{"generated":"2026-11-08T11:51:47.961Z","changes":[{"incident":"vmware-aria-command-injection-mar-2026","at":"2026-11-03","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"At this review, Broadcom's Telco guidance lists Aria Operations 8.18.6 upgrade paths for TCI 2.x/3.x and TCP 3.x/4.x/5.x. It directs unlisted versions to support; its affected-environment list also includes TCP 2.5 and 2.7.","url":"https://knowledge.broadcom.com/external/article/428241","by":"Broadcom","patch":"partial","title":"VMware Aria Operations command injection CVE-2026-22719 used in attacks","severity":"high","category":"patch","now":"partial","page":"https://hard.fyi/live/vmware-aria-command-injection-mar-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2026-08-25","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Craft disclosed a related route to code execution requiring a logged-in editor with access to an asset library. Its separate advisory lists Craft CMS 5 releases before 5.10.12 as affected and 5.10.12 as patched.","url":"https://github.com/craftcms/cms/security/advisories/GHSA-9wcj-wqqh-cqvg","by":"Craft CMS","patch":null,"title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2026-07-09","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Australia’s ACSC included CVE-2025-32432 among flaws exploited in a global website-compromise campaign affecting Australian businesses. Attackers were installing backdoors on web servers.","url":"https://www.cyber.gov.au/alert/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms","by":"Australian Cyber Security Centre","patch":null,"title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"langflow-public-flow-code-execution-mar-2026","at":"2026-06-30","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"The Hacker News reported Trend Micro’s findings of Monero-mining attacks exploiting this flaw between 27 March and 15 April. The malware also attempted to spread to other computers using SSH keys.","url":"https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html","by":"The Hacker News","patch":null,"title":"Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/langflow-public-flow-code-execution-mar-2026/"},{"incident":"laravel-livewire-code-injection-attacks-mar-2026","at":"2026-06-23","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Imperva reported stolen credentials from 6,167 distinct applications across multiple countries and sectors. The attackers’ infrastructure held more than 1,850 database dumps and email lists containing over 26 million addresses.","url":"https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/","by":"Imperva","patch":null,"title":"Laravel Livewire code-execution flaw CVE-2025-54068 exploited for credential theft","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/laravel-livewire-code-injection-attacks-mar-2026/"},{"incident":"laravel-livewire-code-injection-attacks-mar-2026","at":"2026-06-03","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Italy’s CSIRT warned of active exploitation and urged operators to update vulnerable installations.","url":"https://csirt.regione.toscana.it/livewire-sfruttamento-attivo-in-rete-della-cve-2025-54068-al01-260603-csirt-ita/","by":"CSIRT Toscana, republishing CSIRT Italia","patch":null,"title":"Laravel Livewire code-execution flaw CVE-2025-54068 exploited for credential theft","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/laravel-livewire-code-injection-attacks-mar-2026/"},{"incident":"forticlient-ems-login-bypass-apr-2026","at":"2026-05-27","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Arctic Wolf reported May attacks that used the flaw to distribute EKZ credential-stealing malware through managed computers. The malware collected browser passwords, session cookies and autofill information, including card details.","url":"https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/","by":"Arctic Wolf","patch":null,"title":"FortiClient EMS login bypass CVE-2026-35616 exploited to spread credential-stealing malware","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/forticlient-ems-login-bypass-apr-2026/"},{"incident":"laravel-livewire-code-injection-attacks-mar-2026","at":"2026-05-24","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Imperva observed and blocked attacks against Laravel Livewire applications. Its subsequent investigation connected the traffic to a campaign stealing application credentials.","url":"https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/","by":"Imperva","patch":null,"title":"Laravel Livewire code-execution flaw CVE-2025-54068 exploited for credential theft","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/laravel-livewire-code-injection-attacks-mar-2026/"},{"incident":"gnu-inetutils-telnet-login-bypass-jan-2026","at":"2026-04-29","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"GNU released Inetutils 2.8 with the authentication-bypass fix. BleepingComputer had described 2.8 as already available in January, but GNU's release announcement dates the stable release to 29 April.","url":"https://seclists.org/oss-sec/2026/q2/289","by":"GNU release announcement, reproduced on oss-security","patch":"patched","title":"GNU Inetutils Telnet server password bypass CVE-2026-24061 exploited; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/gnu-inetutils-telnet-login-bypass-jan-2026/"},{"incident":"langflow-public-flow-code-execution-mar-2026","at":"2026-04-14","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Langflow released stable version 1.9.0, the version its advisory identifies as fixing this flaw. The package was also published on PyPI that day.","url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.0","by":"Langflow","patch":"patched","title":"Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/langflow-public-flow-code-execution-mar-2026/"},{"incident":"forticlient-ems-login-bypass-apr-2026","at":"2026-04-10","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Fortinet re-released the fixed 7.4.7 version as build 2194.M to address an upgrade problem that could cause data loss. Customers who had successfully installed build 2193.M did not need another upgrade.","url":"https://docs.fortinet.com/document/forticlient/7.4.7/ems-release-notes/915559","by":"Fortinet","patch":"patched","title":"FortiClient EMS login bypass CVE-2026-35616 exploited to spread credential-stealing malware","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/forticlient-ems-login-bypass-apr-2026/"},{"incident":"forticlient-ems-login-bypass-apr-2026","at":"2026-04-06","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-35616 to its Known Exploited Vulnerabilities catalogue.","url":"https://it.