{
 "built": "2026-11-03T18:08Z",
 "items": [
  {
   "id": "CVE-2026-109618",
   "title": "Hackers can take over websites running PHP without a login",
   "nick": "php2shell",
   "who": "both",
   "who_line": "Anyone running a website on PHP, including most WordPress hosting.",
   "do": "Update PHP to the latest version, or ask your web host to do it.",
   "light": "act",
   "exploited": true,
   "score": 110.5,
   "vendor": "PHP Group",
   "product": "PHP",
   "added": "2026-10-26"
  },
  {
   "id": "CVE-2026-111497",
   "title": "A booby-trapped file can take over apps that use Google Brotli",
   "nick": "node2shell",
   "who": "both",
   "who_line": "Any app or website that unpacks Brotli compressed data, which is common in web software.",
   "do": "Update software and containers that include Brotli. Apply each vendor's security update.",
   "light": "act",
   "exploited": true,
   "score": 93.9,
   "vendor": "Google",
   "product": "Brotli",
   "added": "2026-10-27"
  },
  {
   "id": "CVE-2026-97229",
   "title": "A booby-trapped setup file can take over a GitLab server",
   "nick": null,
   "who": "work",
   "who_line": "Anyone who runs their own GitLab server, Community or Enterprise Edition.",
   "do": "Apply GitLab's latest security update to your self-run GitLab server.",
   "light": "act",
   "exploited": true,
   "score": 81.8,
   "vendor": "GitLab",
   "product": "Community Edition and Enterprise Edition",
   "added": "2026-10-29"
  },
  {
   "id": "CVE-2026-46300",
   "title": "A Linux flaw can let attackers run commands as root",
   "nick": null,
   "who": "work",
   "who_line": "Anyone running Linux servers. Reported as chained with the PHP flaws to plant web shells.",
   "do": "Install your Linux distribution's kernel update and reboot. Also patch PHP.",
   "light": "act",
   "exploited": true,
   "score": 80.1,
   "vendor": "Linux",
   "product": "Kernel",
   "added": "2026-10-28"
  },
  {
   "id": "CVE-2026-118527",
   "title": "Ivanti Connect Secure flaw lets a logged-in user plant files",
   "nick": null,
   "who": "work",
   "who_line": "Companies that use Ivanti Connect Secure for remote access. Used together with two other flaws.",
   "do": "Apply the vendor's mitigations and updates for Ivanti Connect Secure, covering all three linked flaws.",
   "light": "act",
   "exploited": true,
   "score": 78.4,
   "vendor": "Ivanti",
   "product": "Connect Secure",
   "added": "2026-10-30"
  },
  {
   "id": "CVE-2026-111357",
   "title": "Ivanti Connect Secure flaw lets a local user gain more power",
   "nick": null,
   "who": "work",
   "who_line": "Companies that use Ivanti Connect Secure for remote access. Used together with two other flaws.",
   "do": "Apply the vendor's mitigations and updates for Ivanti Connect Secure, covering all three linked flaws.",
   "light": "act",
   "exploited": true,
   "score": 78.4,
   "vendor": "Ivanti",
   "product": "Connect Secure",
   "added": "2026-10-30"
  },
  {
   "id": "CVE-2026-76418",
   "title": "A crafted request can make Cisco firewalls restart",
   "nick": null,
   "who": "work",
   "who_line": "Organizations using Cisco Secure Firewall ASA or FTD devices.",
   "do": "Apply Cisco's security update for your firewall and confirm the fix with Cisco's advisory.",
   "light": "act",
   "exploited": true,
   "score": 78.2,
   "vendor": "Cisco",
   "product": "Secure Firewall ASA Software and Cisco Secure FTD Software",
   "added": "2026-10-29"
  },
  {
   "id": "CVE-2026-98432",
   "title": "A Linux network flaw can crash servers or let attackers in",
   "nick": null,
   "who": "work",
   "who_line": "Anyone running Linux servers, including container hosts and Kubernetes nodes.",
   "do": "Install your Linux distribution's kernel update and reboot.",
   "light": "act",
