Active security threats right now

Exploited vulnerabilities and malicious packages from CISA KEV, EPSS and OSV, merged into one feed. Checked every 10 minutes. Not every CVE: only ones with evidence of attacks or malware, plus CVEs that EPSS predicts are likely to be exploited soon.

RSS Atom JSON Feed JSON API

MCP server for your agent

50+ active threats in the last 7 days

Newest signal first

ACT NOW

Compromised packageGHSA-q8jp-gq6p-hwpxnpm / @cherrydotfun/miniapp-sdk

Malicious code in @cherrydotfun/miniapp-sdk (npm)

Attackers planted malicious code in this npm package, so anyone who installed it may have had full control of their computer taken over, with secrets and keys exposed. npm package @cherrydotfun/miniapp-sdk, versions 0.1.22 and 0.1.23. Remove the package, rotate all secrets and keys from a different computer, and check for signs of compromise, since removal alone may not clean up the malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 6 · updated Nov 6

ACT NOW

Exploited vulnerabilityCVE-2026-19868SonicWall SonicOS SSLVPN

SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

An attacker with valid credentials for an alternate login method can bypass SAML sign-in controls and even skip SAML-enforced multi-factor authentication, and this flaw is being actively exploited. SonicWall SonicOS SSLVPN. Apply the vendor's update now and check for signs of compromise, such as unexpected VPN logins.

In CISA KEVFederal deadline Nov 20

Sources: CISA KEV · AI summary first seen Nov 6 · updated Nov 6

ACT NOW

Compromised packageMAL-2026-18193npm / opencode-skills-collection

Malicious code in opencode-skills-collection (npm)

Attackers can fully take over any computer that installed this package, and malicious code may keep running even after removal, exposing stored secrets and keys. npm package opencode-skills-collection, including versions 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, and many others. Rotate all secrets and keys from a different computer, then fully rebuild or reimage any machine that installed it rather than relying on removal alone.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 6

ACT NOW

Compromised packageGHSA-q7g7-jwp5-cvghnpm / synapse-hub

Malware in synapse-hub

Malicious code in this npm package gives an attacker full control of any computer that installed it, and they can steal secrets and keys stored there. npm package synapse-hub, versions 3.1.0, 3.1.1, 3.1.2, and 3.2.0. Remove the package, rotate all secrets and keys from a different computer, and treat the machine as fully compromised, since removal may not clean up all malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 5 · updated Nov 5

ACT NOW

Compromised packageGHSA-588x-qpg3-55p7npm / @denzz221/baileys

Malicious code in @denzz221/baileys (npm)

Anyone who installs this package gets their own WhatsApp account silently subscribed to a channel the publisher picked, using their logged-in session and without telling them. The attacker can use these hidden actions to push content and grow their audience through your account. npm package @denzz221/baileys, a malicious fork of the Baileys WhatsApp library, including versions 2.0.0, 7.0.0, 8.0.5, 8.0.6, 8.0.8, and 8.1.1, plus several others. Remove @denzz221/baileys from your projects, switch to the official Baileys package, review your WhatsApp channel subscriptions, and check for signs of compromise in your installed dependencies.

Hijacked release

Sources: OSV · AI summary first seen Nov 5 · updated Nov 5

ACT NOW

Compromised packageGHSA-hvrq-7pvp-2573npm / nminer

Malware in nminer

The npm package nminer contains malware that can give an outside attacker full control of any computer where it is installed or running, and removing it may not clean everything up. npm package nminer, version 3.0.0. Remove nminer 3.0.0 now, rebuild or treat the machine as fully compromised, and rotate all secrets and keys from a different computer.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-8hr2-m7vq-fhpgnpm / dsh-volcengine-provider

Malware in dsh-volcengine-provider

Malicious code in this npm package can give an attacker full control of any computer that installs it, letting them take secrets and keys stored there. npm package dsh-volcengine-provider, versions 0.2.3, 0.2.5, 0.2.8, and 0.2.11. Remove the package, rotate all secrets and keys from a different computer, and treat the machine as fully compromised, since removal may not clean up all malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Exploited vulnerabilityCVE-2026-111497PyPI / brotli, PyPI / brotlicffi +1

