Live, refreshed every 15 minutes
Threat watch
The security flaws that matter to small businesses, with what’s being exploited right now first.
- in the last 60 days
- 73
- in the last 30 days
- 30
- on the busiest day, Sep 2
- 7
| Date | Exploited | Products |
|---|---|---|
| Oct 26 | 2 | PHP Group PHP, PHP Group PHP |
| Oct 23 | 2 | Arista VeloCloud Orchestrator, Collabora Collabora Online – Built-in CODE Server |
| Oct 20 | 6 | EG Secure Solutions SiteGuard Server Edition, Plex Media Server, Plex Media Server, Plex Media Server, Plex Media Server, Siemens Software Center |
| Oct 16 | 2 | BeyondTrust Remote Support, Fortinet Multiple Products |
| Oct 15 | 1 | Atlassian Multiple Products |
| Oct 14 | 4 | Ahsay AhsayCBS, Cisco Secure Email Gateway, Ahsay AhsayCBS, Palo Alto Networks PAN-OS |
| Oct 13 | 2 | Ivanti Connect Secure, Microsoft Windows |
| Oct 8 | 5 | ISC BIND, Apache Struts, Strapi Strapi, ONLYOFFICE Docs, ProFTPD ProFTPD |
| Oct 4 | 1 | Citrix NetScaler |
| Oct 2 | 2 | Zammad GmbH Zammad, Zammad GmbH Zammad |
| Oct 1 | 1 | Fortinet FortiMail |
| Sep 30 | 1 | Cisco Catalyst SD-WAN Manager |
| Sep 29 | 1 | Apple Multiple Products |
| Sep 27 | 2 | Citrix NetScaler, Citrix NetScaler |
| Sep 25 | 3 | MikroTik RouterOS, Microsoft SharePoint, WordPress Core |
| Sep 24 | 2 | WSO2 Multiple Products, Adobe Commerce and Magento |
| Sep 22 | 4 | Arista VeloCloud Orchestrator, F5 BIG-IP APM, Check Point Multiple Products, Check Point Multiple Products |
| Sep 21 | 1 | Zyxel GS1900 Series Switches |
| Sep 18 | 3 | Linux Kernel, Linux Kernel, Linux Kernel |
| Sep 16 | 3 | Google Pixel, Cisco Identity Services Engine, Acronis Backup |
| Sep 14 | 1 | Cisco Secure Email Gateway |
| Sep 11 | 4 | ConnectWise ScreenConnect, JFrog Artifactory, JFrog Artifactory, GitLab Community Edition and Enterprise Edition |
| Sep 10 | 2 | MikroTik RouterOS, MikroTik RouterOS |
| Sep 9 | 4 | Citrix NetScaler, Fortinet Multiple Products, Google Chromium V8, Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management |
| Sep 8 | 4 | Adobe Commerce and Magento, Microsoft Windows, N-able N-central, Microsoft Windows |
| Sep 4 | 1 | Google Chromium V8 |
| Sep 2 | 7 | BerriAI LiteLLM, Kludex Starlette, Kestra Kestra OSS, JFrog Artifactory, Sangoma Switchvox, SonicWall SMA1000 Appliances, SonicWall SMA1000 Appliances |
| Aug 31 | 2 | PaperCut NG/MF, PaperCut NG/MF |
Days not listed had no new confirmed exploits.
59 that affect small businesses
PHP2Shell: critical unauthenticated RCE in PHP core
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (QNAP shipped NAS firmware fixes Oct 24; other appliance vendors are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
Read the details →CVE-2026-109618 +1 · Oct 27
Tailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes
Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale has since confirmed the SSH issues as serious privilege-escalation bugs and says it is targeting a patched client release by the end of Oct 27; there is no CVE or fixed version yet. It is lateral movement from a foothold, not internet RCE.
pwn.watch · via pwn.watch
Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper
Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials.
