{"title":"Network edge advisories","description":"Firewalls, VPNs and appliances on the internet edge, and the infrastructure-as-code that exposes them.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/cccs-canada-reports-fortinet-security-advisory-av26-1145/","title":"CCCS Canada reports Fortinet security advisory AV26-1145","url":"https://vulnpocalypse.dev/advisories/cccs-canada-reports-fortinet-security-advisory-av26-1145/","date":"2026-11-12","summary":"CCCS Canada lists Fortinet security advisory AV26-1145; details are not confirmed, so check the CCCS page and Fortinet products you run.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/","title":"Intelbras IP cameras: Kaspersky reports DoS flaw in firmware update endpoint","url":"https://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/","date":"2026-11-12","summary":"Kaspersky reports an unauthenticated DoS flaw in Intelbras IP camera firmware, update affected cameras to firmware R.260804 as soon as possible.","tags":["exploited","network-edge","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/","title":"Supermarket fridges hijacked across Europe: internet-exposed Danfoss, Copeland and Dixell controllers forced into defrost","url":"https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/","date":"2026-11-12","summary":"On 11 Oct and 2 Nov 2026, attackers forced European supermarket fridges, and France's blood service, into defrost via exposed refrigeration controllers.","tags":["breach","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/","title":"Check Point Remote Access VPN CVE-2026-50751: IKEv1 authentication bypass exploited since May 2026","url":"https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/","date":"2026-11-12","summary":"An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/","title":"BeyondTrust Remote Support and PRA CVE-2026-1731: pre-auth command injection exploited before disclosure and used by ransomware","url":"https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/","date":"2026-11-12","summary":"Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/","title":"SecurityWeek reports Zoom Workplace and Asus router patches","url":"https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/","date":"2026-11-11","summary":"SecurityWeek reports Zoom patched two Workplace for Windows flaws in 7.1.8 and later, and Asus issued a router advisory; update both.","tags":["exploited","endpoint","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/policy-wire-reports-ukraine-units-adopt-hisky-terminals-amid-starlink-limits/","title":"Policy Wire reports Ukraine units adopt HiSKY terminals amid Starlink limits","url":"https://vulnpocalypse.dev/advisories/policy-wire-reports-ukraine-units-adopt-hisky-terminals-amid-starlink-limits/","date":"2026-11-11","summary":"Policy Wire reports Russian channels claim Ukraine uses HiSKY satellite terminals; unverified, so treat it as a claim and check vendor sources.","tags":["ecosystem","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-cve-2026-0330-panorama-pan-os-rce-flaw/","title":"Palo Alto Networks discloses CVE-2026-0330 Panorama PAN-OS RCE flaw","url":"https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-cve-2026-0330-panorama-pan-os-rce-flaw/","date":"2026-11-11","summary":"Palo Alto Networks says CVE-2026-0330 lets an authenticated Panorama admin run code as root; upgrade to a fixed PAN-OS version.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-information-disclosure-flaw-cve-2026-0331/","title":"Palo Alto discloses PAN-OS information disclosure flaw CVE-2026-0331","url":"https://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-information-disclosure-flaw-cve-2026-0331/","date":"2026-11-11","summary":"Palo Alto Networks says PAN-OS flaw CVE-2026-0331 can leak firewall and session data to unauthenticated attackers; upgrade to a fixed build.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-buffer-overflow-cve-2026-0326/","title":"Palo Alto discloses PAN-OS buffer overflow CVE-2026-0326","url":"https://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-buffer-overflow-cve-2026-0326/","date":"2026-11-11","summary":"Palo Alto Networks says PAN-OS CVE-2026-0326 is a buffer overflow in SCTP, DNS proxy or OSPFv3 handling, so upgrade to a fixed version.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/","title":"SAP ICM2SHELL and PROXYGATE: four CVSS 10.0 flaws patched","url":"https://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/","date":"2026-11-11","summary":"SAP patched four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws on Nov 10, 2026; apply the SAP Notes and check prxyinfo.