{"date":"2015-06-30","title":"Have I Been Pwned loaded 16K breached Minecraft Pocket Edition Forum accounts"},"patchStatus":"no-fix-needed","product":"minecraftpeforum.net","severity":"high","severityNote":"16K accounts · passwords exposed","slug":"minecraftpocketeditionforum-data-breach","stacks":[],"startedAt":"2015-06-30","status":"closed","summary":"In May 2015, the Minecraft Pocket Edition forum was hacked and over 16k accounts were dumped public. Allegedly hacked by @rmsg0d, the forum data included numerous personal pieces of data for each user. The forum has subsequently been decommissioned. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from May 24, 2015; Have I Been Pwned loaded it on Jun 30, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"Minecraft Pocket Edition Forum data breach: 16K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/minecraftpocketeditionforum-data-breach","vendor":"Minecraft Pocket Edition Forum"},{"auto":true,"category":"breach","closedAt":"2015-06-19","cveIds":[],"exploited":"unknown","identifiers":["HIBP:NEXTGENUPDATE"],"json":"https://helix.ml/threat-watch/i/nextgenupdate-data-breach.json","latestUpdate":{"date":"2015-06-05","title":"Have I Been Pwned loaded 1.2M breached NextGenUpdate accounts"},"patchStatus":"no-fix-needed","product":"nextgenupdate.com","severity":"high","severityNote":"1.2M accounts · passwords exposed","slug":"nextgenupdate-data-breach","stacks":[],"startedAt":"2015-06-05","status":"closed","summary":"Early in 2014, the video game website NextGenUpdate reportedly suffered a data breach that disclosed almost 1.2 million accounts. Amongst the data breach was usernames, email addresses, IP addresses and salted and hashed passwords. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Apr 22, 2014; Have I Been Pwned loaded it on Jun 5, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"NextGenUpdate data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/nextgenupdate-data-breach","vendor":"NextGenUpdate"},{"auto":true,"category":"breach","closedAt":"2015-06-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MSPY"],"json":"https://helix.ml/threat-watch/i/mspy-data-breach.json","latestUpdate":{"date":"2015-05-28","title":"Have I Been Pwned loaded 699K breached mSpy accounts"},"patchStatus":"no-fix-needed","product":"mspy.com","severity":"high","severityNote":"699K accounts","slug":"mspy-data-breach","stacks":[],"startedAt":"2015-05-28","status":"closed","summary":"In May 2015, the \"monitoring\" software known as mSpy suffered a major data breach. The software (allegedly often used to spy on unsuspecting victims), stored extensive personal information within their online service which after being breached, was made freely available on the internet. Exposed data: device usage tracking data. The breach dates from May 14, 2015; Have I Been Pwned loaded it on May 28, 2015.","tags":["data-breach","hibp","device-usage-tracking-data"],"title":"mSpy data breach: 699K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mspy-data-breach","vendor":"mSpy"},{"auto":true,"category":"breach","closedAt":"2015-06-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADULTFRIENDFINDER"],"json":"https://helix.ml/threat-watch/i/adultfriendfinder-data-breach.json","latestUpdate":{"date":"2015-05-22","title":"Have I Been Pwned loaded 3.9M breached Adult FriendFinder (2015) accounts"},"patchStatus":"no-fix-needed","product":"adultfriendfinder.com","severity":"high","severityNote":"3.9M accounts","slug":"adultfriendfinder-data-breach","stacks":[],"startedAt":"2015-05-22","status":"closed","summary":"In May 2015, the adult hookup site Adult FriendFinder was hacked and nearly 4 million records dumped publicly. The data dump included extremely sensitive personal information about individuals and their relationship statuses and sexual preferences combined with personally identifiable information. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, races, relationship statuses, sexual orientations, spoken languages, usernames. The breach dates from May 21, 2015; Have I Been Pwned loaded it on May 22, 2015.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","races","relationship-statuses","sexual-orientations","spoken-languages","usernames"],"title":"Adult FriendFinder (2015) data breach: 3.9M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/adultfriendfinder-data-breach","vendor":"Adult FriendFinder (2015)"},{"auto":true,"category":"breach","closedAt":"2015-05-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPRASHIVAIRU"],"json":"https://helix.ml/threat-watch/i/sprashivairu-data-breach.json","latestUpdate":{"date":"2015-05-12","title":"Have I Been Pwned loaded 3.5M breached Спрашивай.ру accounts"},"patchStatus":"no-fix-needed","product":"sprashivai.ru","severity":"high","severityNote":"3.5M accounts · passwords exposed","slug":"sprashivairu-data-breach","stacks":[],"startedAt":"2015-05-12","status":"closed","summary":"In May 2015, Спрашивай.ру (a the Russian website for anonymous reviews) was reported to have had 6.7 million user details exposed by a hacker known as \"w0rm\". Intended to be a site for expressing anonymous opinions, the leaked data included email addresses, birth dates and other personally identifiable data about almost 3.5 million unique email addresses found in the leak. Exposed data: dates of birth, email addresses, genders, geographic locations, ip addresses, passwords, spoken languages. The breach dates from May 11, 2015; Have I Been Pwned loaded it on May 12, 2015.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","geographic-locations","ip-addresses","passwords","spoken-languages"],"title":"Спрашивай.ру data breach: 3.5M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/sprashivairu-data-breach","vendor":"Спрашивай.ру"},{"auto":true,"category":"breach","closedAt":"2015-05-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TRAI"],"json":"https://helix.ml/threat-watch/i/trai-data-breach.json","latestUpdate":{"date":"2015-04-27","title":"Have I Been Pwned loaded 107K breached Telecom Regulatory Authority of India accounts"},"patchStatus":"no-fix-needed","product":"trai.gov.in","severity":"medium","severityNote":"107K accounts","slug":"trai-data-breach","stacks":[],"startedAt":"2015-04-27","status":"closed","summary":"In April 2015, the Telecom Regulatory Authority of India (TRAI) published tens of thousand of emails sent by Indian citizens supporting net neutrality as part of the SaveTheInternet campaign. The published data included lists of emails including the sender's name and email address as well as the contents of the email as well, often with signatures including other personal data. Exposed data: email addresses, email messages. The breach dates from Apr 27, 2015; Have I Been Pwned loaded it on Apr 27, 2015.","tags":["data-breach","hibp","email-addresses","email-messages"],"title":"Telecom Regulatory Authority of India data breach: 107K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/trai-data-breach","vendor":"Telecom Regulatory Authority of India"},{"auto":true,"category":"breach","closedAt":"2015-04-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STARNET"],"json":"https://helix.ml/threat-watch/i/starnet-data-breach.json","latestUpdate":{"date":"2015-04-11","title":"Have I Been Pwned loaded 139K breached StarNet accounts"},"patchStatus":"no-fix-needed","product":"starnet.md","severity":"high","severityNote":"139K accounts · passwords exposed","slug":"starnet-data-breach","stacks":[],"startedAt":"2015-04-11","status":"closed","summary":"In