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the","by":"Tenable","patch":null,"title":"FortiClient EMS login bypass CVE-2026-35616 exploited to spread credential-stealing malware","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/forticlient-ems-login-bypass-apr-2026/"},{"incident":"forticlient-ems-login-bypass-apr-2026","at":"2026-04-04","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Fortinet disclosed CVE-2026-35616, confirmed exploitation and provided hotfixes for FortiClient EMS 7.4.5 and 7.4.6. The regular 7.4.7 release was still forthcoming.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-099","by":"Fortinet","patch":"partial","title":"FortiClient EMS login bypass CVE-2026-35616 exploited to spread credential-stealing malware","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/forticlient-ems-login-bypass-apr-2026/"},{"incident":"forticlient-ems-login-bypass-apr-2026","at":"2026-03-31","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Defused reported the flaw to Fortinet after observing attacks, according to Arctic Wolf’s later account.","url":"https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/","by":"Arctic Wolf","patch":null,"title":"FortiClient EMS login bypass CVE-2026-35616 exploited to spread credential-stealing malware","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/forticlient-ems-login-bypass-apr-2026/"},{"incident":"citrix-netscaler-memory-disclosure-mar-2026","at":"2026-03-31","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"BleepingComputer reported that CISA required US federal civilian agencies to secure affected appliances by 2 April. The number of vulnerable or compromised appliances remained unknown.","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-citrix-flaw-by-thursday/","by":"BleepingComputer","patch":null,"title":"Citrix NetScaler memory disclosure flaw CVE-2026-3055 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/citrix-netscaler-memory-disclosure-mar-2026/"},{"incident":"citrix-netscaler-memory-disclosure-mar-2026","at":"2026-03-30","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities catalogue.","url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-267","by":"Canadian Centre for Cyber Security","patch":null,"title":"Citrix NetScaler memory disclosure flaw CVE-2026-3055 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/citrix-netscaler-memory-disclosure-mar-2026/"},{"incident":"citrix-netscaler-memory-disclosure-mar-2026","at":"2026-03-27","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Exploitation was observed from this date, according to research subsequently cited by Canada's Cyber Centre.","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-006-vulnerability-impacting-citrix-netscaler-adc-netscaler-gateway-cve-2026-3055","by":"Canadian Centre for Cyber Security","patch":null,"title":"Citrix NetScaler memory disclosure flaw CVE-2026-3055 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/citrix-netscaler-memory-disclosure-mar-2026/"},{"incident":"langflow-public-flow-code-execution-mar-2026","at":"2026-03-26","added":"2026-11-03T22:24:44.025Z","kind":"fix-incomplete","text":"JFrog confirmed that 1.8.2 remained vulnerable in both Python packages and official Docker images, despite earlier fix claims. The fix worked in a nightly build, but stable 1.9.0 was still unreleased.","url":"https://research.jfrog.com/post/langflow-latest-version-was-not-fixed/","by":"JFrog","patch":"partial","title":"Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/langflow-public-flow-code-execution-mar-2026/"},{"incident":"langflow-public-flow-code-execution-mar-2026","at":"2026-03-25","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-33017 to its Known Exploited Vulnerabilities catalogue, with an 8 April remediation deadline for US federal civilian agencies.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null,"title":"Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/langflow-public-flow-code-execution-mar-2026/"},{"incident":"citrix-netscaler-memory-disclosure-mar-2026","at":"2026-03-23","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Citrix revised its affected-version guidance and confirmed that 14.1-60.58 also fixes the flaw, alongside 14.1-66.59.","url":"https://support.citrix.com/external/article/CTX696300/netscaler-adc-and-netscaler-gateway-secu.html","by":"Citrix","patch":null,"title":"Citrix NetScaler memory disclosure flaw CVE-2026-3055 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/citrix-netscaler-memory-disclosure-mar-2026/"},{"incident":"citrix-netscaler-memory-disclosure-mar-2026","at":"2026-03-23","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Citrix disclosed CVE-2026-3055 and published fixed releases. The flaw affects appliances configured as SAML identity providers.","url":"https://support.citrix.com/external/article/CTX696300/netscaler-adc-and-netscaler-gateway-secu.html","by":"Citrix","patch":"patched","title":"Citrix NetScaler memory disclosure flaw CVE-2026-3055 