{"title":"Critical advisories","description":"Our advisories rated critical.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/","title":"Supermarket fridges hijacked across Europe: internet-exposed Danfoss, Copeland and Dixell controllers forced into defrost","url":"https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/","date":"2026-11-12","summary":"On 11 Oct and 2 Nov 2026, attackers forced European supermarket fridges, and France's blood service, into defrost via exposed refrigeration controllers.","tags":["breach","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/","title":"Check Point Remote Access VPN CVE-2026-50751: IKEv1 authentication bypass exploited since May 2026","url":"https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/","date":"2026-11-12","summary":"An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/cursor-2026-cves/","title":"Cursor 2026 CVEs: DuneSlide sandbox escapes, Git hook and Claude hook RCE, and an unpatched Windows git.exe plant","url":"https://vulnpocalypse.dev/advisories/cursor-2026-cves/","date":"2026-11-12","summary":"Seven 2026 Cursor CVEs let prompt injection or a cloned repo run code outside the sandbox. Update to 3.1.2 or later; the Windows git.exe bug has no stated fix.","tags":["ai-tools","ai-tools","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/","title":"BeyondTrust Remote Support and PRA CVE-2026-1731: pre-auth command injection exploited before disclosure and used by ransomware","url":"https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/","date":"2026-11-12","summary":"Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/synology-discloses-dsm-flaws-incl-critical-cve-2026-76954/","title":"Synology discloses DSM flaws incl. critical CVE-2026-76954","url":"https://vulnpocalypse.dev/advisories/synology-discloses-dsm-flaws-incl-critical-cve-2026-76954/","date":"2026-11-11","summary":"Synology says DSM updates fix multiple flaws, including a critical Auth API one; affected DSM owners should upgrade to the fixed builds.","tags":["exploited","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/","title":"SecurityWeek reports Zoom Workplace and Asus router patches","url":"https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/","date":"2026-11-11","summary":"SecurityWeek reports Zoom patched two Workplace for Windows flaws in 7.1.8 and later, and Asus issued a router advisory; update both.","tags":["exploited","endpoint","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/","title":"SAP ICM2SHELL and PROXYGATE: four CVSS 10.0 flaws patched","url":"https://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/","date":"2026-11-11","summary":"SAP patched four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws on Nov 10, 2026; apply the SAP Notes and check prxyinfo.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/","title":"N-able takes N-central offline after 33 alleged zero-days are published (Able2Shell)","url":"https://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/","date":"2026-11-11","summary":"A researcher published exploit code for 33 unpatched N-central flaws; N-able took hosted N-central offline and told on-prem users to shut down pending a fix","tags":["exploited","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/","title":"Zyxel GS1900 switch zero-day CVE-2026-107441 lets attackers run root commands before login, now patched","url":"https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/","date":"2026-11-11","summary":"Zyxel GS1900 switches have a pre-auth RCE flaw, CVE-2026-107441, exploited in the wild and missed by the June patch, fixed October 22.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/","title":"Critical Rails Active Storage flaw lets crafted ImageMagick uploads write server files","url":"https://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/","date":"2026-11-11","summary":"A critical Rails Active Storage flaw lets unauthenticated uploads write files through ImageMagick, fixed in activestorage 8.1.4.1 and 8.0.5.2.","tags":["exploited","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/","title":"Chrome 157 fixes 213 security bugs, 7 rated critical, in desktop and Android builds","url":"https://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/","date":"2026-11-11","summary":"Google released Chrome 157 with 213 security fixes, seven rated critical, and has not said any of them are exploited in the wild.","tags":["exploited","web","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/","title":"Barracuda warns of critical flaws that chain to root access on Email Security Gateway and other appliances","url":"https://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/","date":"2026-11-11","summary":"Barracuda flaws CVE-2026-116606 and CVE-2026-111560 chain to root on the Email Security Gateway and five other products. Patch now.