https://vulnpocalypse.dev/feeds/Our advisories rated critical.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/Thu, 12 Nov 2026 12:00:00 +0000On 11 Oct and 2 Nov 2026, attackers forced European supermarket fridges, and France's blood service, into defrost via exposed refrigeration controllers.breachnetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/Thu, 12 Nov 2026 12:00:00 +0000An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/cursor-2026-cves/https://vulnpocalypse.dev/advisories/cursor-2026-cves/Thu, 12 Nov 2026 12:00:00 +0000Seven 2026 Cursor CVEs let prompt injection or a cloned repo run code outside the sandbox. Update to 3.1.2 or later; the Windows git.exe bug has no stated fix.ai-toolsai-toolsendpointhttps://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/Thu, 12 Nov 2026 12:00:00 +0000Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/synology-discloses-dsm-flaws-incl-critical-cve-2026-76954/https://vulnpocalypse.dev/advisories/synology-discloses-dsm-flaws-incl-critical-cve-2026-76954/Wed, 11 Nov 2026 12:00:00 +0000Synology says DSM updates fix multiple flaws, including a critical Auth API one; affected DSM owners should upgrade to the fixed builds.exploitedenterprisehttps://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/Wed, 11 Nov 2026 12:00:00 +0000SecurityWeek reports Zoom patched two Workplace for Windows flaws in 7.1.8 and later, and Asus issued a router advisory; update both.exploitedendpointnetwork-edgehttps://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/https://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/Wed, 11 Nov 2026 12:00:00 +0000SAP patched four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws on Nov 10, 2026; apply the SAP Notes and check prxyinfo.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/https://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/Wed, 11 Nov 2026 12:00:00 +0000A researcher published exploit code for 33 unpatched N-central flaws; N-able took hosted N-central offline and told on-prem users to shut down pending a fixexploitedenterpriseendpointhttps://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/Wed, 11 Nov 2026 12:00:00 +0000Zyxel GS1900 switches have a pre-auth RCE flaw, CVE-2026-107441, exploited in the wild and missed by the June patch, fixed October 22.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/https://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/Wed, 11 Nov 2026 12:00:00 +0000A critical Rails Active Storage flaw lets unauthenticated uploads write files through ImageMagick, fixed in activestorage 8.1.4.1 and 8.0.5.2.exploitedwebopen-sourcehttps://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/https://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/Wed, 11 Nov 2026 12:00:00 +0000Google released Chrome 157 with 213 security fixes, seven rated critical, and has not said any of them are exploited in the wild.exploitedwebendpointhttps://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/https://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/Wed, 11 Nov 2026 12:00:00 +0000Barracuda flaws CVE-2026-116606 and CVE-2026-111560 chain to root on the Email Security Gateway and five other products. Patch now.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/https://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/Wed, 11 Nov 2026 12:00:00 +0000Google's November 2026 Android bulletin fixes 216 flaws, including critical zero-click RCE CVE-2026-58868 on Android 14 through 17.exploitedendpointenterprisehttps://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/Wed, 11 Nov 2026 12:00:00 +0000On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.breachcryptocloudci-cdhttps://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/Wed, 11 Nov 2026 12:00:00 +0000Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.supply-chainai-toolsendpointopen-sourcehttps://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/Wed, 11 Nov 2026 12:00:00 +0000PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train's hotfix and take management off the internet.exploitednetwork-edgephpenterprisehttps://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/Wed, 11 Nov 2026 12:00:00 +0000An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.exploitedphpwebopen-sourcehttps://vulnpocalypse.dev/advisories/oracle-ebs-cve-2026-101767/https://vulnpocalypse.dev/advisories/oracle-ebs-cve-2026-101767/Wed, 11 Nov 2026 12:00:00 +0000An unauthenticated SQL injection in EBS 12.2.3 to 12.2.15 leads to OS command execution, and decoys saw exploit attempts. Apply the October 2026 CPU.exploitedenterprisehttps://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/Wed, 11 Nov 2026 12:00:00 +0000CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash or run code. Patch Node.js, Brotli, Bun and more.exploitednodejsopen-sourcehttps://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/https://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/Wed, 11 Nov 2026 12:00:00 +0000Two PHP engine flaws allow unauthenticated code execution on WordPress, Drupal and Joomla. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.exploitedphphttps://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/https://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/Wed, 11 Nov 2026 12:00:00 +0000Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA's exploited list and three TLS certificate checks.exploitednodejshttps://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/https://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/Wed, 11 Nov 2026 12:00:00 +0000Attackers with stolen gh CLI tokens shipped malware as LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR. Check before running Python, then rebuild and rotate.supply-chainpypiai-toolsci-cdhttps://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/Wed, 11 Nov 2026 12:00:00 +0000LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.supply-chainpypiai-toolsopen-sourceci-cdcloudhttps://vulnpocalypse.dev/advisories/plex2shell-plex-media-server/https://vulnpocalypse.dev/advisories/plex2shell-plex-media-server/Wed, 11 Nov 2026 12:00:00 +0000Four chained Plex Media Server bugs give unauthenticated code execution and are widely exploited. Update to 1.43.3.10861 or later and check the Codecs folder.exploitedendpointhttps://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/https://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/Wed, 11 Nov 2026 12:00:00 +0000Critical BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day by Armory Castle and is now in CISA KEV; patch and hunt.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/https://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/Wed, 11 Nov 2026 12:00:00 +0000Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.exploitednextjsnpmhttps://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/Wed, 11 Nov 2026 12:00:00 +0000CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.ai-toolsai-toolsenterprisecloudwebcryptohttps://vulnpocalypse.dev/advisories/atlassian-data-center-cve-2026-21589-file-read/https://vulnpocalypse.dev/advisories/atlassian-data-center-cve-2026-21589-file-read/Wed, 11 Nov 2026 12:00:00 +0000A pre-auth file read hits every Atlassian Data Center product and can leak Crowd credentials; exploited. Patch, or apply Atlassian's block rule.exploitedenterpriseci-cdhttps://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/Wed, 11 Nov 2026 12:00:00 +0000A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.exploitednodejsnpmopen-sourcehttps://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/https://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/Wed, 11 Nov 2026 12:00:00 +0000Hijacked actions-cool/issues-helper and maintain-one-comment were re-enabled on 16 Sep 2026 with every tag still malicious. Remove them and rotate CI secrets.supply-chaingithub-actionsci-cdai-toolshttps://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/https://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/Wed, 11 Nov 2026 12:00:00 +0000Poisoned TanStack packages stole an Nx developer's GitHub token. A trojaned Nx Console release then hit GitHub and Grafana. Check installs, rotate tokens.supply-chainnpmgithub-actionsci-cdhttps://vulnpocalypse.dev/advisories/axios-npm-hijack/https://vulnpocalypse.dev/advisories/axios-npm-hijack/Wed, 11 Nov 2026 12:00:00 +0000A hijacked maintainer account published axios 1.14.1 and 0.30.4 with a dependency that installs a remote access trojan. Check lockfiles for plain-crypto-js.supply-chainnpmci-cdhttps://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/https://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/Wed, 11 Nov 2026 12:00:00 +0000Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.supply-chaingithub-actionspypici-cdai-toolshttps://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/https://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/Wed, 11 Nov 2026 12:00:00 +0000An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.exploitednpmnextjshttps://vulnpocalypse.dev/advisories/shai-hulud-npm-worm/https://vulnpocalypse.dev/advisories/shai-hulud-npm-worm/Wed, 11 Nov 2026 12:00:00 +0000A self-replicating npm worm runs at install time, steals developer and CI secrets, and registers rogue GitHub runners. New waves hit from April to August 