Google Brotli Unchecked Return Value Vulnerability

An attacker who sends specially crafted Brotli-compressed data can overflow a small decoder buffer, which can crash the process, leak memory contents, or potentially run arbitrary code. This flaw is being actively exploited. Google Brotli as used in Node.js (22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1), and PyPI packages brotli (before 1.2.1) and brotlicffi (before 1.2.1.0). Update Node.js to 22.23.4, 24.22.1, or 26.12.1, upgrade brotli to 1.2.1 and brotlicffi to 1.2.1.0, and check for signs of compromise.

In CISA KEVFederal deadline Nov 10

Sources: CISA KEV, Node.js, OSV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageGHSA-qg2p-28h9-mjw8npm / @cdmbase/wiki-browser

Malware in @cdmbase/wiki-browser

Malicious code in this npm package can give an attacker full control of any computer that installs it, and it may still run after removal. npm package @cdmbase/wiki-browser, version 12.0.18-alpha.53. Treat any machine that installed it as fully compromised, rotate all secrets and keys from a different computer, and remove the package while checking for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-7wfq-2q8j-q4xjnpm / @adminide-stack/yantra-help-browser

Malware in @adminide-stack/yantra-help-browser

Attackers can take full control of any computer that installed this malicious package, and can steal stored secrets and keys. Removing the package may not remove the malware. npm package @adminide-stack/yantra-help-browser, version 12.0.194. Rotate all secrets and keys from a different computer, remove the package, and check for signs of compromise, rebuilding the machine if in doubt.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-4rxj-jcfq-cpm2npm / cdeops

Malware in cdeops

Attackers planted malware in this package that gives them full control of any computer that installed it, so removing it may not undo the damage. npm package cdeops, version 13.5.31. Treat any machine that installed it as fully compromised: rotate all secrets and keys from a different computer, remove the package, and check for signs of compromise, since removal alone may not clean the malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-w4gc-9685-7pr8npm / @adminide-stack/health-api-server

Malware in @adminide-stack/health-api-server

This malicious npm package gives attackers full control of any computer that installed it, so they can steal stored secrets and keys. Removing the package may not remove the malware. npm package @adminide-stack/health-api-server, version 0.0.18-alpha.465. Rotate all secrets and keys from a different computer, then rebuild or reimage the affected machine instead of relying on removal.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-phqq-85q5-xmqmnpm / @adminide-stack/client-redux

Malware in @adminide-stack/client-redux

A malicious npm package gives attackers full control of any computer that installed it, so they can take any secrets and keys stored there. Removing the package may not undo the damage. npm package @adminide-stack/client-redux, versions 0.0.16-18. Rotate all secrets and keys from a different computer, remove the package, and check for signs of compromise, since removal alone may not clean the system.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-ff5p-vgj6-cjcpnpm / @adminide-stack/user-activity-browser

Malware in @adminide-stack/user-activity-browser

Malicious code in this npm package can fully take over any computer that installed it, and attackers may keep control even after removal. npm package @adminide-stack/user-activity-browser, versions 0.0.16 through 0.0.129 and 1.1.3-alpha.114. Treat any machine that installed it as compromised: rotate all secrets and keys from a different computer, remove the package, and rebuild affected systems rather than relying on removal alone.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-7gx8-qvpw-82h6npm / @adminide-stack/utils

Malware in @adminide-stack/utils

Malicious code in this npm package can give an attacker full control of any computer that installed it, letting them steal secrets and keys. npm package @adminide-stack/utils, versions 0.0.16 through 0.0.130. Treat any affected machine as fully compromised, rotate all secrets and keys from a different computer, remove the package, and rebuild the machine if possible since removal may not clear the malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

HEADS-UP

Runtime security releasenodejs-november-2026-security-releasesNode.js

Security releases for 26.x, 24.x, 22.x on Wednesday, November 11, 2026

The Node.js project will release fixes for the 26.x, 24.x, 22.x release lines on or shortly after Wednesday, November 11, 2026. The highest severity is HIGH. End-of-life lines are always affected. Fixed versions appear here on release day.

