{"generated_at":"2026-11-04T10:27:59.060Z","items":[{"id":"MAL-2026-18527","url":"https://compromised.live/t/MAL-2026-18527","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in @lynnidoffc/baileys (npm)","summary":"Anyone who installed or ran this malicious package should assume an outside attacker has full control of the computer, with access to stored secrets and keys. Removing the package may not remove the malware. npm package @lynnidoffc/baileys, all versions. Rotate all secrets and keys stored on affected computers from a different, clean computer, remove the package, and treat the machine as fully compromised by rebuilding it if possible.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"@lynnidoffc/baileys","affected":"all versions || all versions","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-04T09:52:46.694Z"},{"id":"MAL-2026-18525","url":"https://compromised.live/t/MAL-2026-18525","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in blitzstrike (npm)","summary":"The npm package blitzstrike has malicious code that can give an outside attacker full control of any computer that installed it, along with access to stored secrets and keys. npm package blitzstrike, version 2.4.180. Remove the package, rotate all secrets and keys from a different computer, and rebuild the affected machine since removal may not clear the malware.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"blitzstrike","affected":"2.4.180","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-04T09:50:44.792Z"},{"id":"MAL-2026-18526","url":"https://compromised.live/t/MAL-2026-18526","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in nulio-connector (npm)","summary":"Malicious code in this npm package can give an attacker full control of any computer that installed it, and removing the package may not undo that damage. npm package nulio-connector, versions 1.1.10, 1.1.11 and 1.1.16. Treat any machine that installed these versions as fully compromised, rotate all secrets and keys from a different computer, rebuild the machine if possible, and check for signs of compromise.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"nulio-connector","affected":"1.1.16, 1.1.10, 1.1.11","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-04T09:50:44.792Z"},{"id":"GHSA-qwpw-cwrq-333j","url":"https://compromised.live/t/GHSA-qwpw-cwrq-333j","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in @ubedsockets/baileys (npm)","summary":"Malicious code secretly makes every victim's WhatsApp account follow attacker-controlled channels as soon as it connects, letting the attacker push content through those accounts. npm package @ubedsockets/baileys, all published versions; a trojanized fork of the Baileys WhatsApp library. Remove @ubedsockets/baileys now and switch to the legitimate @whiskeysockets/baileys, then check your WhatsApp channel follows and project logs for unexpected newsletter subscriptions.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"@ubedsockets/baileys","affected":"all versions","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-04T09:50:44.792Z","updated_at":"2026-11-04T09:50:44.792Z"},{"id":"MAL-2026-18517","url":"https://compromised.live/t/MAL-2026-18517","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in @atedone/workspace-context (npm)","summary":"The npm package contains malicious code that can run on a developer's machine and may let an attacker take over the system or steal data. The npm package @atedone/workspace-context, including versions 0.0.14 through 0.0.25 such as 0.0.15, 0.0.20, 0.0.22, 0.0.23, and 0.0.25. Remove the package from projects, pin away from these versions, and check for signs of compromise such as unexpected processes or credential changes.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"@atedone/workspace-context","affected":"0.0.23, 0.0.14, 0.0.25, 0.0.22, 0.0.20, 0.0.15, 0.0.19, 0.0.13, 0.0.12, 0.0.18, 0.0.21, 0.0.24, 0.0.16, 0.0.17","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-03T22:10:45.281Z"},{"id":"MAL-2026-18192","url":"https://compromised.live/t/MAL-2026-18192","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in agentic-awesome-skills (npm)","summary":"Attackers compromised this npm package and inserted malicious code, which can run on a developer's machine when the package is installed or used. npm package agentic-awesome-skills, including versions 18.9.0 through 19.9.0 and other listed releases. Remove the affected agentic-awesome-skills versions now, switch to a known clean release, and check for signs of compromise such as unexpected processes, new scripts, or credential theft.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"agentic-awesome-skills","affected":"19.0.0, 19.9.0, 19.6.0, 18.12.0, 18.9.0, 18.11.0, 19.4.0, 19.10.1, 18.14.0, 18.13.0, 19.0.1, 18.10.0, 19.2.0, 19.7.0, 19.1.0, 19.3.0, 19.5.0, 19.12.1, 19.13.0, 19.12.0, 18.15.0, 19.8.0, 19.11.0, 19.14.0, 19.15.0","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-03T22:10:45.281Z"},{"id":"MAL-2026-18193","url":"https://compromised.live/t/MAL-2026-18193","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in opencode-skills-collection (npm)","summary":"Malicious code was published inside this npm package, so anyone who installs it can have their system run attacker-controlled code. npm package opencode-skills-collection, including versions 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, and about 23 other versions. Remove opencode-skills-collection from all projects, pin away from every listed version, and check for signs of compromise on any system that installed it.