February 2015, the Moldavian ISP \"StarNet\" had it's database published online. The dump included nearly 140k email addresses, many with personal details including contact information, usage patterns of the ISP and even passport numbers. Exposed data: customer interactions, dates of birth, email addresses, genders, ip addresses, mac addresses, names, passport numbers, passwords, phone numbers. The breach dates from Feb 26, 2015; Have I Been Pwned loaded it on Apr 11, 2015.","tags":["data-breach","hibp","customer-interactions","dates-of-birth","email-addresses","genders","ip-addresses","mac-addresses","names","passport-numbers","passwords","phone-numbers"],"title":"StarNet data breach: 139K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/starnet-data-breach","vendor":"StarNet"},{"auto":true,"category":"breach","closedAt":"2015-04-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:QUANTUMBOOTER"],"json":"https://helix.ml/threat-watch/i/quantumbooter-data-breach.json","latestUpdate":{"date":"2015-04-04","title":"Have I Been Pwned loaded 48K breached Quantum Booter accounts"},"patchStatus":"no-fix-needed","product":"quantumbooter.net","severity":"high","severityNote":"48K accounts · passwords exposed","slug":"quantumbooter-data-breach","stacks":[],"startedAt":"2015-04-04","status":"closed","summary":"In March 2014, the booter service Quantum Booter (also referred to as Quantum Stresser) suffered a breach which lead to the disclosure of their internal database. The leaked data included private discussions relating to malicious activity Quantum Booter users were performing against online adversaries, including the IP addresses of those using the service to mount DDoS attacks. Exposed data: email addresses, ip addresses, passwords, private messages, usernames, website activity. The breach dates from Mar 18, 2014; Have I Been Pwned loaded it on Apr 4, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","private-messages","usernames","website-activity"],"title":"Quantum Booter data breach: 48K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/quantumbooter-data-breach","vendor":"Quantum Booter"},{"auto":true,"category":"breach","closedAt":"2015-04-11","cveIds":[],"exploited":"unknown","identifiers":["HIBP:THISHABBOFORUM"],"json":"https://helix.ml/threat-watch/i/thishabboforum-data-breach.json","latestUpdate":{"date":"2015-03-28","title":"Have I Been Pwned loaded 612K breached ThisHabbo Forum accounts"},"patchStatus":"no-fix-needed","product":"thishabboforum.com","severity":"high","severityNote":"612K accounts · passwords exposed","slug":"thishabboforum-data-breach","stacks":[],"startedAt":"2015-03-28","status":"closed","summary":"In 2014, the ThisHabbo forum (a fan site for Habbo.com, a Finnish social networking site) appeared among a list of compromised sites which has subsequently been removed from the internet. Whilst the actual date of the exploit is not clear, the breached data includes usernames, email addresses, IP addresses and salted hashes of passwords. A further 584k records were added from a more comprehensive breach file provided in October 2016. Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 1, 2014; Have I Been Pwned loaded it on Mar 28, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames"],"title":"ThisHabbo Forum data breach: 612K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/thishabboforum-data-breach","vendor":"ThisHabbo Forum"},{"auto":true,"category":"breach","closedAt":"2015-02-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FLASHBACK"],"json":"https://helix.ml/threat-watch/i/flashback-data-breach.json","latestUpdate":{"date":"2015-02-12","title":"Have I Been Pwned loaded 40K breached Flashback accounts"},"patchStatus":"no-fix-needed","product":"flashback.se","severity":"medium","severityNote":"40K accounts","slug":"flashback-data-breach","stacks":[],"startedAt":"2015-02-12","status":"closed","summary":"In February 2015, the Swedish forum known as Flashback had sensitive internal data on 40k members published via the tabloid newspaper Aftonbladet. The data was allegedly sold to them via Researchgruppen (The Research Group) who have a history of exposing otherwise anonymous users, primarily those who they believe participate in \"troll like\" behaviour. The compromised data includes social security numbers, home and email addresses. Exposed data: email addresses, government issued ids, physical addresses. The breach dates from Feb 11, 2015; Have I Been Pwned loaded it on Feb 12, 2015.","tags":["data-breach","hibp","email-addresses","government-issued-ids","physical-addresses"],"title":"Flashback data breach: 40K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/flashback-data-breach","vendor":"Flashback"},{"auto":true,"category":"breach","closedAt":"2015-02-17","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CRACKCOMMUNITY"],"json":"https://helix.ml/threat-watch/i/crackcommunity-data-breach.json","latestUpdate":{"date":"2015-02-03","title":"Have I Been Pwned loaded 19K breached Crack Community accounts"},"patchStatus":"no-fix-needed","product":"crackcommunity.com","severity":"high","severityNote":"19K accounts · passwords exposed","slug":"crackcommunity-data-breach","stacks":[],"startedAt":"2015-02-03","status":"closed","summary":"In late 2013, the Crack Community forum specialising in cracks for games was compromised and over 19k accounts published online. Built on the MyBB forum platform, the compromised data included email addresses, IP addresses and salted MD5 passwords. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Sep 9, 2013; Have I Been Pwned loaded it on Feb 3, 2015.","tags":["data-breach","hibp","email-addresses","ip-addresses","passwords","usernames","website-activity"],"title":"Crack Community data breach: 19K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/crackcommunity-data-breach","vendor":"Crack Community"},{"auto":true,"category":"breach","closedAt":"2015-02-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LIZARDSQUAD"],"json":"https://helix.ml/threat-watch/i/lizardsquad-data-breach.json","latestUpdate":{"date":"2015-01-18","title":"Have I Been Pwned loaded 13K breached Lizard Squad accounts"},"patchStatus":"no-fix-needed","product":"lizardstresser.su","severity":"high","severityNote":"13K accounts · passwords exposed","slug":"lizardsquad-data-breach","stacks":[],"startedAt":"2015-01-18","status":"closed","summary":"In January 2015, the hacker collective known as \"Lizard Squad\" created a DDoS service by the name of \"Lizard Stresser\" which could be procured to mount attacks against online targets. Shortly thereafter, the service suffered a data breach which resulted in the public disclosure of over 13k user accounts including passwords stored in plain text. Exposed data: email addresses, passwords, usernames. The breach dates from Jan 16, 2015; Have I Been Pwned loaded it on Jan 18, 2015.