https://vulnpocalypse.dev/feeds/Firewalls, VPNs and appliances on the internet edge, and the infrastructure-as-code that exposes them.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/cccs-canada-reports-fortinet-security-advisory-av26-1145/https://vulnpocalypse.dev/advisories/cccs-canada-reports-fortinet-security-advisory-av26-1145/Thu, 12 Nov 2026 12:00:00 +0000CCCS Canada lists Fortinet security advisory AV26-1145; details are not confirmed, so check the CCCS page and Fortinet products you run.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/https://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/Thu, 12 Nov 2026 12:00:00 +0000Kaspersky reports an unauthenticated DoS flaw in Intelbras IP camera firmware, update affected cameras to firmware R.260804 as soon as possible.exploitednetwork-edgeendpointhttps://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/Thu, 12 Nov 2026 12:00:00 +0000On 11 Oct and 2 Nov 2026, attackers forced European supermarket fridges, and France's blood service, into defrost via exposed refrigeration controllers.breachnetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/Thu, 12 Nov 2026 12:00:00 +0000An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/Thu, 12 Nov 2026 12:00:00 +0000Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/Wed, 11 Nov 2026 12:00:00 +0000SecurityWeek reports Zoom patched two Workplace for Windows flaws in 7.1.8 and later, and Asus issued a router advisory; update both.exploitedendpointnetwork-edgehttps://vulnpocalypse.dev/advisories/policy-wire-reports-ukraine-units-adopt-hisky-terminals-amid-starlink-limits/https://vulnpocalypse.dev/advisories/policy-wire-reports-ukraine-units-adopt-hisky-terminals-amid-starlink-limits/Wed, 11 Nov 2026 12:00:00 +0000Policy Wire reports Russian channels claim Ukraine uses HiSKY satellite terminals; unverified, so treat it as a claim and check vendor sources.ecosystemnetwork-edgehttps://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-cve-2026-0330-panorama-pan-os-rce-flaw/https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-cve-2026-0330-panorama-pan-os-rce-flaw/Wed, 11 Nov 2026 12:00:00 +0000Palo Alto Networks says CVE-2026-0330 lets an authenticated Panorama admin run code as root; upgrade to a fixed PAN-OS version.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-information-disclosure-flaw-cve-2026-0331/https://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-information-disclosure-flaw-cve-2026-0331/Wed, 11 Nov 2026 12:00:00 +0000Palo Alto Networks says PAN-OS flaw CVE-2026-0331 can leak firewall and session data to unauthenticated attackers; upgrade to a fixed build.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-buffer-overflow-cve-2026-0326/https://vulnpocalypse.dev/advisories/palo-alto-discloses-pan-os-buffer-overflow-cve-2026-0326/Wed, 11 Nov 2026 12:00:00 +0000Palo Alto Networks says PAN-OS CVE-2026-0326 is a buffer overflow in SCTP, DNS proxy or OSPFv3 handling, so upgrade to a fixed version.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/https://vulnpocalypse.dev/advisories/sap-icm2shell-and-proxygate-four-cvss-100-flaws-patched/Wed, 11 Nov 2026 12:00:00 +0000SAP patched four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws on Nov 10, 2026; apply the SAP Notes and check prxyinfo.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/Wed, 11 Nov 2026 12:00:00 +0000The Hacker News reports Check Point links three China-nexus espionage clusters via Sparrow malware; review indicators and sideloading alerts.breachendpointnetwork-edgewebhttps://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/Wed, 11 Nov 2026 12:00:00 +0000A jailbroken AI agent attacked a European telecom and 13 hosted organizations for two weeks; patch Cisco BroadWorks CVE-2026-20320 now.ai-toolsai-toolsnetwork-edgeenterprisecloudhttps://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/https://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/Wed, 11 Nov 2026 12:00:00 +0000CISA says SonicWall SonicOS SSLVPN flaw CVE-2026-19868 is exploited and added it to KEV; find exposed devices and check SonicWall guidance.