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/","title":"Check Point reports three China-nexus campaigns linked via Sparrow malware","url":"https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/","date":"2026-11-11","summary":"The Hacker News reports Check Point links three China-nexus espionage clusters via Sparrow malware; review indicators and sideloading alerts.","tags":["breach","endpoint","network-edge","web"]},{"id":"https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/","title":"Operation Snowball: Jailbroken AI agent hits European telecom","url":"https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/","date":"2026-11-11","summary":"A jailbroken AI agent attacked a European telecom and 13 hosted organizations for two weeks; patch Cisco BroadWorks CVE-2026-20320 now.","tags":["ai-tools","ai-tools","network-edge","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/","title":"SonicWall SonicOS SSLVPN CVE-2026-19868 exploited, CISA says in KEV listing","url":"https://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/","date":"2026-11-11","summary":"CISA says SonicWall SonicOS SSLVPN flaw CVE-2026-19868 is exploited and added it to KEV; find exposed devices and check SonicWall guidance.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/","title":"Zyxel GS1900 switch zero-day CVE-2026-107441 lets attackers run root commands before login, now patched","url":"https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/","date":"2026-11-11","summary":"Zyxel GS1900 switches have a pre-auth RCE flaw, CVE-2026-107441, exploited in the wild and missed by the June patch, fixed October 22.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/","title":"Barracuda warns of critical flaws that chain to root access on Email Security Gateway and other appliances","url":"https://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/","date":"2026-11-11","summary":"Barracuda flaws CVE-2026-116606 and CVE-2026-111560 chain to root on the Email Security Gateway and five other products. Patch now.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/","title":"Billboard hijacks in Egypt, Malaysia and Brazil show explicit video","url":"https://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/","date":"2026-11-11","summary":"Explicit video appeared on LED billboards in Egypt, Malaysia and Brazil; operators should keep screen content systems off the public internet.","tags":["exploited","network-edge","web","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/","title":"Palo Alto Networks PAN-OS: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploited through internet-exposed management interfaces","url":"https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/","date":"2026-11-11","summary":"PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train's hotfix and take management off the internet.","tags":["exploited","network-edge","php","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/","title":"FreePBX: Cyble reports INJ3CTOR3 malware now steals SIP trunk credentials","url":"https://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/","date":"2026-11-11","summary":"Cyble reports INJ3CTOR3 malware now exfiltrates FreePBX SIP trunk credentials, so isolate and clean hosts before rotating any secrets.","tags":["exploited","php","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/fortinet-hardening-release-october-2026/","title":"Fortinet \"security hardening release\" for FortiOS, FortiManager, FortiAnalyzer, FortiMail and","url":"https://vulnpocalypse.dev/advisories/fortinet-hardening-release-october-2026/","date":"2026-11-11","summary":"Fortinet shipped critical and high-severity fixes found by AI-assisted testing; details come on 10 November. Upgrade internet-facing FortiGates first.","tags":["exploited","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/","title":"BeyondTrust Remote Support CVE-2026-102764 exploited by Armory Castle, patch now","url":"https://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/","date":"2026-11-11","summary":"Critical BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day by Armory Castle and is now in CISA KEV; patch and hunt.