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Lizard Squad data breach: 13K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/lizardsquad-data-breach","vendor":"Lizard Squad"},{"auto":true,"category":"breach","closedAt":"2015-01-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:DOMINOS"],"json":"https://helix.ml/threat-watch/i/dominos-data-breach.json","latestUpdate":{"date":"2015-01-04","title":"Have I Been Pwned loaded 648K breached Domino's accounts"},"patchStatus":"no-fix-needed","product":"pizza.dominos.be","severity":"high","severityNote":"648K accounts · passwords exposed","slug":"dominos-data-breach","stacks":[],"startedAt":"2015-01-04","status":"closed","summary":"In June 2014, Domino's Pizza in France and Belgium was hacked by a group going by the name \"Rex Mundi\" and their customer data held to ransom. Domino's refused to pay the ransom and six months later, the attackers released the data along with troves of other hacked accounts. Amongst the customer data was passwords stored with a weak MD5 hashing algorithm and no salt. Exposed data: email addresses, names, passwords, phone numbers, physical addresses. The breach dates from Jun 13, 2014; Have I Been Pwned loaded it on Jan 4, 2015.","tags":["data-breach","hibp","email-addresses","names","passwords","phone-numbers","physical-addresses"],"title":"Domino's data breach: 648K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/dominos-data-breach","vendor":"Domino's"},{"auto":true,"category":"breach","closedAt":"2014-11-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:AHASHARE"],"json":"https://helix.ml/threat-watch/i/ahashare-data-breach.json","latestUpdate":{"date":"2014-11-06","title":"Have I Been Pwned loaded 180K breached AhaShare.com accounts"},"patchStatus":"no-fix-needed","product":"ahashare.com","severity":"high","severityNote":"180K accounts · passwords exposed","slug":"ahashare-data-breach","stacks":[],"startedAt":"2014-11-06","status":"closed","summary":"In May 2013, the torrent site AhaShare.com suffered a breach which resulted in more than 180k user accounts being published publicly. The breach included a raft of personal information on registered users plus despite assertions of not distributing personally identifiable information, the site also leaked the IP addresses used by the registered identities. Exposed data: email addresses, genders, geographic locations, ip addresses, partial dates of birth, passwords, usernames, website activity. The breach dates from May 30, 2013; Have I Been Pwned loaded it on Nov 6, 2014.","tags":["data-breach","hibp","email-addresses","genders","geographic-locations","ip-addresses","partial-dates-of-birth","passwords","usernames","website-activity"],"title":"AhaShare.com data breach: 180K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/ahashare-data-breach","vendor":"AhaShare.com"},{"auto":true,"category":"breach","closedAt":"2014-09-26","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YANDEX"],"json":"https://helix.ml/threat-watch/i/yandex-data-breach.json","latestUpdate":{"date":"2014-09-12","title":"Have I Been Pwned loaded 1.2M breached Yandex Dump accounts"},"patchStatus":"no-fix-needed","product":"forum.btcsec.com","severity":"high","severityNote":"1.2M accounts · passwords exposed","slug":"yandex-data-breach","stacks":[],"startedAt":"2014-09-12","status":"closed","summary":"In September 2014, news broke of a massive leak of accounts from Yandex, the Russian search engine giants who also provides email services. The purported million \"breached\" accounts were disclosed at the same time as nearly 5M mail.ru accounts with both companies claiming the credentials were acquired via phishing scams rather than being obtained as a result of direct attacks against their services. Exposed data: email addresses, passwords. The breach dates from Sep 7, 2014; Have I Been Pwned loaded it on Sep 12, 2014.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Yandex Dump data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/yandex-data-breach","vendor":"Yandex Dump"},{"auto":true,"category":"breach","closedAt":"2014-09-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BTSEC"],"json":"https://helix.ml/threat-watch/i/btsec-data-breach.json","latestUpdate":{"date":"2014-09-10","title":"Have I Been Pwned loaded 4.8M breached Bitcoin Security Forum Gmail Dump accounts"},"patchStatus":"no-fix-needed","product":"forum.btcsec.com","severity":"high","severityNote":"4.8M accounts · passwords exposed","slug":"btsec-data-breach","stacks":[],"startedAt":"2014-09-10","status":"closed","summary":"In September 2014, a large dump of nearly 5M usernames and passwords was posted to a Russian Bitcoin forum. Whilst commonly reported as 5M \"Gmail passwords\", the dump also contained 123k yandex.ru addresses. Whilst the origin of the breach remains unclear, the breached credentials were confirmed by multiple source as correct, albeit a number of years old. Exposed data: email addresses, passwords. The breach dates from Jan 9, 2014; Have I Been Pwned loaded it on Sep 10, 2014.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Bitcoin Security Forum Gmail Dump data breach: 4.8M accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/btsec-data-breach","vendor":"Bitcoin Security Forum Gmail Dump"},{"auto":true,"category":"breach","closedAt":"2014-08-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:POKEMONCREED"],"json":"https://helix.ml/threat-watch/i/pokemoncreed-data-breach.json","latestUpdate":{"date":"2014-08-10","title":"Have I Been Pwned loaded 116K breached Pokémon Creed accounts"},"patchStatus":"no-fix-needed","product":"pokemoncreed.net","severity":"high","severityNote":"116K accounts · passwords exposed","slug":"pokemoncreed-data-breach","stacks":[],"startedAt":"2014-08-10","status":"closed","summary":"In August 2014, the Pokémon RPG website Pokémon Creed was hacked after a dispute with rival site, Pokémon Dusk. In a post on Facebook, \"Cruz Dusk\" announced the hack then pasted the dumped MySQL database on pkmndusk.in. The breached data included over 116k usernames, email addresses and plain text passwords. Exposed data: email addresses, genders, ip addresses, passwords, usernames, website activity. The breach dates from Aug 8, 2014; Have I Been Pwned loaded it on Aug 10, 2014.","tags":["data-breach","hibp","email-addresses","genders","ip-addresses","passwords","usernames","website-activity"],"title":"Pokémon Creed data breach: 116K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/pokemoncreed-data-breach","vendor":"Pokémon Creed"},{"auto":true,"category":"breach","closedAt":"2014-08-05","cveIds":[],"exploited":"unknown","identifiers":["HIBP:INSANELYI"],"json":"https://helix.ml/threat-watch/i/insanelyi-data-breach.json","latestUpdate":{"date":"2014-07-22","title":"Have I Been Pwned loaded 104K breached Insanelyi accounts"},"patchStatus":"no-fix-needed","product":"insanelyi.com","severity":"high","severityNote":"104K accounts · passwords exposed","slug":"insanelyi-data-breach","stacks":[],"startedAt":"2014-07-22","status":"closed","summary":"In July 2014, the iOS forum Insanelyi was hacked by an attacker known as Kim Jong-Cracks. A popular source of information for users of jailbroken iOS devices running Cydia, the Insanelyi breach disclosed over 104k users' emails addresses, user names and weakly hashed passwords (salted MD5). Exposed data: email addresses, passwords, usernames, website activity. The breach dates from Jul 22, 2014; Have I Been Pwned loaded it on Jul 22, 2014.","tags":["data-breach","hibp","email-addresses","passwords","usernames","website-activity"],"title":"Insanelyi data breach: 104K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/insanelyi-data-breach","vendor":"Insanelyi"},{"auto":true,"category":"breach","closedAt":"2014-07-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ASTROPID"],"json":"https://helix.ml/threat-watch/i/astropid-data-breach.json","latestUpdate":{"date":"2014-07-06","title":"Have I Been Pwned loaded 5788 breached Astropid accounts"},"patchStatus":"no-fix-needed","product":"astropid.com","severity":"high","severityNote":"5788 accounts · passwords exposed","slug":"astropid-data-breach","stacks":[],"startedAt":"2014-07-06","status":"closed","summary":"In