Sources: Node.js first seen Nov 4 · updated Nov 4

HEADS-UP

Runtime security releasenodejs-october-2026-security-releasesNode.js / node

Security releases of Wednesday, October 21, 2026, 10 fixes

Node.js released 22.23.4, 24.22.1, 26.12.1 with 10 security fixes, highest severity HIGH. CVE-2026-111497 is known to be exploited and listed separately. Upgrade to the fixed release for your line.

Sources: Node.js first seen Nov 4 · updated Nov 4

ACT NOW

Exploited vulnerabilityCVE-2026-119977WordPress Core

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

Attackers can exploit a race condition during WordPress core upgrades to run code on the server without logging in, and this flaw is being actively exploited. WordPress Core. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 6 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Exploited vulnerabilityCVE-2024-27834Apple Multiple Products

Apple Multiple Products Improper Authentication Vulnerability

An attacker who already has arbitrary read and write access to memory can bypass pointer authentication, a security feature that protects against memory-corruption attacks. This flaw is being actively exploited. Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 18

Sources: CISA KEV · AI summary first seen Nov 4 · updated Nov 4

WATCH

Exploited vulnerabilityCVE-2026-110447Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

An attacker can run arbitrary commands on the server remotely, and this flaw is being actively exploited in the wild. Collabora Online Built-in CODE Server, when used within the NextCloud platform. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 26 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 4

WATCH

Exploited vulnerabilityCVE-2026-105134AhsayCBS

Ahsay AhsayCBS Command Injection Vulnerability

A remote attacker can run operating system commands on the server by tampering with a parameter in a web request, and this flaw is being actively exploited in attacks. Ahsay AhsayCBS. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 17 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 4

WATCH

Exploited vulnerabilityCVE-2026-105133AhsayCBS

Ahsay AhsayCBS Improper Authentication Vulnerability

A remote attacker can bypass login authentication on the Ahsay CBS server by manipulating a parameter in its API, and this flaw is being actively exploited in the wild. Ahsay AhsayCBS (no versions specified in the advisory). Apply the vendor's update now and check for signs of compromise, since the flaw can be chained with CVE-2026-105134.

In CISA KEVFederal deadline Oct 17 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 4

WATCH

Exploited vulnerabilityCVE-2023-22894npm / @strapi/strapi

Strapi Cleartext Storage of Sensitive Information Vulnerability

Attackers who can log into the Strapi admin panel can read sensitive user details in cleartext through the query filter, and this flaw is being actively exploited, sometimes chained with CVE-2023-22621 for remote code execution. npm package @strapi/strapi, versions 3.2.1 up to but not including 4.8.0. Upgrade @strapi/strapi to 4.8.0 now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 11 passed

Sources: CISA KEV, OSV · AI summary first seen Nov 3 · updated Nov 4

WATCH

Exploited vulnerabilityCVE-2015-3306ProFTPD

ProFTPD Improper Access Control Vulnerability

Remote attackers can read and write arbitrary files on the server using the site cpfr and site cpto commands, and this flaw is being actively exploited. ProFTPD FTP server (no versions given). Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 11 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageGHSA-r5hx-v68j-8w57npm / @realvare/based

Malware in @realvare/based

Installing or running this package hands full control of the computer to an outside attacker, who can take any secrets and keys stored there. Removing it may not remove everything the malware left behind. npm package @realvare/based, all versions. Treat any machine that installed it as fully compromised, rotate all secrets and keys from a different computer, remove the package, and check for signs of compromise such as unknown processes or persistence.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-38rp-mcrj-j69mnpm / @ai-ecoverse/slicc-windows-amd64