   "exploited": false,
   "score": 76.2,
   "vendor": "",
   "product": "",
   "added": ""
  },
  {
   "id": "CVE-2026-88771",
   "title": "Attackers can run commands on Citrix NetScaler before login",
   "nick": null,
   "who": "work",
   "who_line": "Companies using Citrix NetScaler ADC or Gateway, including default setups.",
   "do": "Update NetScaler using Citrix's bulletin. If you may be hit, investigate as well.",
   "light": "act",
   "exploited": true,
   "score": 64.1,
   "vendor": "Citrix",
   "product": "NetScaler",
   "added": "2026-09-27"
  },
  {
   "id": "CVE-2026-48356",
   "title": "Attackers can upload a malicious file to Adobe Commerce stores",
   "nick": null,
   "who": "work",
   "who_line": "Online stores built on Adobe Commerce or Magento.",
   "do": "Apply Adobe's latest security update for Commerce or Magento.",
   "light": "act",
   "exploited": true,
   "score": 57.8,
   "vendor": "Adobe",
   "product": "Commerce and Magento",
   "added": "2026-10-27"
  },
  {
   "id": "CVE-2026-41709",
   "title": "A VMware ESX admin can act without leaving a log entry",
   "nick": null,
   "who": "work",
   "who_line": "Teams that run VMware ESX servers. An attacker would already need admin access.",
   "do": "Apply Broadcom's update for VMware ESX and review who holds admin access.",
   "light": "act",
   "exploited": true,
   "score": 57.3,
   "vendor": "Broadcom",
   "product": "VMware ESX",
   "added": "2026-10-28"
  },
  {
   "id": "CVE-2026-110447",
   "title": "Nextcloud's built in Collabora editor can be taken over",
   "nick": null,
   "who": "both",
   "who_line": "People who self host Nextcloud with the built in Collabora Online CODE server.",
   "do": "Update Collabora Online and Nextcloud to the latest versions.",
   "light": "act",
   "exploited": true,
   "score": 57.2,
   "vendor": "Collabora",
   "product": "Collabora Online \u2013 Built-in CODE Server",
   "added": "2026-10-23"
  },
  {
   "id": "CVE-2026-114625",
   "title": "A flaw lets attackers break into Arista VeloCloud Orchestrator",
   "nick": null,
   "who": "work",
   "who_line": "Companies that run Arista VeloCloud Orchestrator on their own servers.",
   "do": "Apply Arista's security update for VeloCloud Orchestrator.",
   "light": "act",
   "exploited": true,
   "score": 56.0,
   "vendor": "Arista",
   "product": "VeloCloud Orchestrator",
   "added": "2026-10-23"
  },
  {
   "id": "CVE-2026-21589",
   "title": "Attackers can read private files on Atlassian servers",
   "nick": null,
   "who": "work",
   "who_line": "Companies that run Jira, Confluence, Bitbucket or other Atlassian Data Center products.",
   "do": "Apply Atlassian's security update for your Data Center products.",
   "light": "act",
   "exploited": true,
   "score": 54.9,
   "vendor": "Atlassian",
   "product": "Multiple Products",
   "added": "2026-10-15"
  },
  {
   "id": "CVE-2026-96652",
   "title": "Plex Media Server can be forced to send data to attackers",
   "nick": null,
   "who": "both",
   "who_line": "People who run Plex Media Server. Used together with other Plex flaws.",
   "do": "Update Plex Media Server to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 54.7,
   "vendor": "Plex",
   "product": "Media Server",
   "added": "2026-10-20"
  },
  {
   "id": "CVE-2026-110936",
   "title": "A planted file can make Siemens Software Center run attacker code",
   "nick": null,
   "who": "work",
   "who_line": "Windows users and companies who use Siemens Software Center.",
   "do": "Apply Siemens' update for Software Center.",
   "light": "act",
   "exploited": true,
   "score": 54.7,
   "vendor": "Siemens",
   "product": "Software Center",
   "added": "2026-10-20"
  },
  {
   "id": "CVE-2026-106931",
   "title": "A flaw in SiteGuard Server Edition lets attackers run commands",