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/citrix-netscaler-memory-disclosure-mar-2026/"},{"incident":"laravel-livewire-code-injection-attacks-mar-2026","at":"2026-03-20","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set an April 3 remediation deadline for covered US federal agencies.","url":"https://nvd.nist.gov/vuln/detail/cve-2025-54068","by":"NVD","patch":null,"title":"Laravel Livewire code-execution flaw CVE-2025-54068 exploited for credential theft","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/laravel-livewire-code-injection-attacks-mar-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2026-03-20","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities catalogue, as subsequently confirmed by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/craft-cms-security-advisory-av25-300","by":"Canadian Centre for Cyber Security","patch":null,"title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"langflow-public-flow-code-execution-mar-2026","at":"2026-03-18T16:04Z","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Sysdig observed the first exploitation attempt against its decoy servers, followed by credential harvesting later that day. It recorded attacks from six source IP addresses within 48 hours of disclosure.","url":"https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours","by":"Sysdig","patch":null,"title":"Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/langflow-public-flow-code-execution-mar-2026/"},{"incident":"langflow-public-flow-code-execution-mar-2026","at":"2026-03-16","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Langflow’s advisory disclosed unauthenticated code execution through public flow building. GitHub dates publication to 16 March; Sysdig’s subsequent report gives 17 March.","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx","by":"Langflow","patch":null,"title":"Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/langflow-public-flow-code-execution-mar-2026/"},{"incident":"vmware-aria-command-injection-mar-2026","at":"2026-03-04","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Reporting identified no public details about the attackers, victims or scale of exploitation.","url":"https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html","by":"The Hacker News","patch":null,"title":"VMware Aria Operations command injection CVE-2026-22719 used in attacks","severity":"high","category":"patch","now":"partial","page":"https://hard.fyi/live/vmware-aria-command-injection-mar-2026/"},{"incident":"vmware-aria-command-injection-mar-2026","at":"2026-03-03","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Broadcom updated its advisory to acknowledge reports of exploitation, while saying it could not independently confirm them.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947","by":"Broadcom","patch":null,"title":"VMware Aria Operations command injection CVE-2026-22719 used in attacks","severity":"high","category":"patch","now":"partial","page":"https://hard.fyi/live/vmware-aria-command-injection-mar-2026/"},{"incident":"vmware-aria-command-injection-mar-2026","at":"2026-03-03","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-22719 to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to address it by 24 March.","url":"https://www.bleepingcomputer.com/news/security/cisa-flags-vmware-aria-operations-rce-flaw-as-exploited-in-attacks/","by":"BleepingComputer","patch":null,"title":"VMware Aria Operations command injection CVE-2026-22719 used in attacks","severity":"high","category":"patch","now":"partial","page":"https://hard.fyi/live/vmware-aria-command-injection-mar-2026/"},{"incident":"cisco-sdwan-path-traversal-attacks-feb-2026","at":"2026-02-25T20:29Z","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Cisco updated its advisory to acknowledge attempted exploitation during February 2026 and renewed its recommendation to upgrade.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF","by":"Cisco","patch":null,"title":"Cisco SD-WAN privilege-escalation flaw CVE-2022-20775 used in attacks","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/cisco-sdwan-path-traversal-attacks-feb-2026/"},{"incident":"cisco-sdwan-path-traversal-attacks-feb-2026","at":"2026-02-25","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Cisco Talos reported that UAT-8616 used the flaw to obtain root access after a separate SD-WAN authentication bypass. The wider campaign's activity dated back to at least 2023; Talos did not date this flaw's first use separately.","url":"https://blog.talosintelligence.com/uat-8616-sd-wan/","by":"Cisco Talos","patch":null,"title":"Cisco SD-WAN privilege-escalation flaw CVE-2022-20775 used in attacks","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/cisco-sdwan-path-traversal-attacks-feb-2026/"},{"incident":"cisco-sdwan-path-traversal-attacks-feb-2026","at":"2026-02-25","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2022-20775 to its Known Exploited Vulnerabilities catalogue, with a 27 February deadline for US federal civilian agencies to act.","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20775","by":"NIST","patch":null,"title":"Cisco SD-WAN privilege-escalation flaw CVE-2022-20775 used in attacks","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/cisco-sdwan-path-traversal-attacks-feb-2026/"},{"incident":"vmware-aria-command-injection-mar-2026","at":"2026-02-24","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Broadcom disclosed CVE-2026-22719 and published fixes. The flaw allows commands to run without a login while support-assisted product migration is under way.