Malware in @ai-ecoverse/slicc-windows-amd64

Malicious code in this npm package can give an attacker full control of any computer that installed it, so secrets and keys on that machine may be stolen. npm package @ai-ecoverse/slicc-windows-amd64, version 1.46.4. Rebuild or reinstall the affected machine if possible, rotate all secrets and keys from a different computer, and remove the package, knowing removal may not clear all malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageGHSA-q2mc-9hgr-vmx2npm / screenshot-desktop

Malware in screenshot-desktop

An attacker can take full control of a computer where this package is installed, so any secrets or keys on it may be stolen. The package is malicious and removing it may not remove everything it installed. npm package screenshot-desktop, version 1.16.0. Treat any machine with it as fully compromised, rotate all secrets and keys from a different computer, remove the package, and check for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageMAL-2026-18527npm / @lynnidoffc/baileys

Malicious code in @lynnidoffc/baileys (npm)

Anyone who installed or ran this malicious package should assume an outside attacker has full control of the computer, with access to stored secrets and keys. Removing the package may not remove the malware. npm package @lynnidoffc/baileys, all versions. Rotate all secrets and keys stored on affected computers from a different, clean computer, remove the package, and treat the machine as fully compromised by rebuilding it if possible.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageMAL-2026-18525npm / blitzstrike

Malicious code in blitzstrike (npm)

The npm package blitzstrike has malicious code that can give an outside attacker full control of any computer that installed it, along with access to stored secrets and keys. npm package blitzstrike, version 2.4.180. Remove the package, rotate all secrets and keys from a different computer, and rebuild the affected machine since removal may not clear the malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageMAL-2026-18526npm / nulio-connector

Malicious code in nulio-connector (npm)

Malicious code in this npm package can give an attacker full control of any computer that installed it, and removing the package may not undo that damage. npm package nulio-connector, versions 1.1.10, 1.1.11 and 1.1.16. Treat any machine that installed these versions as fully compromised, rotate all secrets and keys from a different computer, rebuild the machine if possible, and check for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageGHSA-qwpw-cwrq-333jnpm / @ubedsockets/baileys

Malicious code in @ubedsockets/baileys (npm)

Malicious code secretly makes every victim's WhatsApp account follow attacker-controlled channels as soon as it connects, letting the attacker push content through those accounts. npm package @ubedsockets/baileys, all published versions; a trojanized fork of the Baileys WhatsApp library. Remove @ubedsockets/baileys now and switch to the legitimate @whiskeysockets/baileys, then check your WhatsApp channel follows and project logs for unexpected newsletter subscriptions.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageMAL-2026-18517npm / @atedone/workspace-context

Malicious code in @atedone/workspace-context (npm)

The npm package contains malicious code that can run on a developer's machine and may let an attacker take over the system or steal data. The npm package @atedone/workspace-context, including versions 0.0.14 through 0.0.25 such as 0.0.15, 0.0.20, 0.0.22, 0.0.23, and 0.0.25. Remove the package from projects, pin away from these versions, and check for signs of compromise such as unexpected processes or credential changes.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-18192npm / agentic-awesome-skills

Malicious code in agentic-awesome-skills (npm)

Attackers compromised this npm package and inserted malicious code, which can run on a developer's machine when the package is installed or used. npm package agentic-awesome-skills, including versions 18.9.0 through 19.9.0 and other listed releases. Remove the affected agentic-awesome-skills versions now, switch to a known clean release, and check for signs of compromise such as unexpected processes, new scripts, or credential theft.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-18522npm / dsh-moss-console

Malicious code in dsh-moss-console (npm)

Malicious code was published inside this npm package, so installing it can let attackers run harmful code on the machine that installs it. npm package dsh-moss-console, version 3.3.0. Remove or downgrade dsh-moss-console 3.3.0 now, and check systems that installed it for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-118527Ivanti Connect Secure

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

A remote attacker with a valid login can upload files with content they choose to a predictable spot on the disk, and attackers are actively exploiting this flaw. It can also be chained with two other flaws. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files on the appliance.