   "nick": null,
   "who": "work",
   "who_line": "Organizations using SiteGuard Server Edition to protect their websites.",
   "do": "Apply the vendor's update for SiteGuard Server Edition.",
   "light": "act",
   "exploited": true,
   "score": 53.8,
   "vendor": "EG Secure Solutions",
   "product": "SiteGuard Server Edition",
   "added": "2026-10-20"
  },
  {
   "id": "CVE-2026-96656",
   "title": "Plex Media Server flaw lets an admin write files that run",
   "nick": null,
   "who": "both",
   "who_line": "People who run Plex Media Server. Used together with three other Plex flaws.",
   "do": "Update Plex Media Server to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 53.8,
   "vendor": "Plex",
   "product": "Media Server",
   "added": "2026-10-20"
  },
  {
   "id": "CVE-2026-96655",
   "title": "Plex Media Server can be tricked into making outside requests",
   "nick": null,
   "who": "both",
   "who_line": "People who run Plex Media Server. Used together with other Plex flaws.",
   "do": "Update Plex Media Server to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 53.8,
   "vendor": "Plex",
   "product": "Media Server",
   "added": "2026-10-20"
  },
  {
   "id": "CVE-2026-96654",
   "title": "Plex Media Server flaw lets attackers call other plugins",
   "nick": null,
   "who": "both",
   "who_line": "People who run Plex Media Server. Used together with other Plex flaws.",
   "do": "Update Plex Media Server to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 53.8,
   "vendor": "Plex",
   "product": "Media Server",
   "added": "2026-10-20"
  },
  {
   "id": "CVE-2026-102764",
   "title": "Attackers can skip the login on BeyondTrust Remote Support",
   "nick": null,
   "who": "work",
   "who_line": "Companies using BeyondTrust Remote Support for IT help desks.",
   "do": "Apply BeyondTrust's update for Remote Support.",
   "light": "act",
   "exploited": true,
   "score": 53.8,
   "vendor": "BeyondTrust",
   "product": "Remote Support",
   "added": "2026-10-16"
  },
  {
   "id": "CVE-2026-63030",
   "title": "Hackers can take over WordPress sites through a web request",
   "nick": null,
   "who": "both",
   "who_line": "Anyone with a WordPress website, including small business sites.",
   "do": "Update WordPress to the latest version. Check: Dashboard > Updates.",
   "light": "act",
   "exploited": true,
   "score": 52.9,
   "vendor": "WordPress",
   "product": "Core",
   "added": "2026-07-21"
  },
  {
   "id": "CVE-2026-104935",
   "title": "Attackers can run commands on Ivanti Connect Secure before login",
   "nick": null,
   "who": "work",
   "who_line": "Companies that use Ivanti Connect Secure for remote access.",
   "do": "Apply the vendor's mitigations and updates for Ivanti Connect Secure.",
   "light": "act",
   "exploited": true,
   "score": 52.8,
   "vendor": "Ivanti",
   "product": "Connect Secure",
   "added": "2026-10-13"
  },
  {
   "id": "CVE-2025-61624",
   "title": "Fortinet admin accounts can write or delete any file",
   "nick": null,
   "who": "work",
   "who_line": "Companies using FortiOS, FortiPAM, FortiProxy or FortiSwitchManager.",
   "do": "Apply Fortinet's update for your products.",
   "light": "act",
   "exploited": true,
   "score": 52.0,
   "vendor": "Fortinet",
   "product": "Multiple Products",
   "added": "2026-10-16"
  },
  {
   "id": "CVE-2026-105134",
   "title": "A flaw lets attackers run commands on AhsayCBS backup servers",
   "nick": null,
   "who": "work",
   "who_line": "Organizations running AhsayCBS backup servers. Used together with another Ahsay flaw.",
   "do": "Apply Ahsay's update for AhsayCBS.",
   "light": "act",
   "exploited": true,
   "score": 52.0,
   "vendor": "Ahsay",
   "product": "AhsayCBS",
   "added": "2026-10-14"
  },
  {
   "id": "CVE-2026-76519",