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947","by":"Broadcom","patch":"partial","title":"VMware Aria Operations command injection CVE-2026-22719 used in attacks","severity":"high","category":"patch","now":"partial","page":"https://hard.fyi/live/vmware-aria-command-injection-mar-2026/"},{"incident":"zimbra-webex-ssrf-exploited-feb-2026","at":"2026-02-19","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Check Point published a Security Gateway protection advisory for detecting attempts to exploit this flaw. This additional protection did not replace Zimbra’s existing software fix.","url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2020-4652.html","by":"Check Point","patch":null,"title":"Zimbra WebEx request-forgery flaw CVE-2020-7796 used in attacks; fixed since 2020","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/zimbra-webex-ssrf-exploited-feb-2026/"},{"incident":"zimbra-webex-ssrf-exploited-feb-2026","at":"2026-02-17","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2020-7796 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","patch":null,"title":"Zimbra WebEx request-forgery flaw CVE-2020-7796 used in attacks; fixed since 2020","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/zimbra-webex-ssrf-exploited-feb-2026/"},{"incident":"solarwinds-help-desk-bypass-attacks-feb-2026","at":"2026-02-13","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"The Record reported that US federal civilian agencies had until 15 February to patch this flaw, following CISA's unusually short remediation deadline.","url":"https://therecord.media/cisa-orders-federal-agencies-to-patch-solarwinds-microsoft-apple-bugs","by":"The Record","patch":null,"title":"SolarWinds Web Help Desk security bypass CVE-2025-40536 used in attacks; fix available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/solarwinds-help-desk-bypass-attacks-feb-2026/"},{"incident":"solarwinds-help-desk-bypass-attacks-feb-2026","at":"2026-02-12","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2025-40536 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. The Canadian Centre for Cyber Security recorded the addition in its updated advisory.","url":"https://www.cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-063-update-1","by":"Canadian Centre for Cyber Security","patch":null,"title":"SolarWinds Web Help Desk security bypass CVE-2025-40536 used in attacks; fix available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/solarwinds-help-desk-bypass-attacks-feb-2026/"},{"incident":"solarwinds-help-desk-bypass-attacks-feb-2026","at":"2026-02-06","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Microsoft reported December 2025 intrusions through exposed Web Help Desk servers, followed by credential theft and movement into other systems. It could not confirm which vulnerability provided access, so these attacks cannot be attributed specifically to CVE-2025-40536.","url":"https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","by":"Microsoft","patch":null,"title":"SolarWinds Web Help Desk security bypass CVE-2025-40536 used in attacks; fix available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/solarwinds-help-desk-bypass-attacks-feb-2026/"},{"incident":"gitlab-ci-lint-ssrf-attacks-feb-2026","at":"2026-02-03","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2021-39935 to its Known Exploited Vulnerabilities catalogue based on evidence of active exploitation. US federal civilian agencies were given until 24 February to remediate.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40778cf","by":"CISA","patch":null,"title":"GitLab server-request flaw CVE-2021-39935 used in attacks; fixes available since 2021","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gitlab-ci-lint-ssrf-attacks-feb-2026/"},{"incident":"solarwinds-help-desk-bypass-attacks-feb-2026","at":"2026-01-28","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"SolarWinds released Web Help Desk 2026.1, fixing CVE-2025-40536. Its advisory identifies 12.8.8 HF1 and all earlier versions as affected.","url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40536","by":"SolarWinds","patch":"patched","title":"SolarWinds Web Help Desk security bypass CVE-2025-40536 used in attacks; fix available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/solarwinds-help-desk-bypass-attacks-feb-2026/"},{"incident":"gnu-inetutils-telnet-login-bypass-jan-2026","at":"2026-01-26","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-24061 to its Known Exploited Vulnerabilities catalogue, with a 16 February remediation deadline for US federal civilian agencies. Its entry does not establish whether ransomware campaigns used it.","url":"https://db.gcve.eu/known-exploited-vulnerabilities-catalog/ce9ee6df-b43d-4c0b-b17f-7704049f6646","by":"GCVE, reproducing CISA's entry","patch":null,"title":"GNU Inetutils Telnet server password bypass CVE-2026-24061 exploited; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/gnu-inetutils-telnet-login-bypass-jan-2026/"},{"incident":"vmware-vcenter-code-execution-attacks-jan-2026","at":"2026-01-24","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Reporting on the exploitation warning said the attackers, method of exploitation and scale of attacks were unknown.","url":"https://thehackernews.com/2026/01/cisa-adds-actively-exploited-vmware.html","by":"The Hacker News","patch":null,"title":"VMware vCenter Server code-execution flaw CVE-2024-37079 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/vmware-vcenter-code-execution-attacks-jan-2026/"},{"incident":"gogs-path-traversal-attacks-jan-2026","at":"2026-01-23","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Gogs released stable version 0.13.4, including the fix for code execution through its repository file-update API.","url":"https://github.com/gogs/gogs/releases/tag/v0.13.4","by":"Gogs","patch":"patched","title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/"},{"incident":"vmware-vcenter-code-execution-attacks-jan-2026","at":"2026-01-23","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Broadcom revised its advisory to report information suggesting CVE-2024-37079 had been exploited. The revision retained the existing fixes.