In CISA KEVFederal deadline Nov 13

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-111357Ivanti Connect Secure

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

An attacker who already has a login on Ivanti Connect Secure can skip a required check and gain higher privileges, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 2 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-97229GitLab Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

An unauthenticated attacker can run arbitrary code on the GitLab server using a specially crafted regular expression in a CI/CD configuration; this flaw is being actively exploited. GitLab Community Edition and Enterprise Edition. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 1 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

An unauthenticated remote attacker can crash the device by sending crafted traffic, causing it to reload unexpectedly and drop service; this flaw is being exploited in the wild. Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 1 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-41709Broadcom VMware ESX

Broadcom VMWare ESX Insufficient Logging Vulnerability

An attacker who already has admin access can carry out certain actions on the system without leaving a log entry, and this flaw is being actively exploited. Broadcom VMware ESX. Apply the vendor's mitigations or update now, and check for signs of compromise.

In CISA KEVFederal deadline Nov 11

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-46300Linux Kernel

Linux Kernel Missing Initialization of a Variable Vulnerability

Attackers can modify data cached in memory for files on the system, and chained with other flaws they can plant PHP webshells and run commands as root. Linux Kernel. Apply the vendor's update now and check for signs of compromise, such as unexpected PHP files or unknown root processes.

In CISA KEVFederal deadline Oct 31 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-48356Adobe Commerce and Magento

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Attackers can upload dangerous file types to the store and run their own code, potentially taking over accounts or sessions. This flaw is being actively exploited. Adobe Commerce and Magento. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files or unfamiliar admin activity.

In CISA KEVFederal deadline Nov 10

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-109618PHP Group PHP

PHP Memory Corruption Vulnerability

Attackers can run their own code on the server without logging in, due to a memory bug in PHP, and this flaw is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 29 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-109619PHP Group PHP

PHP Stale Internal Request-State Vulnerability

An unauthenticated remote attacker can run arbitrary code on servers due to a stale request-state flaw, and this vulnerability is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 29 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-17650npm / tensorlake

Malicious code in tensorlake (npm)

Attackers have published malicious code inside this package, which can run harmful commands on any machine that installs it and may steal secrets or credentials. The npm package tensorlake, version 0.5.144. Remove or downgrade tensorlake 0.5.144 now, rotate any credentials on affected machines, and check for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-3514npm / @tallyui/components

Malicious code in @tallyui/components (npm)

The npm package contains malicious code that can run on a developer's machine or build system once installed, potentially letting an attacker take control or steal data. npm package @tallyui/components, versions 1.0.1, 1.0.2 and 1.0.3. Remove these versions from your projects, pin to a known-safe release, and check for signs of compromise on any system that installed them.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-114625Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Attackers can send specially crafted database queries to reach privileged internal functions and affect the orchestrator host, and this flaw is being actively exploited. Arista VeloCloud Orchestrator on-prem. Apply the vendor's mitigations or update now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 26 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-106931EG Secure Solutions SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Attackers can run arbitrary operating system commands with root or SYSTEM privileges on the server, and this flaw is being actively exploited. EG Secure Solutions SiteGuard Server Edition. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 23 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96656Plex Media Server

Plex Media Server External Control of File Name or Path Vulnerability

An attacker who already has admin access can write arbitrary files to the server, and those files may run when loaded, letting them take control. This flaw is being exploited in the wild and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 23 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96655Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

An authenticated user can make the server send requests to internal or external addresses of their choosing, which is being actively exploited in attacks and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 3 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96654Plex Media Server

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

An attacker can exploit a web page flaw in Plex Media Server to call other plugin functions and supply their own inputs, and this is being actively exploited in the wild. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 23 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

Bulk malware in the last 7 days: 390 on npm, 63 on PyPI and 8 on RubyGems. Mostly typosquats with no real users, so they stay out of the main list. Dependency checks still catch them. Show all 461

Summaries are written by AI from the linked sources and regenerated when a source changes.