December 2013, the vBulletin forum for the social engineering site known as \"AstroPID\" was breached and leaked publicly. The site provided tips on fraudulently obtaining goods and services, often by providing a legitimate \"PID\" or Product Information Description. The breach resulted in nearly 6k user accounts and over 220k private messages between forum members being exposed. Exposed data: email addresses, instant messenger identities, ip addresses, names, passwords, private messages, usernames, website activity. The breach dates from Dec 19, 2013; Have I Been Pwned loaded it on Jul 6, 2014.","tags":["data-breach","hibp","email-addresses","instant-messenger-identities","ip-addresses","names","passwords","private-messages","usernames","website-activity"],"title":"Astropid data breach: 5788 accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/astropid-data-breach","vendor":"Astropid"},{"auto":true,"category":"breach","closedAt":"2014-07-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VERIFIED"],"json":"https://helix.ml/threat-watch/i/verified-data-breach.json","latestUpdate":{"date":"2014-07-06","title":"Have I Been Pwned loaded 16K breached Verified accounts"},"patchStatus":"no-fix-needed","product":"verified.cm","severity":"high","severityNote":"16K accounts · passwords exposed","slug":"verified-data-breach","stacks":[],"startedAt":"2014-07-06","status":"closed","summary":"In January 2014, one of the largest communities of Eastern Europe cybercriminals known as \"Verified\" was hacked. The breach exposed nearly 17k users of the vBulletin forum including their personal messages and other potentially personally identifiable information. Exposed data: email addresses, historical passwords, ip addresses, passwords, private messages, usernames, website activity. The breach dates from Jan 10, 2014; Have I Been Pwned loaded it on Jul 6, 2014.","tags":["data-breach","hibp","email-addresses","historical-passwords","ip-addresses","passwords","private-messages","usernames","website-activity"],"title":"Verified data breach: 16K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/verified-data-breach","vendor":"Verified"},{"auto":true,"category":"breach","closedAt":"2014-07-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:LOUNGEBOARD"],"json":"https://helix.ml/threat-watch/i/loungeboard-data-breach.json","latestUpdate":{"date":"2014-07-06","title":"Have I Been Pwned loaded 45K breached Lounge Board accounts"},"patchStatus":"no-fix-needed","product":"loungeboard.net","severity":"high","severityNote":"45K accounts · passwords exposed","slug":"loungeboard-data-breach","stacks":[],"startedAt":"2014-07-06","status":"closed","summary":"At some point in 2013, 45k accounts were breached from the Lounge Board \"General Discussion Forum\" and then dumped publicly. Lounge Board was a MyBB forum launched in 2012 and discontinued in mid 2013 (the last activity in the logs was from August 2013). Exposed data: email addresses, ip addresses, names, passwords, private messages, usernames, website activity. The breach dates from Aug 1, 2013; Have I Been Pwned loaded it on Jul 6, 2014.","tags":["data-breach","hibp","email-addresses","ip-addresses","names","passwords","private-messages","usernames","website-activity"],"title":"Lounge Board data breach: 45K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/loungeboard-data-breach","vendor":"Lounge Board"},{"auto":true,"category":"breach","closedAt":"2014-06-24","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MANGATRADERS"],"json":"https://helix.ml/threat-watch/i/mangatraders-data-breach.json","latestUpdate":{"date":"2014-06-10","title":"Have I Been Pwned loaded 855K breached Manga Traders accounts"},"patchStatus":"no-fix-needed","product":"mangatraders.com","severity":"high","severityNote":"855K accounts · passwords exposed","slug":"mangatraders-data-breach","stacks":[],"startedAt":"2014-06-10","status":"closed","summary":"In June 2014, the Manga trading website Mangatraders.com had the usernames and passwords of over 900k users leaked on the internet (approximately 855k of the emails were unique). The passwords were weakly hashed with a single iteration of MD5 leaving them vulnerable to being easily cracked. Exposed data: email addresses, passwords. The breach dates from Jun 9, 2014; Have I Been Pwned loaded it on Jun 10, 2014.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Manga Traders data breach: 855K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/mangatraders-data-breach","vendor":"Manga Traders"},{"auto":true,"category":"breach","closedAt":"2014-06-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:CANNABISFORUM"],"json":"https://helix.ml/threat-watch/i/cannabisforum-data-breach.json","latestUpdate":{"date":"2014-06-01","title":"Have I Been Pwned loaded 227K breached Cannabis.com accounts"},"patchStatus":"no-fix-needed","product":"cannabis.com","severity":"high","severityNote":"227K accounts · passwords exposed","slug":"cannabisforum-data-breach","stacks":[],"startedAt":"2014-06-01","status":"closed","summary":"In February 2014, the vBulletin forum for the Marijuana site cannabis.com was breached and leaked publicly. Whilst there has been no public attribution of the breach, the leaked data included over 227k accounts and nearly 10k private messages between users of the forum. Exposed data: dates of birth, email addresses, geographic locations, historical passwords, instant messenger identities, ip addresses, passwords, private messages, usernames, website activity. The breach dates from Feb 5, 2014; Have I Been Pwned loaded it on Jun 1, 2014.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","historical-passwords","instant-messenger-identities","ip-addresses","passwords","private-messages","usernames","website-activity"],"title":"Cannabis.com data breach: 227K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/cannabisforum-data-breach","vendor":"Cannabis.com"},{"auto":true,"category":"breach","closedAt":"2014-06-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WIN7VISTA"],"json":"https://helix.ml/threat-watch/i/win7vista-data-breach.json","latestUpdate":{"date":"2014-06-01","title":"Have I Been Pwned loaded 202K breached Win7Vista Forum accounts"},"patchStatus":"no-fix-needed","product":"win7vista.com","severity":"high","severityNote":"202K accounts · passwords exposed","slug":"win7vista-data-breach","stacks":[],"startedAt":"2014-06-01","status":"closed","summary":"In September 2013, the Win7Vista Windows forum (since renamed to the \"Beyond Windows 9\" forum) was hacked and later had its internal database dumped. The dump included over 200k members’ personal information and other internal data extracted from the forum. Exposed data: email addresses, instant messenger identities, ip addresses, names, passwords, private messages, usernames, website activity. The breach dates from Sep 3, 2013; Have I Been Pwned loaded it on Jun 1, 2014.","tags":["data-breach","hibp","email-addresses","instant-messenger-identities","ip-addresses","names","passwords","private-messages","usernames","website-activity"],"title":"Win7Vista Forum data breach: 202K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/win7vista-data-breach","vendor":"Win7Vista Forum"},{"auto":true,"category":"breach","closedAt":"2014-05-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HACKFORUMS"],"json":"https://helix.ml/threat-watch/i/hackforums-data-breach.json","latestUpdate":{"date":"2014-05-11","title":"Have I Been Pwned loaded 191K breached hackforums.net