2026.supply-chainnpmgithub-actionshttps://vulnpocalypse.dev/advisories/xen-orchestra-auth-bypass-vsa-2026-062-exploited-update-now/https://vulnpocalypse.dev/advisories/xen-orchestra-auth-bypass-vsa-2026-062-exploited-update-now/Tue, 10 Nov 2026 12:00:00 +0000Vates says a critical Xen Orchestra authentication bypass, VSA-2026-062, is exploited; update to the fixed release and restrict access.exploitedenterprisehttps://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/Mon, 09 Nov 2026 12:00:00 +0000React maintainers report a critical unauthenticated RCE flaw in three react-server-dom packages; upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.exploitednpmnodejswebopen-sourcehttps://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/Mon, 09 Nov 2026 12:00:00 +0000Attackers are exploiting a CVSS 10 missing-authentication flaw in Node-RED to create malicious flows and run code on instances left without adminAuth.exploitednodejsnetwork-edgehttps://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/https://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/Mon, 09 Nov 2026 12:00:00 +0000A coordinated campaign abused the Magento StyleSmuggler flaw (CVE-2026-75650) to run code on Adobe Commerce stores and install the PSK Agent Go RAT.breachwebenterprisephphttps://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/https://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/Mon, 09 Nov 2026 12:00:00 +0000Synology says attackers are exploiting a patched DSM vulnerability to deploy C3RB3R (Cerber) ransomware on internet-exposed NAS devices.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/Mon, 09 Nov 2026 12:00:00 +0000A suspected China-nexus actor chained PHP2Shell with the Fragnesia kernel flaw to root 25 Palo Alto PAN-OS servers, including three in a USai-toolsphpnetwork-edgeenterpriseai-toolshttps://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/Mon, 09 Nov 2026 12:00:00 +0000A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.exploitedopen-sourcecloudnetwork-edgehttps://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/https://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/Mon, 09 Nov 2026 12:00:00 +0000Ransomware crews use a GlobalProtect cookie bypass to get VPN access, and a new PAN-OS management RCE is exploited. Upgrade, and check Authentication Override.exploitednetwork-edgehttps://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/https://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/Mon, 09 Nov 2026 12:00:00 +0000Three chained Ivanti Connect Secure flaws give unauthenticated root and evade the Integrity Checker. Upgrade to 25.1.3.1, 25.1.1.3 or 22.8R2.6.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/https://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/Mon, 09 Nov 2026 12:00:00 +0000An exploited memory overflow crashes NetScaler ADC and Gateway set up for SAML. Update to 14.1-73.41 or 13.1-64.28, which also fix September's exploited RCEs.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/cpguard-update-channel-hijacked-to-backdoor-linux-hosting-servers-and-steal-cred/https://vulnpocalypse.dev/advisories/cpguard-update-channel-hijacked-to-backdoor-linux-hosting-servers-and-steal-cred/Sun, 08 Nov 2026 12:00:00 +0000Attackers pushed a malicious script through cPGuard versions 5.88.12 to 5.88.19, installing a root backdoor and stealing password hashes and keys.supply-chainwebopen-sourcehttps://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/https://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/Sun, 08 Nov 2026 12:00:00 +0000LXD and MicroCloud accepted a trusted public certificate anywhere in a client's chain, enabling impersonation. Refresh to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15.exploitedcloudopen-sourcehttps://vulnpocalypse.dev/advisories/gitlab-ci-regex-rce/https://vulnpocalypse.dev/advisories/gitlab-ci-regex-rce/Sun, 08 Nov 2026 12:00:00 +0000Two CVSS 10 regex flaws give unauthenticated code execution on self-managed GitLab; one is exploited. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a 21 Oct backport.exploitedci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/storm-2603-sharepoint-toolshell-fileless/https://vulnpocalypse.dev/advisories/storm-2603-sharepoint-toolshell-fileless/Fri, 06 Nov 2026 12:00:00 +0000Kaspersky details a Storm-2603 intrusion using ToolShell (CVE-2025-53770/53771) to load an in-memory IIS webshell, escalate to SYSTEM and stage Warlock.breachenterprisewebendpointhttps://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/Thu, 05 Nov 2026 12:00:00 +0000A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.supply-chainai-toolsopen-sourcecloudcryptophpnodejsci-cd