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453","by":"Broadcom","patch":null,"title":"VMware vCenter Server code-execution flaw CVE-2024-37079 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/vmware-vcenter-code-execution-attacks-jan-2026/"},{"incident":"vmware-vcenter-code-execution-attacks-jan-2026","at":"2026-01-23","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2024-37079 to its Known Exploited Vulnerabilities catalogue, with a 13 February remediation deadline for US federal civilian agencies.","url":"https://www.bleepingcomputer.com/news/security/cisa-says-critical-vmware-rce-flaw-now-actively-exploited/","by":"BleepingComputer","patch":null,"title":"VMware vCenter Server code-execution flaw CVE-2024-37079 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/vmware-vcenter-code-execution-attacks-jan-2026/"},{"incident":"gnu-inetutils-telnet-login-bypass-jan-2026","at":"2026-01-22","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"GreyNoise reported 60 attack sessions from 18 source IP addresses on 21–22 January against its monitoring systems. Some attackers obtained administrator access and attempted to install malware or retain access.","url":"https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html","by":"GreyNoise","patch":null,"title":"GNU Inetutils Telnet server password bypass CVE-2026-24061 exploited; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/gnu-inetutils-telnet-login-bypass-jan-2026/"},{"incident":"gnu-inetutils-telnet-login-bypass-jan-2026","at":"2026-01-20","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"GNU disclosed a password bypass in the Telnet server in Inetutils 1.9.3–2.7 and supplied two source patches. It recommended disabling the server or restricting access while applying the fix.","url":"https://seclists.org/oss-sec/2026/q1/89","by":"GNU (Simon Josefsson), archived by SecLists","patch":"partial","title":"GNU Inetutils Telnet server password bypass CVE-2026-24061 exploited; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/gnu-inetutils-telnet-login-bypass-jan-2026/"},{"incident":"gogs-path-traversal-attacks-jan-2026","at":"2026-01-12","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2025-8110 to its exploited-vulnerabilities catalogue, setting a 2 February deadline for US federal civilian agencies. BleepingComputer reported code patches were available; the stable fixed release followed later.","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-gogs-rce-flaw-exploited-in-zero-day-attacks/","by":"BleepingComputer","patch":"partial","title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/"},{"incident":"gogs-path-traversal-attacks-jan-2026","at":"2025-12-10","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Wiz publicly disclosed CVE-2025-8110, reporting more than 700 compromised Gogs servers. No fix was available at disclosure.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":"none","title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/"},{"incident":"gogs-path-traversal-attacks-jan-2026","at":"2025-11-01","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Wiz observed a second wave of attacks.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":null,"title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/"},{"incident":"gogs-path-traversal-attacks-jan-2026","at":"2025-10-30","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Gogs maintainers acknowledged Wiz's report.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":null,"title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/"},{"incident":"gogs-path-traversal-attacks-jan-2026","at":"2025-07-17","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Wiz privately reported the vulnerability to Gogs maintainers.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":null,"title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/"},{"incident":"laravel-livewire-code-injection-attacks-mar-2026","at":"2025-07-17","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Livewire disclosed CVE-2025-54068 and confirmed a fix in 3.6.4. Certain Livewire 3 configurations allow remote attackers to run commands without logging in.","url":"https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3","by":"Livewire","patch":"patched","title":"Laravel Livewire code-execution flaw CVE-2025-54068 exploited for credential theft","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/laravel-livewire-code-injection-attacks-mar-2026/"},{"incident":"gogs-path-traversal-attacks-jan-2026","at":"2025-07-10","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Wiz first observed evidence of attacks exploiting the Gogs flaw, months before public disclosure.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":"none","title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2025-04-24","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Craft published its GitHub security advisory for CVE-2025-32432, identifying affected releases across Craft CMS 3, 4 and 5 and rating the flaw critical.","url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3","by":"Craft CMS","patch":null,"title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2025-04-17","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Craft found evidence suggesting exploitation and emailed potentially affected licence holders, urging updates.","url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","by":"Craft CMS","patch":null,"title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2025-04-10","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Craft released versions 3.9.15, 4.14.15 and 5.6.17 with an application-level fix, marking the updates as critical.","url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","by":"Craft CMS","patch":"patched","title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2025-04-07","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Craft