accounts"},"patchStatus":"no-fix-needed","product":"hackforums.net","severity":"high","severityNote":"191K accounts · passwords exposed","slug":"hackforums-data-breach","stacks":[],"startedAt":"2014-05-11","status":"closed","summary":"In June 2011, the hacktivist group known as \"LulzSec\" leaked one final large data breach they titled \"50 days of lulz\". The compromised data came from sources such as AT\u0026T, Battlefield Heroes and the hackforums.net website. The leaked Hack Forums data included credentials and personal information of nearly 200,000 registered forum users. Exposed data: dates of birth, email addresses, instant messenger identities, ip addresses, passwords, social connections, spoken languages, time zones, user website urls, usernames, website activity. The breach dates from Jun 25, 2011; Have I Been Pwned loaded it on May 11, 2014.","tags":["data-breach","hibp","dates-of-birth","email-addresses","instant-messenger-identities","ip-addresses","passwords","social-connections","spoken-languages","time-zones","user-website-urls","usernames","website-activity"],"title":"hackforums.net data breach: 191K accounts exposed","updatedAt":"2026-10-25T08:35:01Z","url":"https://helix.ml/threat-watch/i/hackforums-data-breach","vendor":"hackforums.net"},{"auto":true,"category":"breach","closedAt":"2014-05-25","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BUSINESSACUMEN"],"json":"https://helix.ml/threat-watch/i/businessacumen-data-breach.json","latestUpdate":{"date":"2014-05-11","title":"Have I Been Pwned loaded 26K breached Business Acumen Magazine accounts"},"patchStatus":"no-fix-needed","product":"businessacumen.biz","severity":"high","severityNote":"26K accounts · passwords exposed","slug":"businessacumen-data-breach","stacks":[],"startedAt":"2014-05-11","status":"closed","summary":"In April 2014, the Australian \"Business Acumen Magazine\" website was hacked by an attacker known as 1337MiR. The breach resulted in over 26,000 accounts being exposed including usernames, email addresses and password stored with a weak cryptographic hashing algorithm (MD5 with no salt). Exposed data: email addresses, names, passwords, usernames, website activity. The breach dates from Apr 25, 2014; Have I Been Pwned loaded it on May 11, 2014.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames","website-activity"],"title":"Business Acumen Magazine data breach: 26K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/businessacumen-data-breach","vendor":"Business Acumen Magazine"},{"auto":true,"category":"breach","closedAt":"2014-05-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FRIDAE"],"json":"https://helix.ml/threat-watch/i/fridae-data-breach.json","latestUpdate":{"date":"2014-05-06","title":"Have I Been Pwned loaded 35K breached Fridae accounts"},"patchStatus":"no-fix-needed","product":"fridae.asia","severity":"high","severityNote":"35K accounts · passwords exposed","slug":"fridae-data-breach","stacks":[],"startedAt":"2014-05-06","status":"closed","summary":"In May 2014, over 25,000 user accounts were breached from the Asian lesbian, gay, bisexual and transgender website known as \"Fridae\". The attack which was announced on Twitter appears to have been orchestrated by Deletesec who claim that \"Digital weapons shall annihilate all secrecy within governments and corporations\". The exposed data included password stored in plain text. Exposed data: email addresses, passwords, usernames, website activity. The breach dates from May 2, 2014; Have I Been Pwned loaded it on May 6, 2014.","tags":["data-breach","hibp","email-addresses","passwords","usernames","website-activity"],"title":"Fridae data breach: 35K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/fridae-data-breach","vendor":"Fridae"},{"auto":true,"category":"breach","closedAt":"2014-04-22","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BIGMONEYJOBS"],"json":"https://helix.ml/threat-watch/i/bigmoneyjobs-data-breach.json","latestUpdate":{"date":"2014-04-08","title":"Have I Been Pwned loaded 36K breached BigMoneyJobs accounts"},"patchStatus":"no-fix-needed","product":"bigmoneyjobs.com","severity":"high","severityNote":"36K accounts · passwords exposed","slug":"bigmoneyjobs-data-breach","stacks":[],"startedAt":"2014-04-08","status":"closed","summary":"In April 2014, the job site bigmoneyjobs.com was hacked by an attacker known as \"ProbablyOnion\". The attack resulted in the exposure of over 36,000 user accounts including email addresses, usernames and passwords which were stored in plain text. The attack was allegedly mounted by exploiting a SQL injection vulnerability. Exposed data: career levels, education levels, email addresses, names, passwords, phone numbers, physical addresses, salutations, user website urls, website activity. The breach dates from Apr 3, 2014; Have I Been Pwned loaded it on Apr 8, 2014.","tags":["data-breach","hibp","career-levels","education-levels","email-addresses","names","passwords","phone-numbers","physical-addresses","salutations","user-website-urls","website-activity"],"title":"BigMoneyJobs data breach: 36K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/bigmoneyjobs-data-breach","vendor":"BigMoneyJobs"},{"auto":true,"category":"breach","closedAt":"2014-04-13","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BOXEE"],"json":"https://helix.ml/threat-watch/i/boxee-data-breach.json","latestUpdate":{"date":"2014-03-30","title":"Have I Been Pwned loaded 158K breached Boxee accounts"},"patchStatus":"no-fix-needed","product":"forums.boxee.com","severity":"high","severityNote":"158K accounts · passwords exposed","slug":"boxee-data-breach","stacks":[],"startedAt":"2014-03-30","status":"closed","summary":"In March 2014, the home theatre PC software maker Boxee had their forums compromised in an attack. The attackers obtained the entire vBulletin MySQL database and promptly posted it for download on the Boxee forum itself. The data included 160k users, password histories, private messages and a variety of other data exposed across nearly 200 publicly exposed tables. Exposed data: dates of birth, email addresses, geographic locations, historical passwords, instant messenger identities, ip addresses, passwords, private messages, user website urls, usernames. The breach dates from Mar 29, 2014; Have I Been Pwned loaded it on Mar 30, 2014.","tags":["data-breach","hibp","dates-of-birth","email-addresses","geographic-locations","historical-passwords","instant-messenger-identities","ip-addresses","passwords","private-messages","user-website-urls","usernames"],"title":"Boxee data breach: 158K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/boxee-data-breach","vendor":"Boxee"},{"auto":true,"category":"breach","closedAt":"2014-04-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:HEMMELIG"],"json":"https://helix.ml/threat-watch/i/hemmelig-data-breach.json","latestUpdate":{"date":"2014-03-25","title":"Have I Been Pwned loaded 28K breached hemmelig.com accounts"},"patchStatus":"no-fix-needed","product":"hemmelig.com","severity":"high","severityNote":"28K accounts · passwords exposed","slug":"hemmelig-data-breach","stacks":[],"startedAt":"2014-03-25","status":"closed","summary":"In December 2011, Norway's largest online sex shop hemmelig.com was hacked by a collective calling themselves \"Team Appunity\". The attack exposed over 28,000 usernames and email addresses along with nicknames, gender, year of birth and unsalted MD5 password hashes. Exposed data: email addresses, genders, nicknames, partial dates of birth, passwords, usernames. The breach