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"opencode-skills-collection","affected":"4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.7, 4.1.17, 4.1.14, 4.1.19, 4.1.12, 4.0.56, 4.1.0, 4.0.77, 4.1.9, 4.1.18, 4.1.20, 4.1.2, 4.1.5, 4.1.31, 4.1.32, 4.1.30, 4.1.33, 4.1.22, 4.1.29","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-03T22:10:45.281Z"},{"id":"MAL-2026-18522","url":"https://compromised.live/t/MAL-2026-18522","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in dsh-moss-console (npm)","summary":"Malicious code was published inside this npm package, so installing it can let attackers run harmful code on the machine that installs it. npm package dsh-moss-console, version 3.3.0. Remove or downgrade dsh-moss-console 3.3.0 now, and check systems that installed it for signs of compromise.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"dsh-moss-console","affected":"3.3.0","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-03T22:10:45.281Z"},{"id":"CVE-2026-119977","url":"https://compromised.live/t/CVE-2026-119977","kind":"exploited_vuln","tier":1,"severity":"high","title":"WordPress WordPress Core: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","summary":"Attackers can exploit a timing flaw during WordPress core upgrades to run code on the server without logging in, and this is being actively exploited in the wild. WordPress core. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-11-03","due_date":"2026-11-06","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-118527","url":"https://compromised.live/t/CVE-2026-118527","kind":"exploited_vuln","tier":1,"severity":"high","title":"Ivanti Connect Secure: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","summary":"A remote attacker with a valid login can upload files with content they choose to a predictable spot on the disk, and attackers are actively exploiting this flaw. It can also be chained with two other flaws. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files on the appliance.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-30","due_date":"2026-11-13","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-111357","url":"https://compromised.live/t/CVE-2026-111357","kind":"exploited_vuln","tier":1,"severity":"high","title":"Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","summary":"An attacker who already has a login on Ivanti Connect Secure can skip a required check and gain higher privileges, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-30","due_date":"2026-11-02","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-97229","url":"https://compromised.live/t/CVE-2026-97229","kind":"exploited_vuln","tier":1,"severity":"high","title":"GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","summary":"An unauthenticated attacker can run arbitrary code on the GitLab server using a specially crafted regular expression in a CI/CD configuration; this flaw is being actively exploited. GitLab Community Edition and Enterprise Edition. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-29","due_date":"2026-11-01","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-76418","url":"https://compromised.live/t/CVE-2026-76418","kind":"exploited_vuln","tier":1,"severity":"high","title":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability","summary":"An unauthenticated remote attacker can crash the device by sending crafted traffic, causing it to reload unexpectedly and drop service; this flaw is being exploited in the wild. Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-29","due_date":"2026-11-01","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-41709","url":"https://compromised.live/t/CVE-2026-41709","kind":"exploited_vuln","tier":1,"severity":"high","title":"Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging Vulnerability","summary":"An attacker who already has admin access can carry out certain actions on the system without leaving a log entry, and this flaw is being actively exploited. Broadcom VMware ESX. Apply the vendor's mitigations or update now, and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-28","due_date":"2026-11-11","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-46300","url":"https://compromised.live/t/CVE-2026-46300","kind":"exploited_vuln","tier":1,"severity":"high","title":"Linux Kernel: Linux Kernel Missing Initialization of a Variable Vulnerability","summary":"Attackers can modify data cached in memory for files on the system, and chained with other flaws they can plant PHP webshells and run commands as root. Linux Kernel. Apply the vendor's update now and check for signs of compromise, such as unexpected PHP files or unknown root processes.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-28","due_date":"2026-10-31","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-48356","url":"https://compromised.live/t/CVE-2026-48356","kind":"exploited_vuln","tier":1,"severity":"high","title":"Adobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"Attackers can upload dangerous file types to the store and run their own code, potentially taking over accounts or sessions. This flaw is being actively exploited. Adobe Commerce and Magento. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files or unfamiliar admin activity.