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/","title":"Android November 2026 update fixes critical zero-click RCE CVE-2026-58868 in Framework","url":"https://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/","date":"2026-11-11","summary":"Google's November 2026 Android bulletin fixes 216 flaws, including critical zero-click RCE CVE-2026-58868 on Android 14 through 17.","tags":["exploited","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","title":"Binance hack: $6.3B drained after attackers got its own systems to sign","url":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","date":"2026-11-11","summary":"On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.","tags":["breach","crypto","cloud","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","title":"Trojanized Claude Code extension on Cursor's marketplace planted an SSH backdoor (2.1.312, 2.1.313), plus","url":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","date":"2026-11-11","summary":"Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.","tags":["supply-chain","ai-tools","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/","title":"Palo Alto Networks PAN-OS: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploited through internet-exposed management interfaces","url":"https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/","date":"2026-11-11","summary":"PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train's hotfix and take management off the internet.","tags":["exploited","network-edge","php","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/","title":"Drupal Commerce Core CVE-2026-118539: highly critical access bypass exploited against online stores","url":"https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/","date":"2026-11-11","summary":"An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.","tags":["exploited","php","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/oracle-ebs-cve-2026-101767/","title":"Oracle E-Business Suite CVE-2026-101767: unauthenticated TCF SQL injection to code execution, probed a week after the patch","url":"https://vulnpocalypse.dev/advisories/oracle-ebs-cve-2026-101767/","date":"2026-11-11","summary":"An unauthenticated SQL injection in EBS 12.2.3 to 12.2.15 leads to OS command execution, and decoys saw exploit attempts. Apply the October 2026 CPU.","tags":["exploited","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/","title":"\"Node2Shell: an out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) reaches far beyond Node.js\"","url":"https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/","date":"2026-11-11","summary":"CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash or run code. Patch Node.js, Brotli, Bun and more.","tags":["exploited","nodejs","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/","title":"PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch the PHP engine, not just your app","url":"https://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/","date":"2026-11-11","summary":"Two PHP engine flaws allow unauthenticated code execution on WordPress, Drupal and Joomla. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.","tags":["exploited","php"]},{"id":"https://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/","title":"Node.js October 2026 security release: Brotli RCE now exploited, plus TLS hostname bypasses","url":"https://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/","date":"2026-11-11","summary":"Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA's exploited list and three TLS certificate checks.","tags":["exploited","nodejs"]},{"id":"https://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/","title":"LiteLLM 1.107.0: poisoned PyPI and Docker release built from a lookalike repository","url":"https://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/","date":"2026-11-11","summary":"Attackers with stolen gh CLI tokens shipped malware as LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR. Check before running Python, then rebuild and rotate.","tags":["supply-chain","pypi","ai-tools","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/","title":"LiteLLM 1.107.0 on PyPI and Docker was backdoored with a credential stealer and remote code loader","url":"https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/","date":"2026-11-11","summary":"LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.","tags":["supply-chain","pypi","ai-tools","open-source","ci-cd","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/plex2shell-plex-media-server/","title":"Plex2Shell: four chained Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) widely exploited for miners and proxies","url":"https://vulnpocalypse.dev/advisories/plex2shell-plex-media-server/","date":"2026-11-11","summary":"Four chained Plex Media Server bugs give unauthenticated code execution and are widely exploited. Update to 1.43.3.10861 or later and check the Codecs folder.","tags":["exploited","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/","title":"BeyondTrust Remote Support CVE-2026-102764 exploited by Armory Castle, patch now","url":"https://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/","date":"2026-11-11","summary":"Critical BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day by Armory Castle and is now in CISA KEV; patch and hunt.