received the vulnerability report and confirmed that its software was affected.","url":"https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432","by":"Craft CMS","patch":null,"title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"zimbra-webex-ssrf-exploited-feb-2026","at":"2025-03-11","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"GreyNoise reported exploitation attempts against CVE-2020-7796 during a surge observed on 9 March. About 400 source IP addresses targeted multiple request-forgery flaws; that total was not specific to Zimbra.","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","patch":null,"title":"Zimbra WebEx request-forgery flaw CVE-2020-7796 used in attacks; fixed since 2020","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/zimbra-webex-ssrf-exploited-feb-2026/"},{"incident":"gitlab-ci-lint-ssrf-attacks-feb-2026","at":"2025-03-09","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"GreyNoise observed a surge of server-side request forgery attempts, including CVE-2021-39935. Its report counted about 400 attacking IP addresses across multiple flaws, not GitLab alone.","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","patch":null,"title":"GitLab server-request flaw CVE-2021-39935 used in attacks; fixes available since 2021","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gitlab-ci-lint-ssrf-attacks-feb-2026/"},{"incident":"craft-cms-code-execution-mar-2026","at":"2025-02-14","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Orange Cyberdefense dates a confirmed Craft CMS server compromise to 14 February 2025, before fixes were available.","url":"https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/","by":"Orange Cyberdefense SensePost","patch":"none","title":"Craft CMS code-execution flaw CVE-2025-32432 exploited; fixes available since April 2025","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/craft-cms-code-execution-mar-2026/"},{"incident":"zimbra-webex-ssrf-exploited-feb-2026","at":"2024-12-31","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Zimbra 8.8.15 reached the end of technical guidance, its final listed support milestone.","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases","by":"Zimbra","patch":null,"title":"Zimbra WebEx request-forgery flaw CVE-2020-7796 used in attacks; fixed since 2020","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/zimbra-webex-ssrf-exploited-feb-2026/"},{"incident":"vmware-vcenter-code-execution-attacks-jan-2026","at":"2024-06-17","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"VMware disclosed CVE-2024-37079 and released vCenter Server fixes in 8.0 U2d, 8.0 U1e and 7.0 U3r. Cloud Foundation deployments also received a patch route.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453","by":"Broadcom","patch":"patched","title":"VMware vCenter Server code-execution flaw CVE-2024-37079 used in attacks; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/vmware-vcenter-code-execution-attacks-jan-2026/"},{"incident":"cisco-sdwan-path-traversal-attacks-feb-2026","at":"2022-09-29","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Cisco corrected the first fixed 20.6 release from 20.6.4 to 20.6.3.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF","by":"Cisco","patch":null,"title":"Cisco SD-WAN privilege-escalation flaw CVE-2022-20775 used in attacks","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/cisco-sdwan-path-traversal-attacks-feb-2026/"},{"incident":"cisco-sdwan-path-traversal-attacks-feb-2026","at":"2022-09-28","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Cisco disclosed CVE-2022-20775 and published fixed-release information. The flaw lets an authenticated local attacker gain root privileges.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF","by":"Cisco","patch":"patched","title":"Cisco SD-WAN privilege-escalation flaw CVE-2022-20775 used in attacks","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/cisco-sdwan-path-traversal-attacks-feb-2026/"},{"incident":"gitlab-ci-lint-ssrf-attacks-feb-2026","at":"2021-12-06","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"GitLab released security updates 14.3.6, 14.4.4 and 14.5.2. These are the first fixed versions for CVE-2021-39935 in their respective release branches.","url":"https://forum.gitlab.com/t/gitlab-security-release-14-5-2-14-4-4-and-14-3-6-backport-to-13-x/62532","by":"GitLab Forum","patch":"patched","title":"GitLab server-request flaw CVE-2021-39935 used in attacks; fixes available since 2021","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/gitlab-ci-lint-ssrf-attacks-feb-2026/"},{"incident":"zimbra-webex-ssrf-exploited-feb-2026","at":"2020-02-12","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Zimbra released 8.8.15 Patch 7, fixing CVE-2020-7796. The flaw requires the WebEx zimlet add-on to be installed and zimlet JSP to be enabled.","url":"https://blog.zimbra.com/2020/02/new-zimbra-8-8-15-james-prescott-joule-patch-7/","by":"Zimbra","patch":"patched","title":"Zimbra WebEx request-forgery flaw CVE-2020-7796 used in attacks; fixed since 2020","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/zimbra-webex-ssrf-exploited-feb-2026/"},{"incident":"roundcube-webmail-exploited-flaws-feb-2026","at":"2026-07-10","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"Canada’s Cyber Centre updated its alert to highlight reported ongoing exploitation of CVE-2025-49113. It urged organisations to update Roundcube and monitor for signs of compromise.","url":"https://www.cyber.gc.ca/en/alerts-advisories/vulnerability-impacting-roundcube-webmail-cve-2025-49113","by":"Canadian Centre for Cyber Security","patch":null,"title":"Roundcube Webmail flaws CVE-2025-49113 and CVE-2025-68461 used in attacks; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/roundcube-webmail-exploited-flaws-feb-2026/"},{"incident":"roundcube-webmail-exploited-flaws-feb-2026","at":"2026-07-07","added":"2026-11-03T22:23:55.101Z","kind":"wider-attacks","text":"Proofpoint