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-27","due_date":"2026-11-10","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-111497","url":"https://compromised.live/t/CVE-2026-111497","kind":"exploited_vuln","tier":1,"severity":"high","title":"Google Brotli: Google Brotli Unchecked Return Value Vulnerability","summary":"A remote attacker can send a specially crafted Brotli-compressed stream to corrupt memory, read sensitive memory contents, crash the program, or possibly run arbitrary code, and this flaw is being actively exploited. PyPI packages brotli (versions 1.0.3 up to 1.2.1) and brotlicffi (versions 1.0.3 up to 1.2.1.0). Upgrade brotli to 1.2.1 and brotlicffi to 1.2.1.0 now, and check for signs of compromise.","summary_source":"ai","affected":[{"ecosystem":"PyPI","package":"brotli","affected":">= 1.0.3 < 1.2.1","fixed":["1.2.1"]},{"ecosystem":"PyPI","package":"brotlicffi","affected":">= 1.0.3 < 1.2.1.0","fixed":["1.2.1.0"]}],"epss":null,"kev":{"date_added":"2026-10-27","due_date":"2026-11-10","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-109618","url":"https://compromised.live/t/CVE-2026-109618","kind":"exploited_vuln","tier":1,"severity":"high","title":"PHP Group PHP: PHP Memory Corruption Vulnerability","summary":"Attackers can run their own code on the server without logging in, due to a memory bug in PHP, and this flaw is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-26","due_date":"2026-10-29","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-109619","url":"https://compromised.live/t/CVE-2026-109619","kind":"exploited_vuln","tier":1,"severity":"high","title":"PHP Group PHP: PHP Stale Internal Request-State Vulnerability","summary":"An unauthenticated remote attacker can run arbitrary code on servers due to a stale request-state flaw, and this vulnerability is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-26","due_date":"2026-10-29","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-114625","url":"https://compromised.live/t/CVE-2026-114625","kind":"exploited_vuln","tier":1,"severity":"high","title":"Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator SQL Injection Vulnerability","summary":"Attackers can send specially crafted database queries to reach privileged internal functions and affect the orchestrator host, and this flaw is being actively exploited. Arista VeloCloud Orchestrator on-prem. Apply the vendor's mitigations or update now, and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-23","due_date":"2026-10-26","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-110447","url":"https://compromised.live/t/CVE-2026-110447","kind":"exploited_vuln","tier":1,"severity":"high","title":"Collabora Collabora Online – Built-in CODE Server: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","summary":"Attackers can run their own commands on the server remotely, because a flaw lets crafted input be passed to the operating system, and this is being actively exploited. Collabora Online built-in CODE Server, when used within the NextCloud platform. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-23","due_date":"2026-10-26","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"MAL-2026-17650","url":"https://compromised.live/t/MAL-2026-17650","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in tensorlake (npm)","summary":"Attackers have published malicious code inside this package, which can run harmful commands on any machine that installs it and may steal secrets or credentials. The npm package tensorlake, version 0.5.144. Remove or downgrade tensorlake 0.5.144 now, rotate any credentials on affected machines, and check for signs of compromise.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"tensorlake","affected":"0.5.144","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"MAL-2026-3514","url":"https://compromised.live/t/MAL-2026-3514","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in @tallyui/components (npm)","summary":"The npm package contains malicious code that can run on a developer's machine or build system once installed, potentially letting an attacker take control or steal data. npm package @tallyui/components, versions 1.0.1, 1.0.2 and 1.0.3. Remove these versions from your projects, pin to a known-safe release, and check for signs of compromise on any system that installed them.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"@tallyui/components","affected":"1.0.1, 1.0.2, 1.0.3","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-106931","url":"https://compromised.live/t/CVE-2026-106931","kind":"exploited_vuln","tier":2,"severity":"high","title":"EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","summary":"Attackers can run arbitrary operating system commands with root or SYSTEM privileges on the server, and this flaw is being actively exploited. EG Secure Solutions SiteGuard Server Edition. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-10-23","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-96656","url":"https://compromised.live/t/CVE-2026-96656","kind":"exploited_vuln","tier":2,"severity":"high","title":"Plex Media Server: Plex Media Server External Control of File Name or Path Vulnerability","summary":"An attacker who already has admin access can write arbitrary files to the server, and those files may run when loaded, letting them take control. This flaw is being exploited in the wild and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-10-23","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-96655","url":"https://compromised.live/t/CVE-2026-96655","kind":"exploited_vuln","tier":2,"severity":"high","title":"Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","summary":"An authenticated user can make the server send requests to internal or external addresses of their choosing, which is being actively exploited in attacks and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-11-03","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-96654","url":"https://compromised.live/t/CVE-2026-96654","kind":"exploited_vuln","tier":2,"severity":"high","title":"Plex Media Server: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","summary":"An attacker can exploit a web page flaw in Plex Media Server to call other plugin functions and supply their own inputs, and this is being actively exploited in the wild. Plex Media Server. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-10-23","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-96652","url":"https://compromised.live/t/CVE-2026-96652","kind":"exploited_vuln","tier":2,"severity":"high","title":"Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","summary":"An attacker with any valid-looking access token can make the Plex server send POST requests to a destination of their choosing, and this flaw is being actively exploited. Plex Media Server. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-11-03","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-110936","url":"https://compromised.live/t/CVE-2026-110936","kind":"exploited_vuln","tier":2,"severity":"high","title":"Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability","summary":"A logged-in local user can plant a specially crafted DLL file where the program looks for libraries, tricking it into running attacker code with the app's privileges; this is being exploited in the wild. Siemens Software Center. Apply the vendor's mitigations now and check for signs of compromise, such as unexpected DLL files in the application's search directories.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-11-03","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-102764","url":"https://compromised.live/t/CVE-2026-102764","kind":"exploited_vuln","tier":2,"severity":"high","title":"BeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","summary":"A remote attacker can bypass login by spoofing identity and then perform file operations on the appliance, and this flaw is being actively exploited. BeyondTrust Remote Support. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-16","due_date":"2026-10-19","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2025-61624","url":"https://compromised.live/t/CVE-2025-61624","kind":"exploited_vuln","tier":2,"severity":"high","title":"Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability","summary":"An attacker with admin-level login can use specific command-line commands to write or delete arbitrary files on the device, and this flaw is being actively exploited. Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Apply the vendor's fixes and mitigations now, and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-16","due_date":"2026-10-19","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-21589","url":"https://compromised.live/t/CVE-2026-21589","kind":"exploited_vuln","tier":2,"severity":"high","title":"Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","summary":"An unauthenticated attacker can access files inside the web application's root directory without logging in, and this flaw is being actively exploited. Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-15","due_date":"2026-10-18","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-105134","url":"https://compromised.live/t/CVE-2026-105134","kind":"exploited_vuln","tier":2,"severity":"high","title":"Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability","summary":"Attackers can run operating system commands on the server by tampering with a parameter in a web request, and this flaw is being actively exploited. Ahsay AhsayCBS. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-14","due_date":"2026-10-17","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-76519","url":"https://compromised.live/t/CVE-2026-76519","kind":"exploited_vuln","tier":2,"severity":"high","title":"Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability","summary":"An unauthenticated remote attacker can write arbitrary files onto the underlying operating system, and this flaw is being actively exploited. Cisco Secure Email Gateway. Apply the vendor's mitigations or update now, and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-14","due_date":"2026-10-17","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-105133","url":"https://compromised.live/t/CVE-2026-105133","kind":"exploited_vuln","tier":2,"severity":"high","title":"Ahsay AhsayCBS: Ahsay AhsayCBS Improper Authentication Vulnerability","summary":"A remote attacker can bypass login checks in AhsayCBS by manipulating a parameter sent to its API, and this flaw is being actively exploited in the wild. Ahsay AhsayCBS; no fixed versions are listed, so this applies to all AhsayCBS deployments. Apply the vendor's update now and check for signs of compromise, including unexpected admin logins or new accounts.