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/Wed, 11 Nov 2026 12:00:00 +0000Zyxel GS1900 switches have a pre-auth RCE flaw, CVE-2026-107441, exploited in the wild and missed by the June patch, fixed October 22.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/https://vulnpocalypse.dev/advisories/barracuda-email-security-gateway-root-access-flaws/Wed, 11 Nov 2026 12:00:00 +0000Barracuda flaws CVE-2026-116606 and CVE-2026-111560 chain to root on the Email Security Gateway and five other products. Patch now.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/https://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/Wed, 11 Nov 2026 12:00:00 +0000Explicit video appeared on LED billboards in Egypt, Malaysia and Brazil; operators should keep screen content systems off the public internet.exploitednetwork-edgewebenterprisehttps://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/Wed, 11 Nov 2026 12:00:00 +0000PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train's hotfix and take management off the internet.exploitednetwork-edgephpenterprisehttps://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/https://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/Wed, 11 Nov 2026 12:00:00 +0000Cyble reports INJ3CTOR3 malware now exfiltrates FreePBX SIP trunk credentials, so isolate and clean hosts before rotating any secrets.exploitedphpnetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/fortinet-hardening-release-october-2026/https://vulnpocalypse.dev/advisories/fortinet-hardening-release-october-2026/Wed, 11 Nov 2026 12:00:00 +0000Fortinet shipped critical and high-severity fixes found by AI-assisted testing; details come on 10 November. Upgrade internet-facing FortiGates first.exploitednetwork-edgehttps://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/https://vulnpocalypse.dev/advisories/beyondtrust-remote-support-cve-2026-102764-exploited-by-armory-castle-patch-now/Wed, 11 Nov 2026 12:00:00 +0000Critical BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day by Armory Castle and is now in CISA KEV; patch and hunt.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/https://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/Mon, 09 Nov 2026 12:00:00 +0000The Hacker News reports exploitation attempts on OpenSSH flaw SSHole on musl systems without PAM, so check your hosts and patch.exploitedopen-sourcenetwork-edgeenterprisewebhttps://vulnpocalypse.dev/advisories/sonicwall-will-not-patch-two-flaws-in-end-of-life-gms-952-and-earlier-including/https://vulnpocalypse.dev/advisories/sonicwall-will-not-patch-two-flaws-in-end-of-life-gms-952-and-earlier-including/Mon, 09 Nov 2026 12:00:00 +0000SonicWall says two flaws in end-of-life GMS 9.5.2 and earlier will get no fix, so customers are urged to move to Network Security Manager.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/Mon, 09 Nov 2026 12:00:00 +0000Attackers are exploiting a CVSS 10 missing-authentication flaw in Node-RED to create malicious flows and run code on instances left without adminAuth.exploitednodejsnetwork-edgehttps://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/Mon, 09 Nov 2026 12:00:00 +0000Attackers drained hot wallets on internet-exposed BTCPay Server instances running 2.4.1 or older; update to 2.4.7 and move funds to a new wallet.exploitedcryptonetwork-edgeopen-sourcehttps://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/https://vulnpocalypse.dev/advisories/synology-c3rb3r-ransomware-nas/Mon, 09 Nov 2026 12:00:00 +0000Synology says attackers are exploiting a patched DSM vulnerability to deploy C3RB3R (Cerber) ransomware on internet-exposed NAS devices.