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/","title":"Hacker News recap reports OpenSSH SSHole exploitation attempts","url":"https://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/","date":"2026-11-09","summary":"The Hacker News reports exploitation attempts on OpenSSH flaw SSHole on musl systems without PAM, so check your hosts and patch.","tags":["exploited","open-source","network-edge","enterprise","web"]},{"id":"https://vulnpocalypse.dev/advisories/sonicwall-will-not-patch-two-flaws-in-end-of-life-gms-952-and-earlier-including/","title":"SonicWall will not patch two flaws in end-of-life GMS 9.5.2 and earlier, including unauthenticated file read","url":"https://vulnpocalypse.dev/advisories/sonicwall-will-not-patch-two-flaws-in-end-of-life-gms-952-and-earlier-including/","date":"2026-11-09","summary":"SonicWall says two flaws in end-of-life GMS 9.5.2 and earlier will get no fix, so customers are urged to move to Network Security Manager.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/","title":"Critical Node-RED flaw CVE-2026-58115 exploited in the wild to run code on exposed instances","url":"https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/","date":"2026-11-09","summary":"Attackers are exploiting a CVSS 10 missing-authentication flaw in Node-RED to create malicious flows and run code on instances left without adminAuth.","tags":["exploited","nodejs","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/","title":"BTCPay Server hot wallets drained on outdated self-hosted instances","url":"https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/","date":"2026-11-09","summary":"Attackers drained hot wallets on internet-exposed BTCPay Server instances running 2.4.1 or older; update to 2.4.7 and move funds to a new wallet.","tags":["exploited","crypto","network-edge","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/","title":"Synology warns of active C3RB3R (Cerber) ransomware hitting NAS devices through a patched DSM flaw","url":"https://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/","date":"2026-11-09","summary":"Synology says attackers are exploiting a patched DSM vulnerability to deploy C3RB3R (Cerber) ransomware on internet-exposed NAS devices.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/","title":"Suspected Chinese actor chains PHP2Shell and Fragnesia to root 25 PAN-OS servers","url":"https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/","date":"2026-11-09","summary":"A suspected China-nexus actor chained PHP2Shell with the Fragnesia kernel flaw to root 25 Palo Alto PAN-OS servers, including three in a US","tags":["ai-tools","php","network-edge","enterprise","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","title":"Linux kernel CVE-2026-98432: IPv4 TCP handshake use-after-free, with an AI-built remote root exploit","url":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","date":"2026-11-09","summary":"A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.","tags":["exploited","open-source","cloud","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/safepay-ransomware-critical-infrastructure-cisa/","title":"CISA, FBI and partners warn SafePay ransomware has hit at least 600 critical-infrastructure victims","url":"https://vulnpocalypse.dev/advisories/safepay-ransomware-critical-infrastructure-cisa/","date":"2026-11-09","summary":"Joint advisory AA26-293A: SafePay ransomware has hit 600+ organisations since Aug 2024. Patch the five named CVEs, require MFA, keep offline backups.","tags":["breach","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/","title":"PAN-OS GlobalProtect auth bypass (CVE-2026-0257) now used by Qilin and Inc ransomware, plus an exploited management RCE (CVE-2026-0322)","url":"https://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/","date":"2026-11-09","summary":"Ransomware crews use a GlobalProtect cookie bypass to get VPN access, and a new PAN-OS management RCE is exploited. Upgrade, and check Authentication Override.","tags":["exploited","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/","title":"Ivanti Connect Secure zero-day chain (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) gave root on fully patched VPNs","url":"https://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/","date":"2026-11-09","summary":"Three chained Ivanti Connect Secure flaws give unauthenticated root and evade the Integrity Checker. Upgrade to 25.1.3.1, 25.1.1.3 or 22.8R2.6.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/","title":"Citrix NetScaler CVE-2026-88779: exploited SAML memory overflow DoS, a week after the CVE-2026-88771 and -88772 RCE zero-days","url":"https://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/","date":"2026-11-09","summary":"An exploited memory overflow crashes NetScaler ADC and Gateway set up for SAML. Update to 14.1-73.41 or 13.1-64.28, which also fix September's exploited RCEs.