dates from Dec 21, 2011; Have I Been Pwned loaded it on Mar 25, 2014.","tags":["data-breach","hibp","email-addresses","genders","nicknames","partial-dates-of-birth","passwords","usernames"],"title":"hemmelig.com data breach: 28K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/hemmelig-data-breach","vendor":"hemmelig.com"},{"auto":true,"category":"breach","closedAt":"2014-03-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:MUSLIMDIRECTORY"],"json":"https://helix.ml/threat-watch/i/muslimdirectory-data-breach.json","latestUpdate":{"date":"2014-02-23","title":"Have I Been Pwned loaded 37K breached Muslim Directory accounts"},"patchStatus":"no-fix-needed","product":"muslimdirectory.co.uk","severity":"high","severityNote":"37K accounts · passwords exposed","slug":"muslimdirectory-data-breach","stacks":[],"startedAt":"2014-02-23","status":"closed","summary":"In February 2014, the UK guide to services and business known as the Muslim Directory was attacked by the hacker known as @th3inf1d3l. The data was consequently dumped publicly and included the web accounts of tens of thousands of users which contained data including their names, home address, age group, email, website activity and password in plain text. Exposed data: age groups, email addresses, employers, names, passwords, phone numbers, physical addresses, website activity. The breach dates from Feb 17, 2014; Have I Been Pwned loaded it on Feb 23, 2014.","tags":["data-breach","hibp","age-groups","email-addresses","employers","names","passwords","phone-numbers","physical-addresses","website-activity"],"title":"Muslim Directory data breach: 37K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/muslimdirectory-data-breach","vendor":"Muslim Directory"},{"auto":true,"category":"breach","closedAt":"2014-03-09","cveIds":[],"exploited":"unknown","identifiers":["HIBP:IGF"],"json":"https://helix.ml/threat-watch/i/igf-data-breach.json","latestUpdate":{"date":"2014-02-23","title":"Have I Been Pwned loaded 3200 breached UN Internet Governance Forum accounts"},"patchStatus":"no-fix-needed","product":"intgovforum.org","severity":"high","severityNote":"3200 accounts · passwords exposed","slug":"igf-data-breach","stacks":[],"startedAt":"2014-02-23","status":"closed","summary":"In February 2014, the Internet Governance Forum (formed by the United Nations for policy dialogue on issues of internet governance) was attacked by hacker collective known as Deletesec. Although tasked with \"ensuring the security and stability of the Internet\", the IGF’s website was still breached and resulted in the leak of 3,200 email addresses, names, usernames and cryptographically stored passwords. Exposed data: email addresses, names, passwords, usernames. The breach dates from Feb 20, 2014; Have I Been Pwned loaded it on Feb 23, 2014.","tags":["data-breach","hibp","email-addresses","names","passwords","usernames"],"title":"UN Internet Governance Forum data breach: 3200 accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/igf-data-breach","vendor":"UN Internet Governance Forum"},{"auto":true,"category":"breach","closedAt":"2014-03-08","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SPIROL"],"json":"https://helix.ml/threat-watch/i/spirol-data-breach.json","latestUpdate":{"date":"2014-02-22","title":"Have I Been Pwned loaded 55K breached Spirol accounts"},"patchStatus":"no-fix-needed","product":"spirol.com","severity":"medium","severityNote":"55K accounts","slug":"spirol-data-breach","stacks":[],"startedAt":"2014-02-22","status":"closed","summary":"In February 2014, Connecticut based Spirol Fastening Solutions suffered a data breach that exposed over 70,000 customer records. The attack was allegedly mounted by exploiting a SQL injection vulnerability which yielded data from Spirol’s CRM system ranging from customers’ names, companies, contact information and over 55,000 unique email addresses. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses. The breach dates from Feb 22, 2014; Have I Been Pwned loaded it on Feb 22, 2014.","tags":["data-breach","hibp","email-addresses","employers","job-titles","names","phone-numbers","physical-addresses"],"title":"Spirol data breach: 55K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/spirol-data-breach","vendor":"Spirol"},{"auto":true,"category":"breach","closedAt":"2014-03-01","cveIds":[],"exploited":"unknown","identifiers":["HIBP:FORBES"],"json":"https://helix.ml/threat-watch/i/forbes-data-breach.json","latestUpdate":{"date":"2014-02-15","title":"Have I Been Pwned loaded 1.1M breached Forbes accounts"},"patchStatus":"no-fix-needed","product":"forbes.com","severity":"high","severityNote":"1.1M accounts · passwords exposed","slug":"forbes-data-breach","stacks":[],"startedAt":"2014-02-15","status":"closed","summary":"In February 2014, the Forbes website succumbed to an attack that leaked over 1 million user accounts. The attack was attributed to the Syrian Electronic Army, allegedly as retribution for a perceived \"Hate of Syria\". The attack not only leaked user credentials, but also resulted in the posting of fake news stories to forbes.com. Exposed data: email addresses, passwords, user website urls, usernames. The breach dates from Feb 15, 2014; Have I Been Pwned loaded it on Feb 15, 2014.","tags":["data-breach","hibp","email-addresses","passwords","user-website-urls","usernames"],"title":"Forbes data breach: 1.1M accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/forbes-data-breach","vendor":"Forbes"},{"auto":true,"category":"breach","closedAt":"2014-02-27","cveIds":[],"exploited":"unknown","identifiers":["HIBP:TESCO"],"json":"https://helix.ml/threat-watch/i/tesco-data-breach.json","latestUpdate":{"date":"2014-02-13","title":"Have I Been Pwned loaded 2239 breached Tesco accounts"},"patchStatus":"no-fix-needed","product":"tesco.com","severity":"high","severityNote":"2239 accounts · passwords exposed","slug":"tesco-data-breach","stacks":[],"startedAt":"2014-02-13","status":"closed","summary":"In February 2014, over 2,000 Tesco accounts with usernames, passwords and loyalty card balances appeared on Pastebin. Whilst the source of the breach is not clear, many confirmed the credentials were valid for Tesco and indeed they have a history of poor online security. Exposed data: email addresses, passwords, reward program balances. The breach dates from Feb 12, 2014; Have I Been Pwned loaded it on Feb 13, 2014.","tags":["data-breach","hibp","email-addresses","passwords","reward-program-balances"],"title":"Tesco data breach: 2239 accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/tesco-data-breach","vendor":"Tesco"},{"auto":true,"category":"breach","closedAt":"2014-02-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:WPT"],"json":"https://helix.ml/threat-watch/i/wpt-data-breach.json","latestUpdate":{"date":"2014-02-01","title":"Have I Been Pwned loaded 148K breached WPT Amateur Poker League accounts"},"patchStatus":"no-fix-needed","product":"wptapl.com","severity":"high","severityNote":"148K accounts · passwords exposed","slug":"wpt-data-breach","stacks":[],"startedAt":"2014-02-01","status":"closed","summary":"In January 2014, the World Poker Tour (WPT) Amateur Poker League website was hacked by the Twitter user @smitt3nz. The attack resulted in the public disclosure of 175,000 accounts including 148,000 email addresses. The plain text password for each account was also included in the breach. Exposed data: email addresses, passwords. The breach dates from Jan 4, 2014; Have I Been Pwned loaded it on Feb 1, 2014.