   "title": "Cisco email security gateways let attackers write files",
   "nick": null,
   "who": "work",
   "who_line": "Organizations that filter email with a Cisco Secure Email Gateway.",
   "do": "Apply Cisco's security update for Secure Email Gateway.",
   "light": "act",
   "exploited": true,
   "score": 52.0,
   "vendor": "Cisco",
   "product": "Secure Email Gateway",
   "added": "2026-10-14"
  },
  {
   "id": "CVE-2015-3306",
   "title": "Old ProFTPD file servers let attackers read and write files",
   "nick": null,
   "who": "work",
   "who_line": "Anyone running an older ProFTPD file transfer server.",
   "do": "Update ProFTPD to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 51.9,
   "vendor": "ProFTPD",
   "product": "ProFTPD",
   "added": "2026-10-08"
  },
  {
   "id": "CVE-2026-60137",
   "title": "Hackers can inject database commands into WordPress sites",
   "nick": null,
   "who": "both",
   "who_line": "Anyone with a WordPress website, including small business sites.",
   "do": "Update WordPress to the latest version. Check: Dashboard > Updates.",
   "light": "act",
   "exploited": true,
   "score": 51.2,
   "vendor": "WordPress",
   "product": "Core",
   "added": "2026-07-21"
  },
  {
   "id": "CVE-2026-105133",
   "title": "Attackers can skip the login on AhsayCBS backup servers",
   "nick": null,
   "who": "work",
   "who_line": "Organizations running AhsayCBS backup servers. Used together with another Ahsay flaw.",
   "do": "Apply Ahsay's update for AhsayCBS.",
   "light": "act",
   "exploited": true,
   "score": 51.1,
   "vendor": "Ahsay",
   "product": "AhsayCBS",
   "added": "2026-10-14"
  },
  {
   "id": "CVE-2026-0322",
   "title": "Palo Alto firewalls can be taken over by a logged-in user",
   "nick": null,
   "who": "work",
   "who_line": "Organizations using Palo Alto Networks firewalls running PAN-OS.",
   "do": "Apply Palo Alto Networks' update for PAN-OS.",
   "light": "act",
   "exploited": true,
   "score": 51.1,
   "vendor": "Palo Alto Networks",
   "product": "PAN-OS",
   "added": "2026-10-14"
  },
  {
   "id": "CVE-2015-5477",
   "title": "Old BIND DNS servers can be knocked offline",
   "nick": null,
   "who": "work",
   "who_line": "Teams running older versions of the BIND DNS server.",
   "do": "Update BIND to a supported version.",
   "light": "act",
   "exploited": true,
   "score": 50.8,
   "vendor": "ISC",
   "product": "BIND",
   "added": "2026-10-08"
  },
  {
   "id": "CVE-2026-96951",
   "title": "A Windows flaw lets attackers get around a safety check",
   "nick": null,
   "who": "both",
   "who_line": "Anyone using Windows, at home or at work.",
   "do": "Run Windows Update, then restart your PC. Check: Settings > Windows Update.",
   "light": "act",
   "exploited": true,
   "score": 50.7,
   "vendor": "Microsoft",
   "product": "Windows",
   "added": "2026-10-13"
  },
  {
   "id": "CVE-2023-22894",
   "title": "Strapi admins can see private user details they should not",
   "nick": null,
   "who": "work",
   "who_line": "Teams that run websites on the Strapi content system. Old versions may be unsupported.",
   "do": "Update Strapi, or move off any version the vendor no longer supports.",
   "light": "act",
   "exploited": true,
   "score": 49.9,
   "vendor": "Strapi",
   "product": "Strapi",
   "added": "2026-10-08"
  },
  {
   "id": "CVE-2016-3081",
   "title": "Old Apache Struts websites can be taken over remotely",
   "nick": null,
   "who": "work",
   "who_line": "Companies running websites built on Apache Struts, especially older ones.",
   "do": "Update Apache Struts to a supported version and turn off Dynamic Method Invocation.",
   "light": "act",
   "exploited": true,
   "score": 48.4,
   "vendor": "Apache",
   "product": "Struts",
   "added": "2026-10-08"
  },
  {