CVE-2026-48356 +1 · via pwn.watch
More from the last 60 days
Node2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releases
Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4. On Oct 23 Aikido started calling the wider impact HTTP2Shell: the bug sits in Google Brotli itself, so other software that decodes Brotli needs its own update. Envoy published a critical advisory (GHSA-3wvj-j6qm-62mr) for deployments with a Brotli decompressor configured, fixed in 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio has the fix in 1.29.9, 1.30.6 and 1.31.2. On Oct 25 Microsoft shipped fixes for .NET (8.0.33, 9.0.22, 10.0.14, 11 RC3), Visual Studio 2019/2022/2026 and PowerShell 7.4/7.5/7.6. If you can't patch yet, disable Brotli decoding of untrusted data, and restart services or rebuild images after patching. On Oct 26 PHP shipped Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1, since the bundled decoder is reachable through cURL when automatic response decompression is on.
CVE-2026-111497 +9 · via pwn.watch
Echo Go framework: rejected WebSocket upgrades let requests bypass route-level auth in the Proxy middleware
Echo's Proxy middleware opened a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking whether the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection alive, later HTTP requests on that connection went straight to the upstream without passing through Echo's router or route-specific middleware, which can bypass authentication or authorization enforced only at Echo's routes. It needs an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. It affects the v4 and v5 release lines; upgrade to v4.16.1 or v5.4.1. GitHub rates it critical; no CVE id has been assigned yet.
pwn.watch · via pwn.watch
Laravel TokenGuard authentication bypass through non-string API credentials (CVE-2026-114509)
Laravel's built-in TokenGuard, when configured as a standard token-based API guard, can be bypassed to log in as an arbitrary existing user without their API token. On some database configurations (MySQL/MariaDB), a crafted non-string credential is mishandled during the lookup so the query matches an unintended user instead of failing. An unauthenticated attacker can take over accounts on any route protected by that guard. Upgrade laravel/framework to 12.68.0 or 13.29.0. GitHub rates it critical (CVSS 4.0 score 9.2).
CVE-2026-114509 · via pwn.watch
GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws
Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.
CVE-2026-115888 +4 · via pwn.watch
Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097)
Microsoft Authenticator on Android acts as the sign-in broker for Microsoft apps, and an exported activity in it handed out tokens without checking which app was really asking. A malicious app with zero permissions could claim to be an installed Microsoft app such as Teams and get that app's tokens for the work account signed into Authenticator. Enclave researcher Ofek Levin, who found it, says the tokens gave full delegated mailbox, files and calendar access, and that by posing as Authenticator itself an attacker could change the account's sign-in methods, including adding passkeys that keep access after the app is removed. It needs a malicious app installed on the phone. Microsoft fixed it in September 2026; update Authenticator for Android to 6.2606.4246 or later.
CVE-2026-80097 · via pwn.watch
Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772)
Citrix's CTX697096 bulletin fixes eight NetScaler ADC and Gateway bugs, two of them critical unauthenticated remote code execution zero-days exploited in the wild: CVE-2026-88771 (improper input validation, affects every deployment, no preconditions) and CVE-2026-88772 (memory overflow on appliances with DTLS enabled, which is the default on VPN virtual servers). Both score CVSS 4.0 9.5 and were added to CISA KEV on Sep 27. Attackers chain CVE-2026-88771 with the SAML crash CVE-2026-88779 to get root, plant PHP web shells and steal configs and keys, and exploitation was still being reported in late October. A follow-up SAML bug, CVE-2026-107406, needs newer builds (14.1-73.46 / 13.1-64.29). Patch, then run a compromise assessment: patching does not remove persistence.
CVE-2026-88771 +8 · via pwn.watch
FortiMail unauthenticated file-write zero-day CVE-2026-104286
Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).
CVE-2026-104286 · via pwn.watch
Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)
On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.
CVE-2026-96889 · via pwn.watch
Not sure if any of this affects you?
Threats from pwn.watch and cve.now; daily counts and exploited flags from CISA’s Known Exploited Vulnerabilities catalog. Summaries marked “via cve.now” are written by AI at cve.now and shared under CC BY 4.0. This product uses NVD data but is not endorsed or certified by the NVD. We pick the flaws that affect small businesses; it isn’t a complete list.