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/Mon, 09 Nov 2026 12:00:00 +0000A suspected China-nexus actor chained PHP2Shell with the Fragnesia kernel flaw to root 25 Palo Alto PAN-OS servers, including three in a USai-toolsphpnetwork-edgeenterpriseai-toolshttps://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/Mon, 09 Nov 2026 12:00:00 +0000A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.exploitedopen-sourcecloudnetwork-edgehttps://vulnpocalypse.dev/advisories/safepay-ransomware-critical-infrastructure-cisa/https://vulnpocalypse.dev/advisories/safepay-ransomware-critical-infrastructure-cisa/Mon, 09 Nov 2026 12:00:00 +0000Joint advisory AA26-293A: SafePay ransomware has hit 600+ organisations since Aug 2024. Patch the five named CVEs, require MFA, keep offline backups.breachnetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/https://vulnpocalypse.dev/advisories/pan-os-globalprotect-cve-2026-0257/Mon, 09 Nov 2026 12:00:00 +0000Ransomware crews use a GlobalProtect cookie bypass to get VPN access, and a new PAN-OS management RCE is exploited. Upgrade, and check Authentication Override.exploitednetwork-edgehttps://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/https://vulnpocalypse.dev/advisories/ivanti-connect-secure-cve-2026-104935/Mon, 09 Nov 2026 12:00:00 +0000Three chained Ivanti Connect Secure flaws give unauthenticated root and evade the Integrity Checker. Upgrade to 25.1.3.1, 25.1.1.3 or 22.8R2.6.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/https://vulnpocalypse.dev/advisories/citrix-netscaler-cve-2026-88779-saml-dos/Mon, 09 Nov 2026 12:00:00 +0000An exploited memory overflow crashes NetScaler ADC and Gateway set up for SAML. Update to 14.1-73.41 or 13.1-64.28, which also fix September's exploited RCEs.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/cisa-says-gitlab-and-cisco-asaftd-flaws-exploited-adds-two-cves-to-kev/https://vulnpocalypse.dev/advisories/cisa-says-gitlab-and-cisco-asaftd-flaws-exploited-adds-two-cves-to-kev/Sun, 08 Nov 2026 12:00:00 +0000CISA says it added GitLab CVE-2026-97229 and Cisco ASA/FTD CVE-2026-76418 to its KEV catalog on exploitation evidence; patch affected systems.exploitedenterprisenetwork-edgeci-cdhttps://vulnpocalypse.dev/advisories/networks-asia-reports-cisa-added-apple-wordpress-ivanti-flaws-to-kev/https://vulnpocalypse.dev/advisories/networks-asia-reports-cisa-added-apple-wordpress-ivanti-flaws-to-kev/Sat, 07 Nov 2026 12:00:00 +0000Networks Asia reports CISA added four exploited flaws in Apple, WordPress and Ivanti to its KEV list; verify the entries and patch affected products.exploitedwebnetwork-edgeendpointenterprisehttps://vulnpocalypse.dev/advisories/d-link-dgs-3130-switches-have-unpatched-zero-day-flaws-the420in-reports/https://vulnpocalypse.dev/advisories/d-link-dgs-3130-switches-have-unpatched-zero-day-flaws-the420in-reports/Sat, 07 Nov 2026 12:00:00 +0000The420.in reports unpatched zero-day flaws in D-Link DGS-3130 switches, so disable D-Link Discovery Protocol and restrict management access.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/https://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/Fri, 06 Nov 2026 12:00:00 +0000Rapid7 says new Metasploit modules target Citrix NetScaler, Flowise, SPIP and OpenBullet2 flaws, so check exposure and apply vendor fixes.ai-toolsnetwork-edgeci-cdai-toolsphpopen-sourcewebhttps://vulnpocalypse.dev/advisories/dark-project-ransomware-group-claims-38-victims-in-8-countries-according-to/https://vulnpocalypse.dev/advisories/dark-project-ransomware-group-claims-38-victims-in-8-countries-according-to/Fri, 06 Nov 2026 12:00:00 +0000Outlets report Gurucul research on Dark Project, a ransomware group claiming 38 victims; review exposed RDP, VPN access and credentials.breachenterpriseendpointnetwork-edgehttps://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/https://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/Thu, 05 Nov 2026 12:00:00 +0000SecurityWeek reports Cisco and WatchGuard patches plus two unfixed SonicWall GMS flaws, so apply vendor fixes and replace end-of-life GMS.exploitednetwork-edgeenterprisenodejshttps://vulnpocalypse.dev/advisories/sans-isc-reports-scans-it-suspects-target-cisco-ios-cve-2023-20198/https://vulnpocalypse.dev/advisories/sans-isc-reports-scans-it-suspects-target-cisco-ios-cve-2023-20198/Thu, 05 Nov 2026 12:00:00 +0000SANS ISC reports honeypot scans it suspects target Cisco IOS CVE-2023-20198; check that IOS web management is not exposed to the internet.