reported attacks observed since May against physics and engineering departments at US and Canadian universities, using CVE-2025-49113 after a separate, older browser scripting flaw. Attackers stole credentials and installed backdoors; Proofpoint coordinated notification of identified victims.","url":"https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation","by":"Proofpoint","patch":null,"title":"Roundcube Webmail flaws CVE-2025-49113 and CVE-2025-68461 used in attacks; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/roundcube-webmail-exploited-flaws-feb-2026/"},{"incident":"soliton-filezen-command-injection-feb-2026","at":"2026-03-31","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"FileZen V5.0 and the ST82 physical and virtual appliances reached their listed limited-support end date. The available vulnerability fix does not extend the product's support life.","url":"https://www.soliton.co.jp/support/support_eos_product.html","by":"Soliton Systems","patch":null,"title":"Soliton FileZen command-injection flaw CVE-2026-25108 exploited; fix available, product support ended","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/soliton-filezen-command-injection-feb-2026/"},{"incident":"dell-recoverpoint-hardcoded-credentials-feb-2026","at":"2026-03-18","added":"2026-11-03T22:23:55.101Z","kind":"vendor-revised","text":"Dell's script guidance was last updated on this date. It says the procedure must be repeated after reimaging appliances running 6.0 SP3 P1 or older, and applied to newly deployed appliances on those versions.","url":"https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa","by":"Dell","patch":null,"title":"Dell RecoverPoint for Virtual Machines hard-coded password flaw CVE-2026-22769 exploited","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/dell-recoverpoint-hardcoded-credentials-feb-2026/"},{"incident":"ivanti-epm-credential-leak-feb-2026","at":"2026-03-11","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"NHS England warned organisations about the confirmed exploitation, assessed further attacks as highly likely and urged them to apply Ivanti’s update.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4752","by":"NHS England","patch":null,"title":"Ivanti Endpoint Manager credential-leaking login bypass CVE-2026-1603 used in attacks; fixed in SU5","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/ivanti-epm-credential-leak-feb-2026/"},{"incident":"ivanti-epm-credential-leak-feb-2026","at":"2026-03-10","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"BleepingComputer reported that Ivanti had received no exploitation reports when contacted on 9 March, despite CISA’s finding. Public details of the attacks were unavailable.","url":"https://www.bleepingcomputer.com/news/security/cisa-recently-patched-ivanti-epm-flaw-now-actively-exploited/","by":"BleepingComputer","patch":null,"title":"Ivanti Endpoint Manager credential-leaking login bypass CVE-2026-1603 used in attacks; fixed in SU5","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/ivanti-epm-credential-leak-feb-2026/"},{"incident":"ivanti-epm-credential-leak-feb-2026","at":"2026-03-09","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2026-1603 to its Known Exploited Vulnerabilities catalogue. Canada’s Cyber Centre updated its alert and urged administrators to apply the updates.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-113","by":"Canadian Centre for Cyber Security","patch":null,"title":"Ivanti Endpoint Manager credential-leaking login bypass CVE-2026-1603 used in attacks; fixed in SU5","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/ivanti-epm-credential-leak-feb-2026/"},{"incident":"teamt5-threatsonar-upload-attacks-feb-2026","at":"2026-02-24","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"TeamT5 told SecurityWeek the attacks occurred in 2024, affected a few customers and prompted notification and remediation assistance. It attributed them with uncertainty to Chinese groups it calls Slime57 and Slime62.","url":"https://www.securityweek.com/taiwan-security-firm-confirms-flaw-flagged-by-cisa-likely-exploited-by-chinese-apt/","by":"SecurityWeek","patch":null,"title":"TeamT5 ThreatSonar Anti-Ransomware upload flaw CVE-2024-7694 exploited; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/teamt5-threatsonar-upload-attacks-feb-2026/"},{"incident":"soliton-filezen-command-injection-feb-2026","at":"2026-02-24","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2026-25108 to its Known Exploited Vulnerabilities catalogue, setting a 17 March remediation deadline for US federal civilian agencies. Its entry lists ransomware use as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null,"title":"Soliton FileZen command-injection flaw CVE-2026-25108 exploited; fix available, product support ended","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/soliton-filezen-command-injection-feb-2026/"},{"incident":"teamt5-threatsonar-upload-attacks-feb-2026","at":"2026-02-22","added":"2026-11-03T22:23:55.101Z","kind":"vendor-revised","text":"TeamT5 said it had helped all affected customers update and that no customer systems remained in service with the affected release.","url":"https://teamt5.org/en/posts/team-t5-cisa-kev/","by":"TeamT5","patch":null,"title":"TeamT5 ThreatSonar Anti-Ransomware upload flaw CVE-2024-7694 exploited; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/teamt5-threatsonar-upload-attacks-feb-2026/"},{"incident":"roundcube-webmail-exploited-flaws-feb-2026","at":"2026-02-20","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added both flaws to its Known Exploited Vulnerabilities catalogue, confirming their use in attacks. US federal civilian agencies were given until 13 March to address