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/cisa-says-gitlab-and-cisco-asaftd-flaws-exploited-adds-two-cves-to-kev/","title":"CISA says GitLab and Cisco ASA/FTD flaws exploited, adds two CVEs to KEV","url":"https://vulnpocalypse.dev/advisories/cisa-says-gitlab-and-cisco-asaftd-flaws-exploited-adds-two-cves-to-kev/","date":"2026-11-08","summary":"CISA says it added GitLab CVE-2026-97229 and Cisco ASA/FTD CVE-2026-76418 to its KEV catalog on exploitation evidence; patch affected systems.","tags":["exploited","enterprise","network-edge","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/networks-asia-reports-cisa-added-apple-wordpress-ivanti-flaws-to-kev/","title":"Networks Asia reports CISA added Apple, WordPress, Ivanti flaws to KEV","url":"https://vulnpocalypse.dev/advisories/networks-asia-reports-cisa-added-apple-wordpress-ivanti-flaws-to-kev/","date":"2026-11-07","summary":"Networks Asia reports CISA added four exploited flaws in Apple, WordPress and Ivanti to its KEV list; verify the entries and patch affected products.","tags":["exploited","web","network-edge","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/d-link-dgs-3130-switches-have-unpatched-zero-day-flaws-the420in-reports/","title":"D-Link DGS-3130 switches have unpatched zero-day flaws, The420.in reports","url":"https://vulnpocalypse.dev/advisories/d-link-dgs-3130-switches-have-unpatched-zero-day-flaws-the420in-reports/","date":"2026-11-07","summary":"The420.in reports unpatched zero-day flaws in D-Link DGS-3130 switches, so disable D-Link Discovery Protocol and restrict management access.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/","title":"Rapid7 reports new Metasploit modules for Citrix NetScaler, Flowise, SPIP","url":"https://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/","date":"2026-11-06","summary":"Rapid7 says new Metasploit modules target Citrix NetScaler, Flowise, SPIP and OpenBullet2 flaws, so check exposure and apply vendor fixes.","tags":["ai-tools","network-edge","ci-cd","ai-tools","php","open-source","web"]},{"id":"https://vulnpocalypse.dev/advisories/dark-project-ransomware-group-claims-38-victims-in-8-countries-according-to/","title":"Dark Project ransomware group claims 38 victims in 8 countries, according to Gurucul research","url":"https://vulnpocalypse.dev/advisories/dark-project-ransomware-group-claims-38-victims-in-8-countries-according-to/","date":"2026-11-06","summary":"Outlets report Gurucul research on Dark Project, a ransomware group claiming 38 victims; review exposed RDP, VPN access and credentials.","tags":["breach","enterprise","endpoint","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/","title":"SecurityWeek reports Cisco, WatchGuard patches and unfixed SonicWall GMS flaws","url":"https://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/","date":"2026-11-05","summary":"SecurityWeek reports Cisco and WatchGuard patches plus two unfixed SonicWall GMS flaws, so apply vendor fixes and replace end-of-life GMS.","tags":["exploited","network-edge","enterprise","nodejs"]},{"id":"https://vulnpocalypse.dev/advisories/sans-isc-reports-scans-it-suspects-target-cisco-ios-cve-2023-20198/","title":"SANS ISC reports scans it suspects target Cisco IOS CVE-2023-20198","url":"https://vulnpocalypse.dev/advisories/sans-isc-reports-scans-it-suspects-target-cisco-ios-cve-2023-20198/","date":"2026-11-05","summary":"SANS ISC reports honeypot scans it suspects target Cisco IOS CVE-2023-20198; check that IOS web management is not exposed to the internet.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/residential-proxy-traffic-white-house-eop-network-as2650/","title":"Residential proxy traffic seen exiting the White House (EOP) network AS2650, a threat-intel vendor reports","url":"https://vulnpocalypse.dev/advisories/residential-proxy-traffic-white-house-eop-network-as2650/","date":"2026-11-05","summary":"Layer3 Intel reports 236 residential proxy exits over 30 days on AS2650, registered to the Executive Office of the President; the cause is unconfirmed.","tags":["breach","network-edge","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/clingstun-linux-backdoor-stun/","title":"\"ClingSTUN\" Linux backdoor turns IoT devices into proxy nodes and hides its C2 inside public STUN traffic","url":"https://vulnpocalypse.dev/advisories/clingstun-linux-backdoor-stun/","date":"2026-11-04","summary":"ClingSTUN backdoors unpatched internet-facing Linux and IoT devices and hides its C2 in legitimate public STUN traffic. Inventory and patch