   "id": "CVE-2021-3199",
   "title": "A flaw in ONLYOFFICE Docs can let attackers take over the server",
   "nick": null,
   "who": "work",
   "who_line": "Organizations that host ONLYOFFICE Docs for shared editing.",
   "do": "Update ONLYOFFICE Docs to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 48.4,
   "vendor": "ONLYOFFICE",
   "product": "Docs",
   "added": "2026-10-08"
  },
  {
   "id": "CVE-2026-104286",
   "title": "Attackers can plant files on Fortinet FortiMail servers",
   "nick": null,
   "who": "work",
   "who_line": "Organizations using Fortinet FortiMail for email security.",
   "do": "Apply Fortinet's update for FortiMail.",
   "light": "act",
   "exploited": true,
   "score": 47.7,
   "vendor": "Fortinet",
   "product": "FortiMail",
   "added": "2026-10-01"
  },
  {
   "id": "CVE-2026-102489",
   "title": "Zammad flaw lets attackers hijack a login session and run code",
   "nick": null,
   "who": "work",
   "who_line": "Teams that run their own Zammad help desk. Used together with another Zammad flaw.",
   "do": "Update Zammad to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 47.2,
   "vendor": "Zammad GmbH",
   "product": "Zammad",
   "added": "2026-10-02"
  },
  {
   "id": "CVE-2026-86950",
   "title": "A bad image file can take over an iPhone, iPad or Mac",
   "nick": null,
   "who": "everyday",
   "who_line": "Anyone with an iPhone, iPad or Mac.",
   "do": "Update to the latest iOS, iPadOS or macOS. Check: Settings > General > Software Update.",
   "light": "act",
   "exploited": true,
   "score": 47.0,
   "vendor": "Apple",
   "product": "Multiple Products",
   "added": "2026-09-29"
  },
  {
   "id": "CVE-2026-87902",
   "title": "Hackers can take over WordPress sites through a theme flaw",
   "nick": null,
   "who": "both",
   "who_line": "Anyone with a WordPress website, including small business sites.",
   "do": "Update WordPress to the latest version. Check: Dashboard > Updates.",
   "light": "act",
   "exploited": true,
   "score": 46.8,
   "vendor": "WordPress",
   "product": "Core",
   "added": "2026-09-25"
  },
  {
   "id": "CVE-2026-88779",
   "title": "A crafted request can knock Citrix NetScaler offline",
   "nick": null,
   "who": "work",
   "who_line": "Companies using Citrix NetScaler ADC or Gateway.",
   "do": "Apply Citrix's update for NetScaler.",
   "light": "act",
   "exploited": true,
   "score": 46.7,
   "vendor": "Citrix",
   "product": "NetScaler",
   "added": "2026-10-04"
  },
  {
   "id": "CVE-2026-76504",
   "title": "Attackers can get admin access to Cisco SD-WAN Manager",
   "nick": null,
   "who": "work",
   "who_line": "Companies managing their networks with Cisco Catalyst SD-WAN Manager.",
   "do": "Apply Cisco's security update for Catalyst SD-WAN Manager.",
   "light": "act",
   "exploited": true,
   "score": 46.7,
   "vendor": "Cisco",
   "product": "Catalyst SD-WAN Manager",
   "added": "2026-09-30"
  },
  {
   "id": "CVE-2026-102490",
   "title": "A Zammad server user can become the all powerful root user",
   "nick": null,
   "who": "work",
   "who_line": "Teams that run their own Zammad help desk. Used together with another Zammad flaw.",
   "do": "Update Zammad to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 45.8,
   "vendor": "Zammad GmbH",
   "product": "Zammad",
   "added": "2026-10-02"
  },
  {
   "id": "CVE-2026-88772",
   "title": "Citrix NetScaler flaw can crash or let attackers take over",
   "nick": null,
   "who": "work",
   "who_line": "Companies using Citrix NetScaler ADC or Gateway.",
   "do": "Apply Citrix's update for NetScaler.",
   "light": "act",
   "exploited": true,
   "score": 45.7,
   "vendor": "Citrix",
   "product": "NetScaler",
   "added": "2026-09-27"
  },
  {
   "id": "CVE-2026-67279",
   "title": "MikroTik routers can be tricked into running commands",