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-14","due_date":"2026-10-17","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-0322","url":"https://compromised.live/t/CVE-2026-0322","kind":"exploited_vuln","tier":2,"severity":"high","title":"Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability","summary":"An authenticated attacker with network access can run arbitrary code with root privileges on the firewall, and this flaw is being exploited in the wild. Palo Alto Networks PAN-OS. Apply the vendor's mitigations and update now, and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-14","due_date":"2026-10-17","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-104935","url":"https://compromised.live/t/CVE-2026-104935","kind":"exploited_vuln","tier":2,"severity":"high","title":"Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","summary":"A remote attacker with no login can bypass authentication by spoofing and run arbitrary commands on the device, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's mitigations or update now, and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-13","due_date":"2026-10-16","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-96951","url":"https://compromised.live/t/CVE-2026-96951","kind":"exploited_vuln","tier":2,"severity":"high","title":"Microsoft Windows: Microsoft Windows Command Injection Vulnerability","summary":"An unauthorized attacker over a network can bypass a Windows security feature through a command injection flaw, and this flaw is being actively exploited. Microsoft Windows Shell. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-13","due_date":"2026-10-16","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2015-5477","url":"https://compromised.live/t/CVE-2015-5477","kind":"exploited_vuln","tier":2,"severity":"high","title":"ISC BIND:  ISC BIND Data Processing Errors Vulnerability","summary":"Remote attackers can crash the BIND DNS server by sending specially crafted TKEY queries, causing denial of service, and this flaw is being actively exploited. ISC BIND DNS server software. Apply the vendor's update now and check for signs of compromise, such as unexpected DNS server crashes or restarts.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-08","due_date":"2026-10-11","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2016-3081","url":"https://compromised.live/t/CVE-2016-3081","kind":"exploited_vuln","tier":2,"severity":"high","title":"Apache Struts: Apache Struts Command Injection Vulnerability","summary":"Remote attackers can run their own commands on servers through a crafted method: prefix when Dynamic Method Invocation is enabled, and this flaw is being actively exploited. Apache Struts, Maven org.apache.struts:struts2-core versions 2.3.20 through 2.3.28. Upgrade to fixed versions 2.3.20.3, 2.3.24.3, or 2.3.28.1 now, and check for signs of compromise.","summary_source":"ai","affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","affected":"2.3.20, 2.3.20.1, 2.3.24, 2.3.24.1, 2.3.28","fixed":["2.3.20.3","2.3.24.3","2.3.28.1"]}],"epss":null,"kev":{"date_added":"2026-10-08","due_date":"2026-10-11","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2023-22894","url":"https://compromised.live/t/CVE-2023-22894","kind":"exploited_vuln","tier":2,"severity":"high","title":"Strapi Strapi: Strapi Cleartext Storage of Sensitive Information Vulnerability","summary":"Attackers who can log into the Strapi admin panel can use query filters to read sensitive user details stored in cleartext, and it is being exploited in the wild and can be chained toward remote code execution. Strapi (npm package @strapi/strapi), versions 3.2.1 up to but not including 4.8.0. Upgrade @strapi/strapi to 4.8.0 or later now, and check for signs of compromise such as unexpected admin logins or unusual query activity.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"@strapi/strapi","affected":">= 3.2.1 < 4.8.0","fixed":["4.8.0"]}],"epss":null,"kev":{"date_added":"2026-10-08","due_date":"2026-10-11","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2021-3199","url":"https://compromised.live/t/CVE-2021-3199","kind":"exploited_vuln","tier":2,"severity":"high","title":"ONLYOFFICE Docs: ONLYOFFICE Docs Server Path Traversal Vulnerability","summary":"Attackers are actively exploiting a path traversal flaw, using a /.. sequence in an image upload parameter when JWT is enabled, which can lead to remote code execution on the server. ONLYOFFICE Docs Server, installations that use JWT. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-08","due_date":"2026-10-11","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2015-3306","url":"https://compromised.live/t/CVE-2015-3306","kind":"exploited_vuln","tier":2,"severity":"high","title":"ProFTPD ProFTPD: ProFTPD Improper Access Control Vulnerability","summary":"Remote attackers can read and write arbitrary files on the server through the site cpfr and site cpto commands, and this flaw is being actively exploited. ProFTPD (ProFTPD server; no versions given in the advisory). Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-08","due_date":"2026-10-11","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"},{"id":"CVE-2026-88779","url":"https://compromised.live/t/CVE-2026-88779","kind":"exploited_vuln","tier":2,"severity":"high","title":"Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"An attacker can crash Citrix NetScaler devices through a memory buffer bug, and this flaw is being actively exploited in the wild. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-04","due_date":"2026-10-07","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z"}]}