exposed devices.","tags":["breach","endpoint","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/","title":"Palo Alto Networks CEO says AI is driving faster cyberattacks, ETCISO reports","url":"https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/","date":"2026-11-03","summary":"Palo Alto Networks CEO says AI is speeding up cyberattacks, ETCISO reports; test exposed infrastructure for known flaws and misconfigurations.","tags":["ai-tools","ai-tools","php","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-analysis-78-of-exploited-vulnerabilities-are-system-takeover-flaws-and/","title":"Microsoft analysis: 78% of exploited vulnerabilities are system takeover flaws, and patching lags","url":"https://vulnpocalypse.dev/advisories/microsoft-analysis-78-of-exploited-vulnerabilities-are-system-takeover-flaws-and/","date":"2026-11-03","summary":"Microsoft found that about 0.5% of disclosed CVEs are exploited, 78% of those enable system takeover, and patching on servers and appliances lags far behind","tags":["exploited","enterprise","endpoint","network-edge","cloud","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/cisco-asa-ftd-cve-2026-76418/","title":"Cisco ASA and FTD CVE-2026-76418: exploited SSL VPN crash when secondary authentication is configured","url":"https://vulnpocalypse.dev/advisories/cisco-asa-ftd-cve-2026-76418/","date":"2026-11-02","summary":"An exploited flaw lets anyone reload Cisco ASA or FTD firewalls running SSL VPN with secondary auth. Upgrade to a fixed release or remove secondary auth.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/tailscale-ssh-serve-ts-2026-014/","title":"Tailscale SSH and Serve flaws (TS-2026-014 to TS-2026-017) let a permitted session reach root-only sockets","url":"https://vulnpocalypse.dev/advisories/tailscale-ssh-serve-ts-2026-014/","date":"2026-11-02","summary":"Tailscale SSH forwarding and Serve Unix-socket backends ran as root, so an allowed session could take over a node. Update every node to Tailscale 1.104.4.","tags":["exploited","network-edge","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/goahead-tls-cve-2026-115881/","title":"Embedthis GoAhead 6.1.1 (CVE-2026-115881, CVE-2026-115884): revoked client certificates accepted, plus a password bypass","url":"https://vulnpocalypse.dev/advisories/goahead-tls-cve-2026-115881/","date":"2026-11-02","summary":"GoAhead up to 6.1.0 ignores its CRL, so revoked mTLS client certificates still log in. Rebuild firmware with GoAhead 6.1.1; device owners need vendor updates.","tags":["exploited","network-edge","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/arista-velocloud-orchestrator-cve-2026-114625/","title":"Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625) lets any logged-in user act as superuser operator, exploited","url":"https://vulnpocalypse.dev/advisories/arista-velocloud-orchestrator-cve-2026-114625/","date":"2026-11-02","summary":"Any authenticated user of on-prem VeloCloud Orchestrator can become superuser operator; Arista says it is exploited. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/fortinet-cli-path-traversal-cve-2025-61624/","title":"Fortinet CLI path traversal (CVE-2025-61624) in FortiOS, FortiProxy, FortiPAM and FortiSwitchManager is now exploited","url":"https://vulnpocalypse.dev/advisories/fortinet-cli-path-traversal-cve-2025-61624/","date":"2026-11-02","summary":"An admin-level CLI path traversal patched in April is now on CISA's exploited list. Upgrade FortiOS to 7.6.5 or 7.4.10 and audit admin accounts.","tags":["exploited","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/fortimail-cve-2026-104286-ibe-file-write/","title":"Fortinet FortiMail CVE-2026-104286: unauthenticated file write through the IBE endpoint, exploited as a zero-day","url":"https://vulnpocalypse.dev/advisories/fortimail-cve-2026-104286-ibe-file-write/","date":"2026-11-02","summary":"Unauthenticated attackers write files on FortiMail through the /ibe endpoint; exploited before a patch. Upgrade to 8.0.2, 7.6.7 or 7.4.9, or turn IBE off.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/cisco-sd-wan-manager-cve-2026-76504/","title":"Cisco Catalyst SD-WAN Manager CVE-2026-76504: URL-encoded login path gives unauthenticated admin API access, exploited","url":"https://vulnpocalypse.dev/advisories/cisco-sd-wan-manager-cve-2026-76504/","date":"2026-11-02","summary":"A URL-encoding trick bypasses SD-WAN Manager API login and grants admin; exploited since September. Upgrade and check the two logs Cisco names.","tags":["exploited","network-edge","enterprise"]}]}