   "nick": null,
   "who": "both",
   "who_line": "Businesses and home users with a MikroTik router. Linked to another RouterOS flaw.",
   "do": "Update RouterOS to the latest version.",
   "light": "act",
   "exploited": true,
   "score": 44.5,
   "vendor": "MikroTik",
   "product": "RouterOS",
   "added": "2026-09-25"
  },
  {
   "id": "CVE-2026-5430",
   "title": "WSO2 flaw lets attackers upload files and take over servers",
   "nick": null,
   "who": "work",
   "who_line": "Companies using WSO2 API Manager and related products.",
   "do": "Apply WSO2's security update for your products.",
   "light": "act",
   "exploited": true,
   "score": 44.3,
   "vendor": "WSO2",
   "product": "Multiple Products",
   "added": "2026-09-24"
  },
  {
   "id": "CVE-2026-65660",
   "title": "A flaw in Microsoft SharePoint lets attackers run code",
   "nick": null,
   "who": "work",
   "who_line": "Organizations that run their own SharePoint servers.",
   "do": "Run Microsoft's latest SharePoint security update.",
   "light": "act",
   "exploited": true,
   "score": 44.1,
   "vendor": "Microsoft",
   "product": "SharePoint",
   "added": "2026-09-25"
  },
  {
   "id": "CVE-2026-71362",
   "title": "Attackers can reach private data in Adobe Commerce stores",
   "nick": null,
   "who": "work",
   "who_line": "Online stores built on Adobe Commerce or Magento.",
   "do": "Apply Adobe's latest security update for Commerce or Magento.",
   "light": "act",
   "exploited": true,
   "score": 43.7,
   "vendor": "Adobe",
   "product": "Commerce and Magento ",
   "added": "2026-09-24"
  },
  {
   "id": "CVE-2026-94127",
   "title": "F5 BIG-IP login systems can be taken over before login",
   "nick": null,
   "who": "work",
   "who_line": "Companies using F5 BIG-IP APM with an OAuth profile set up.",
   "do": "Apply F5's update for BIG-IP APM.",
   "light": "act",
   "exploited": true,
   "score": 42.8,
   "vendor": "F5",
   "product": "BIG-IP APM",
   "added": "2026-09-22"
  },
  {
   "id": "CVE-2026-93616",
   "title": "Check Point management servers let attackers run scripts",
   "nick": null,
   "who": "work",
   "who_line": "Organizations running Check Point management or log servers.",
   "do": "Apply Check Point's update for your management servers.",
   "light": "act",
   "exploited": true,
   "score": 42.8,
   "vendor": "Check Point",
   "product": "Multiple Products",
   "added": "2026-09-22"
  },
  {
   "id": "CVE-2026-85102",
   "title": "Check Point VPN gateways can be taken over remotely",
   "nick": null,
   "who": "work",
   "who_line": "Organizations using Check Point Security Gateway or Spark Firewall VPNs.",
   "do": "Apply Check Point's update for your gateway or Spark Firewall.",
   "light": "act",
   "exploited": true,
   "score": 42.2,
   "vendor": "Check Point",
   "product": "Multiple Products",
   "added": "2026-09-22"
  },
  {
   "id": "CVE-2026-93952",
   "title": "A flaw lets attackers break into Arista VeloCloud Orchestrator",
   "nick": null,
   "who": "work",
   "who_line": "Companies that run Arista VeloCloud Orchestrator on their own servers.",
   "do": "Apply Arista's security update for VeloCloud Orchestrator.",
   "light": "act",
   "exploited": true,
   "score": 41.3,
   "vendor": "Arista",
   "product": "VeloCloud Orchestrator",
   "added": "2026-09-22"
  },
  {
   "id": "CVE-2026-7273",
   "title": "Zyxel GS1900 switches can be taken over from the local network",
   "nick": null,
   "who": "both",
   "who_line": "Offices and homes with a Zyxel GS1900 series network switch.",
   "do": "Apply Zyxel's firmware update for your GS1900 switch.",
   "light": "act",
   "exploited": true,
   "score": 40.9,
   "vendor": "Zyxel",
   "product": "GS1900 Series Switches",
   "added": "2026-09-21"
  }
 ]
}