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/","title":"Next.js October 2026 security release: two critical RCEs, and check your sharp version","url":"https://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/","date":"2026-11-11","summary":"Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.","tags":["exploited","nextjs","npm"]},{"id":"https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/","title":"CRAFTY FALCON: CERT-In warns AI-driven attacks are draining Indian BFSI through their own payment APIs","url":"https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/","date":"2026-11-11","summary":"CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.","tags":["ai-tools","ai-tools","enterprise","cloud","web","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/atlassian-data-center-cve-2026-21589-file-read/","title":"Atlassian Data Center CVE-2026-21589: unauthenticated file read in Jira, Confluence, Bitbucket, Bamboo, Crowd, Fisheye and Crucible, exploited","url":"https://vulnpocalypse.dev/advisories/atlassian-data-center-cve-2026-21589-file-read/","date":"2026-11-11","summary":"A pre-auth file read hits every Atlassian Data Center product and can leak Crowd credentials; exploited. Patch, or apply Atlassian's block rule.","tags":["exploited","enterprise","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/","title":"Rejetto HFS CVE-2026-61500: an AI-found bug attacked the day after its write-up","url":"https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/","date":"2026-11-11","summary":"A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.","tags":["exploited","nodejs","npm","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/","title":"actions-cool/issues-helper and maintain-one-comment came back online still carrying Mini Shai-Hulud malware","url":"https://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/","date":"2026-11-11","summary":"Hijacked actions-cool/issues-helper and maintain-one-comment were re-enabled on 16 Sep 2026 with every tag still malicious. Remove them and rotate CI secrets.","tags":["supply-chain","github-actions","ci-cd","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/","title":"TanStack to Nx Console to GitHub: one poisoned npm install led to ~3,800 stolen internal repos (CVE-2026-45321, CVE-2026-48027)","url":"https://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/","date":"2026-11-11","summary":"Poisoned TanStack packages stole an Nx developer's GitHub token. A trojaned Nx Console release then hit GitHub and Grafana. Check installs, rotate tokens.","tags":["supply-chain","npm","github-actions","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/axios-npm-hijack/","title":"axios npm hijack: versions 1.14.1 and 0.30.4 installed a North Korean RAT via plain-crypto-js","url":"https://vulnpocalypse.dev/advisories/axios-npm-hijack/","date":"2026-11-11","summary":"A hijacked maintainer account published axios 1.14.1 and 0.30.4 with a dependency that installs a remote access trojan. Check lockfiles for plain-crypto-js.","tags":["supply-chain","npm","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/","title":"TeamPCP campaign (CVE-2026-33634): Trivy, KICS, LiteLLM and Telnyx turned into credential stealers","url":"https://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/","date":"2026-11-11","summary":"Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.","tags":["supply-chain","github-actions","pypi","ci-cd","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/","title":"React2Shell (CVE-2025-55182): the React Server Components RCE, and why the December patch is not enough now","url":"https://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/","date":"2026-11-11","summary":"An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.","tags":["exploited","npm","nextjs"]},{"id":"https://vulnpocalypse.dev/advisories/shai-hulud-npm-worm/","title":"Shai-Hulud npm worm: check installs, rotate tokens, kill rogue runners","url":"https://vulnpocalypse.dev/advisories/shai-hulud-npm-worm/","date":"2026-11-11","summary":"A self-replicating npm worm runs at install time, steals developer and CI secrets, and registers rogue GitHub runners. New waves hit from April to August 2026.","tags":["supply-chain","npm","github-actions"]},{"id":"https://vulnpocalypse.dev/advisories/xen-orchestra-auth-bypass-vsa-2026-062-exploited-update-now/","title":"Xen Orchestra auth bypass (VSA-2026-062) exploited, update now","url":"https://vulnpocalypse.dev/advisories/xen-orchestra-auth-bypass-vsa-2026-062-exploited-update-now/","date":"2026-11-10","summary":"Vates says a critical Xen Orchestra authentication bypass, VSA-2026-062, is exploited; update to the fixed release and restrict access.","tags":["exploited","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/","title":"React maintainers report critical RCE flaw in React Server Components","url":"https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/","date":"2026-11-09","summary":"React maintainers report a critical unauthenticated RCE flaw in three react-server-dom packages; upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.","tags":["exploited","npm","nodejs","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/","title":"Critical Node-RED flaw CVE-2026-58115 exploited in the wild to run code on exposed instances","url":"https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/","date":"2026-11-09","summary":"Attackers are exploiting a CVSS 10 missing-authentication flaw in Node-RED to create malicious flows and run code on instances left without adminAuth.","tags":["exploited","nodejs","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/","title":"StyleSmuggler attacks hit Magento and Adobe Commerce stores and drop the PSK Agent Go RAT","url":"https://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/","date":"2026-11-09","summary":"A coordinated campaign abused the Magento StyleSmuggler flaw (CVE-2026-75650) to run code on Adobe Commerce stores and install the PSK Agent Go RAT.","tags":["breach","web","enterprise","php"]},{"id":"https://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/","title":"Synology warns of active C3RB3R (Cerber) ransomware hitting NAS devices through a patched DSM flaw","url":"https://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/","date":"2026-11-09","summary":"Synology says attackers are exploiting a patched DSM vulnerability to deploy C3RB3R (Cerber) ransomware on internet-exposed NAS devices.