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"WPT Amateur Poker League data breach: 148K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/wpt-data-breach","vendor":"WPT Amateur Poker League"},{"auto":true,"category":"breach","closedAt":"2014-02-15","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BELL"],"json":"https://helix.ml/threat-watch/i/bell-data-breach.json","latestUpdate":{"date":"2014-02-01","title":"Have I Been Pwned loaded 20K breached Bell (2014 breach) accounts"},"patchStatus":"no-fix-needed","product":"bell.ca","severity":"high","severityNote":"20K accounts · passwords exposed · financial data exposed","slug":"bell-data-breach","stacks":[],"startedAt":"2014-02-01","status":"closed","summary":"In February 2014, Bell Canada suffered a data breach via the hacker collective known as NullCrew. The breach included data from multiple locations within Bell and exposed email addresses, usernames, user preferences and a number of unencrypted passwords and credit card data from 40,000 records containing just over 20,000 unique email addresses and usernames. Exposed data: credit cards, genders, passwords, usernames. The breach dates from Feb 1, 2014; Have I Been Pwned loaded it on Feb 1, 2014.","tags":["data-breach","hibp","credit-cards","genders","passwords","usernames"],"title":"Bell (2014 breach) data breach: 20K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/bell-data-breach","vendor":"Bell (2014 breach)"},{"auto":true,"category":"breach","closedAt":"2014-02-06","cveIds":[],"exploited":"unknown","identifiers":["HIBP:BATTLEFIELDHEROES"],"json":"https://helix.ml/threat-watch/i/battlefieldheroes-data-breach.json","latestUpdate":{"date":"2014-01-23","title":"Have I Been Pwned loaded 530K breached Battlefield Heroes accounts"},"patchStatus":"no-fix-needed","product":"battlefieldheroes.com","severity":"high","severityNote":"530K accounts · passwords exposed","slug":"battlefieldheroes-data-breach","stacks":[],"startedAt":"2014-01-23","status":"closed","summary":"In June 2011 as part of a final breached data dump, the hacker collective \"LulzSec\" obtained and released over half a million usernames and passwords from the game Battlefield Heroes. The passwords were stored as MD5 hashes with no salt and many were easily converted back to their plain text versions. Exposed data: passwords, usernames. The breach dates from Jun 26, 2011; Have I Been Pwned loaded it on Jan 23, 2014.","tags":["data-breach","hibp","passwords","usernames"],"title":"Battlefield Heroes data breach: 530K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/battlefieldheroes-data-breach","vendor":"Battlefield Heroes"},{"auto":true,"category":"breach","closedAt":"2014-01-16","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SNAPCHAT"],"json":"https://helix.ml/threat-watch/i/snapchat-data-breach.json","latestUpdate":{"date":"2014-01-02","title":"Have I Been Pwned loaded 4.6M breached Snapchat accounts"},"patchStatus":"no-fix-needed","product":"snapchat.com","severity":"medium","severityNote":"4.6M accounts","slug":"snapchat-data-breach","stacks":[],"startedAt":"2014-01-02","status":"closed","summary":"In January 2014 just one week after Gibson Security detailed vulnerabilities in the service, Snapchat had 4.6 million usernames and phone number exposed. The attack involved brute force enumeration of a large number of phone numbers against the Snapchat API in what appears to be a response to Snapchat's assertion that such an attack was \"theoretical\". Consequently, the breach enabled individual usernames (which are often used across other services) to be resolved to phone numbers which users usually wish to keep private. Exposed data: geographic locations, phone numbers, usernames. The breach dates from Jan 1, 2014; Have I Been Pwned loaded it on Jan 2, 2014.","tags":["data-breach","hibp","geographic-locations","phone-numbers","usernames"],"title":"Snapchat data breach: 4.6M accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/snapchat-data-breach","vendor":"Snapchat"},{"auto":true,"category":"breach","closedAt":"2013-12-20","cveIds":[],"exploited":"unknown","identifiers":["HIBP:PIXELFEDERATION"],"json":"https://helix.ml/threat-watch/i/pixelfederation-data-breach.json","latestUpdate":{"date":"2013-12-06","title":"Have I Been Pwned loaded 38K breached Pixel Federation accounts"},"patchStatus":"no-fix-needed","product":"pixelfederation.com","severity":"high","severityNote":"38K accounts · passwords exposed","slug":"pixelfederation-data-breach","stacks":[],"startedAt":"2013-12-06","status":"closed","summary":"In December 2013, a breach of the web-based game community based in Slovakia exposed over 38,000 accounts which were promptly posted online. The breach included email addresses and unsalted MD5 hashed passwords, many of which were easily converted back to plain text. Exposed data: email addresses, passwords. The breach dates from Dec 4, 2013; Have I Been Pwned loaded it on Dec 6, 2013.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Pixel Federation data breach: 38K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/pixelfederation-data-breach","vendor":"Pixel Federation"},{"auto":true,"category":"breach","closedAt":"2013-12-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:ADOBE"],"json":"https://helix.ml/threat-watch/i/adobe-data-breach.json","latestUpdate":{"date":"2013-12-04","title":"Have I Been Pwned loaded 152.4M breached Adobe accounts"},"patchStatus":"no-fix-needed","product":"adobe.com","severity":"critical","severityNote":"152.4M accounts · passwords exposed","slug":"adobe-data-breach","stacks":[],"startedAt":"2013-12-04","status":"closed","summary":"In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much about the passwords adding further to the risk that hundreds of millions of Adobe customers already faced. Exposed data: email addresses, password hints, passwords, usernames. The breach dates from Oct 4, 2013; Have I Been Pwned loaded it on Dec 4, 2013.","tags":["data-breach","hibp","email-addresses","password-hints","passwords","usernames"],"title":"Adobe data breach: 152.4M accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/adobe-data-breach","vendor":"Adobe"},{"auto":true,"category":"breach","closedAt":"2013-12-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:GAWKER"],"json":"https://helix.ml/threat-watch/i/gawker-data-breach.json","latestUpdate":{"date":"2013-12-04","title":"Have I Been Pwned loaded 1.2M breached Gawker accounts"},"patchStatus":"no-fix-needed","product":"gawker.com","severity":"high","severityNote":"1.2M accounts · passwords exposed","slug":"gawker-data-breach","stacks":[],"startedAt":"2013-12-04","status":"closed","summary":"In December 2010, Gawker was attacked by the hacker collective \"Gnosis\" in retaliation for what was reported to be a feud between Gawker and 4Chan. Information about Gawkers 1.3M users was published along with the data from Gawker's other web presences including Gizmodo and Lifehacker. Due to the prevalence of password reuse, many victims of the breach then had their Twitter accounts compromised to send Acai berry spam. Exposed data: email addresses, passwords, usernames. The breach dates from Dec 11, 2010; Have I Been Pwned loaded it on Dec 4, 2013.","tags":["data-breach","hibp","email-addresses","passwords","usernames"],"title":"Gawker data breach: 1.2M accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/gawker-data-breach","vendor":"Gawker"},{"auto":true,"category":"breach","closedAt":"2013-12-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:SONY"],"json":"https://helix.ml/threat-watch/i/sony-data-breach.json","latestUpdate":{"date":"2013-12-04","title":"Have I Been Pwned loaded 37K breached Sony accounts"},"patchStatus":"no-fix-needed","product":"sony.com","severity":"high","severityNote":"37K accounts · passwords exposed","slug":"sony-data-breach","stacks":[],"startedAt":"2013-12-04","status":"closed","summary":"In 2011, Sony suffered breach after breach after breach — it was a very bad year for them. The breaches spanned various areas of the business ranging from the PlayStation network all the way through to the motion picture arm, Sony Pictures. A SQL Injection vulnerability in sonypictures.com lead to tens of thousands of accounts across multiple systems being exposed complete with plain text passwords. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Jun 2, 2011; Have I Been Pwned loaded it on Dec 4, 2013.","tags":["data-breach","hibp","dates-of-birth","email-addresses","genders","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Sony data breach: 37K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/sony-data-breach","vendor":"Sony"},{"auto":true,"category":"breach","closedAt":"2013-12-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:STRATFOR"],"json":"https://helix.ml/threat-watch/i/stratfor-data-breach.json","latestUpdate":{"date":"2013-12-04","title":"Have I Been Pwned loaded 859K breached Stratfor accounts"},"patchStatus":"no-fix-needed","product":"stratfor.com","severity":"high","severityNote":"859K accounts · passwords exposed · financial data exposed","slug":"stratfor-data-breach","stacks":[],"startedAt":"2013-12-04","status":"closed","summary":"In December 2011, \"Anonymous\" attacked the global intelligence company known as \"Stratfor\" and consequently disclosed a veritable treasure trove of data including hundreds of gigabytes of email and tens of thousands of credit card details which were promptly used by the attackers to make charitable donations (among other uses). The breach also included 860,000 user accounts complete with email address, time zone, some internal system data and MD5 hashed passwords with no salt. Exposed data: credit cards, email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Dec 24, 2011; Have I Been Pwned loaded it on Dec 4, 2013.","tags":["data-breach","hibp","credit-cards","email-addresses","names","passwords","phone-numbers","physical-addresses","usernames"],"title":"Stratfor data breach: 859K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/stratfor-data-breach","vendor":"Stratfor"},{"auto":true,"category":"breach","closedAt":"2013-12-18","cveIds":[],"exploited":"unknown","identifiers":["HIBP:YAHOO"],"json":"https://helix.ml/threat-watch/i/yahoo-data-breach.json","latestUpdate":{"date":"2013-12-04","title":"Have I Been Pwned loaded 453K breached Yahoo accounts"},"patchStatus":"no-fix-needed","product":"yahoo.com","severity":"high","severityNote":"453K accounts · passwords exposed","slug":"yahoo-data-breach","stacks":[],"startedAt":"2013-12-04","status":"closed","summary":"In July 2012, Yahoo! had their online publishing service \"Voices\" compromised via a SQL injection attack. The breach resulted in the disclosure of nearly half a million usernames and passwords stored in plain text. The breach showed that of the compromised accounts, a staggering 59% of people who also had accounts in the Sony breach reused their passwords across both services. Exposed data: email addresses, passwords. The breach dates from Jul 11, 2012; Have I Been Pwned loaded it on Dec 4, 2013.","tags":["data-breach","hibp","email-addresses","passwords"],"title":"Yahoo data breach: 453K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/yahoo-data-breach","vendor":"Yahoo"},{"auto":true,"category":"breach","closedAt":"2013-12-14","cveIds":[],"exploited":"unknown","identifiers":["HIBP:VODAFONE"],"json":"https://helix.ml/threat-watch/i/vodafone-data-breach.json","latestUpdate":{"date":"2013-11-30","title":"Have I Been Pwned loaded 56K breached Vodafone accounts"},"patchStatus":"no-fix-needed","product":"vodafone.is","severity":"high","severityNote":"56K accounts · passwords exposed · financial data exposed","slug":"vodafone-data-breach","stacks":[],"startedAt":"2013-11-30","status":"closed","summary":"In November 2013, Vodafone in Iceland suffered an attack attributed to the Turkish hacker collective \"Maxn3y\". The data was consequently publicly exposed and included user names, email addresses, social security numbers, SMS message, server logs and passwords from a variety of different internal sources. Exposed data: credit cards, email addresses, government issued ids, ip addresses, names, passwords, phone numbers, physical addresses, purchases, sms messages, usernames. The breach dates from Nov 30, 2013; Have I Been Pwned loaded it on Nov 30, 2013.","tags":["data-breach","hibp","credit-cards","email-addresses","government-issued-ids","ip-addresses","names","passwords","phone-numbers","physical-addresses","purchases","sms-messages","usernames"],"title":"Vodafone data breach: 56K accounts exposed","updatedAt":"2026-10-25T08:35:00Z","url":"https://helix.ml/threat-watch/i/vodafone-data-breach","vendor":"Vodafone"}],"live":["php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466","npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware","cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo","cisco-secure-email-gateway-cve-2026-76519","gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","beyondtrust-remote-support-cve-2026-102764","ivanti-connect-secure-cve-2026-104935","pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20","palo-alto-networks-pan-os-cve-2026-0322","collabora-collabora-online-built-in-code-server-cve-2026-110447","brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","arista-velocloud-orchestrator-cve-2026-114625","dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg","plex-media-server-cve-2026-96652","io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe","x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat","mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324","pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026","apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling","fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv","chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1","eg-secure-solutions-siteguard-server-edition-cve-2026-106931","plex-media-server-cve-2026-96656","plex-media-server-cve-2026-96655","plex-media-server-cve-2026-96654","siemens-software-center-cve-2026-110936","assuranceretraite-data-breach","wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889","pingcap-tidb-cloud-extortion-group-fulcrumsec-used-stolen-service-account-credentials-to-access-internal-systems-copying","linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999","laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509","gitesdefrance-data-breach","pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8","fortinet-multiple-products-cve-2025-61624","google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922","atlassian-multiple-products-cve-2026-21589","next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr","next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96","ahsay-ahsaycbs-cve-2026-105134","ahsay-ahsaycbs-cve-2026-105133","crunchbase-data-breach","fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th","microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","microsoft-windows-cve-2026-96951","sharecare-data-breach"],"site":"https://helix.ml/threat-watch","updatedAt":"2026-10-25T11:10:00Z"}