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/residential-proxy-traffic-white-house-eop-network-as2650/https://vulnpocalypse.dev/advisories/residential-proxy-traffic-white-house-eop-network-as2650/Thu, 05 Nov 2026 12:00:00 +0000Layer3 Intel reports 236 residential proxy exits over 30 days on AS2650, registered to the Executive Office of the President; the cause is unconfirmed.breachnetwork-edgeendpointenterprisehttps://vulnpocalypse.dev/advisories/clingstun-linux-backdoor-stun/https://vulnpocalypse.dev/advisories/clingstun-linux-backdoor-stun/Wed, 04 Nov 2026 12:00:00 +0000ClingSTUN backdoors unpatched internet-facing Linux and IoT devices and hides its C2 in legitimate public STUN traffic. Inventory and patch exposed devices.breachendpointnetwork-edgehttps://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/Tue, 03 Nov 2026 12:00:00 +0000Palo Alto Networks CEO says AI is speeding up cyberattacks, ETCISO reports; test exposed infrastructure for known flaws and misconfigurations.ai-toolsai-toolsphpenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/microsoft-analysis-78-of-exploited-vulnerabilities-are-system-takeover-flaws-and/https://vulnpocalypse.dev/advisories/microsoft-analysis-78-of-exploited-vulnerabilities-are-system-takeover-flaws-and/Tue, 03 Nov 2026 12:00:00 +0000Microsoft found that about 0.5% of disclosed CVEs are exploited, 78% of those enable system takeover, and patching on servers and appliances lags far behindexploitedenterpriseendpointnetwork-edgecloudvuln-datahttps://vulnpocalypse.dev/advisories/cisco-asa-ftd-cve-2026-76418/https://vulnpocalypse.dev/advisories/cisco-asa-ftd-cve-2026-76418/Mon, 02 Nov 2026 12:00:00 +0000An exploited flaw lets anyone reload Cisco ASA or FTD firewalls running SSL VPN with secondary auth. Upgrade to a fixed release or remove secondary auth.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/tailscale-ssh-serve-ts-2026-014/https://vulnpocalypse.dev/advisories/tailscale-ssh-serve-ts-2026-014/Mon, 02 Nov 2026 12:00:00 +0000Tailscale SSH forwarding and Serve Unix-socket backends ran as root, so an allowed session could take over a node. Update every node to Tailscale 1.104.4.exploitednetwork-edgeopen-sourcehttps://vulnpocalypse.dev/advisories/goahead-tls-cve-2026-115881/https://vulnpocalypse.dev/advisories/goahead-tls-cve-2026-115881/Mon, 02 Nov 2026 12:00:00 +0000GoAhead up to 6.1.0 ignores its CRL, so revoked mTLS client certificates still log in. Rebuild firmware with GoAhead 6.1.1; device owners need vendor updates.exploitednetwork-edgeopen-sourcehttps://vulnpocalypse.dev/advisories/arista-velocloud-orchestrator-cve-2026-114625/https://vulnpocalypse.dev/advisories/arista-velocloud-orchestrator-cve-2026-114625/Mon, 02 Nov 2026 12:00:00 +0000Any authenticated user of on-prem VeloCloud Orchestrator can become superuser operator; Arista says it is exploited. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/fortinet-cli-path-traversal-cve-2025-61624/https://vulnpocalypse.dev/advisories/fortinet-cli-path-traversal-cve-2025-61624/Mon, 02 Nov 2026 12:00:00 +0000An admin-level CLI path traversal patched in April is now on CISA's exploited list. Upgrade FortiOS to 7.6.5 or 7.4.10 and audit admin accounts.exploitednetwork-edgehttps://vulnpocalypse.dev/advisories/fortimail-cve-2026-104286-ibe-file-write/https://vulnpocalypse.dev/advisories/fortimail-cve-2026-104286-ibe-file-write/Mon, 02 Nov 2026 12:00:00 +0000Unauthenticated attackers write files on FortiMail through the /ibe endpoint; exploited before a patch. Upgrade to 8.0.2, 7.6.7 or 7.4.9, or turn IBE off.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/cisco-sd-wan-manager-cve-2026-76504/https://vulnpocalypse.dev/advisories/cisco-sd-wan-manager-cve-2026-76504/Mon, 02 Nov 2026 12:00:00 +0000A URL-encoding trick bypasses SD-WAN Manager API login and grants admin; exploited since September. Upgrade and check the two logs Cisco names.exploitednetwork-edgeenterprise