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/","title":"Suspected Chinese actor chains PHP2Shell and Fragnesia to root 25 PAN-OS servers","url":"https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/","date":"2026-11-09","summary":"A suspected China-nexus actor chained PHP2Shell with the Fragnesia kernel flaw to root 25 Palo Alto PAN-OS servers, including three in a US","tags":["ai-tools","php","network-edge","enterprise","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","title":"Linux kernel CVE-2026-98432: IPv4 TCP handshake use-after-free, with an AI-built remote root exploit","url":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","date":"2026-11-09","summary":"A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.","tags":["exploited","open-source","cloud","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/","title":"PAN-OS GlobalProtect auth bypass (CVE-2026-0257) now used by Qilin and Inc ransomware, plus an exploited management RCE (CVE-2026-0322)","url":"https://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/","date":"2026-11-09","summary":"Ransomware crews use a GlobalProtect cookie bypass to get VPN access, and a new PAN-OS management RCE is exploited. Upgrade, and check Authentication Override.","tags":["exploited","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/","title":"Ivanti Connect Secure zero-day chain (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) gave root on fully patched VPNs","url":"https://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/","date":"2026-11-09","summary":"Three chained Ivanti Connect Secure flaws give unauthenticated root and evade the Integrity Checker. Upgrade to 25.1.3.1, 25.1.1.3 or 22.8R2.6.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/","title":"Citrix NetScaler CVE-2026-88779: exploited SAML memory overflow DoS, a week after the CVE-2026-88771 and -88772 RCE zero-days","url":"https://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/","date":"2026-11-09","summary":"An exploited memory overflow crashes NetScaler ADC and Gateway set up for SAML. Update to 14.1-73.41 or 13.1-64.28, which also fix September's exploited RCEs.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/cpguard-update-channel-hijacked-to-backdoor-linux-hosting-servers-and-steal-cred/","title":"cPGuard update channel hijacked to backdoor Linux hosting servers and steal credentials","url":"https://vulnpocalypse.dev/advisories/cpguard-update-channel-hijacked-to-backdoor-linux-hosting-servers-and-steal-cred/","date":"2026-11-08","summary":"Attackers pushed a malicious script through cPGuard versions 5.88.12 to 5.88.19, installing a root backdoor and stealing password hashes and keys.","tags":["supply-chain","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/","title":"Canonical LXD and MicroCloud CVE-2026-112816: unverified mTLS client chain lets anyone impersonate a trusted client","url":"https://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/","date":"2026-11-08","summary":"LXD and MicroCloud accepted a trusted public certificate anywhere in a client's chain, enabling impersonation. Refresh to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15.","tags":["exploited","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/gitlab-ci-regex-rce/","title":"GitLab regex RCE (CVE-2026-97229, CVE-2026-110264): the 12 October patch is not enough","url":"https://vulnpocalypse.dev/advisories/gitlab-ci-regex-rce/","date":"2026-11-08","summary":"Two CVSS 10 regex flaws give unauthenticated code execution on self-managed GitLab; one is exploited. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a 21 Oct backport.","tags":["exploited","ci-cd","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/storm-2603-sharepoint-toolshell-fileless/","title":"Storm-2603 chains SharePoint ToolShell flaws into a fileless, in-memory backdoor before attempting Warlock ransomware","url":"https://vulnpocalypse.dev/advisories/storm-2603-sharepoint-toolshell-fileless/","date":"2026-11-06","summary":"Kaspersky details a Storm-2603 intrusion using ToolShell (CVE-2025-53770/53771) to load an in-memory IIS webshell, escalate to SYSTEM and stage Warlock.","tags":["breach","enterprise","web","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","title":"ARTEX Docker image backdoored, researcher says; CERT-In flags Crafty Falcon","url":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","date":"2026-11-05","summary":"A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.","tags":["supply-chain","ai-tools","open-source","cloud","crypto","php","nodejs","ci-cd"]}]}