them.","url":"https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html","by":"The Hacker News","patch":null,"title":"Roundcube Webmail flaws CVE-2025-49113 and CVE-2025-68461 used in attacks; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/roundcube-webmail-exploited-flaws-feb-2026/"},{"incident":"dell-recoverpoint-hardcoded-credentials-feb-2026","at":"2026-02-18","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2026-22769 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/dell-security-advisory-av26-138","by":"Canadian Centre for Cyber Security","patch":null,"title":"Dell RecoverPoint for Virtual Machines hard-coded password flaw CVE-2026-22769 exploited","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/dell-recoverpoint-hardcoded-credentials-feb-2026/"},{"incident":"teamt5-threatsonar-upload-attacks-feb-2026","at":"2026-02-17","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2024-7694 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","patch":null,"title":"TeamT5 ThreatSonar Anti-Ransomware upload flaw CVE-2024-7694 exploited; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/teamt5-threatsonar-upload-attacks-feb-2026/"},{"incident":"dell-recoverpoint-hardcoded-credentials-feb-2026","at":"2026-02-17","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Dell published DSA-2026-079, confirming limited active exploitation and providing fixed release 6.0.3.1 HF1 or a remediation script.","url":"https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079","by":"Dell","patch":"patched","title":"Dell RecoverPoint for Virtual Machines hard-coded password flaw CVE-2026-22769 exploited","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/dell-recoverpoint-hardcoded-credentials-feb-2026/"},{"incident":"dell-recoverpoint-hardcoded-credentials-feb-2026","at":"2026-02-17","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"Mandiant disclosed CVE-2026-22769, reporting exploitation by suspected China-linked group UNC6201 since at least mid-2024. Attackers installed persistent backdoors, replacing BRICKSTORM with GRIMBOLT in September 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day","by":"Google Threat Intelligence Group / Mandiant","patch":null,"title":"Dell RecoverPoint for Virtual Machines hard-coded password flaw CVE-2026-22769 exploited","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/dell-recoverpoint-hardcoded-credentials-feb-2026/"},{"incident":"soliton-filezen-command-injection-feb-2026","at":"2026-02-13","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"Soliton and JVN publicly disclosed the flaw, with attacks already observed. Affected versions are V4.2.1–V4.2.8 and V5.0.0–V5.0.10; FileZen S is unaffected.","url":"https://jvn.jp/en/jp/JVN84622767/","by":"JVN","patch":null,"title":"Soliton FileZen command-injection flaw CVE-2026-25108 exploited; fix available, product support ended","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/soliton-filezen-command-injection-feb-2026/"},{"incident":"ivanti-epm-credential-leak-feb-2026","at":"2026-02-10","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Ivanti’s published CVE record identified EPM versions before 2024 SU5 as vulnerable and marked 2024 SU5 as unaffected. The flaw lets someone without a login obtain certain stored credentials remotely.","url":"https://cve.circl.lu/vuln/cve-2026-1603","by":"Ivanti, via CIRCL Vulnerability-Lookup","patch":"patched","title":"Ivanti Endpoint Manager credential-leaking login bypass CVE-2026-1603 used in attacks; fixed in SU5","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/ivanti-epm-credential-leak-feb-2026/"},{"incident":"ivanti-epm-credential-leak-feb-2026","at":"2026-02-09","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"According to Canada’s Cyber Centre, Ivanti published its EPM advisory on 9 February, covering EPM 2024 SU4 SR1 and earlier.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-113","by":"Canadian Centre for Cyber Security","patch":null,"title":"Ivanti Endpoint Manager credential-leaking login bypass CVE-2026-1603 used in attacks; fixed in SU5","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/ivanti-epm-credential-leak-feb-2026/"},{"incident":"hpe-oneview-code-injection-attacks-jan-2026","at":"2026-01-16","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"HPE told Techzine it had received no direct customer reports of exploitation and said attackers needed access to the customer's network. This differed from Check Point's independently observed attack activity; neither report established a total of successfully compromised appliances.","url":"https://www.techzine.eu/news/security/138004/rondodox-botnet-exploits-hpe-oneview-vulnerability-on-a-massive-scale/","by":"Techzine, quoting HPE","patch":null,"title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/"},{"incident":"hpe-oneview-code-injection-attacks-jan-2026","at":"2026-01-15","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"HPE released an enhanced hotfix, according to its subsequent statement to Techzine.","url":"https://www.techzine.eu/news/security/138004/rondodox-botnet-exploits-hpe-oneview-vulnerability-on-a-massive-scale/","by":"Techzine, quoting HPE","patch":"patched","title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/"},{"incident":"soliton-filezen-command-injection-feb-2026","at":"2026-01-13","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Soliton released FileZen V5.0.11, fixing the command-injection flaw later assigned CVE-2026-25108.","url":"https://www.soliton.co.jp/support/2026/006657.html","by":"Soliton Systems","patch":"patched","title":"Soliton FileZen command-injection flaw CVE-2026-25108 exploited; fix available, product support ended","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/soliton-filezen-command-injection-feb-2026/"},{"incident":"hpe-oneview-code-injection-attacks-jan-2026","at":"2026-01-07T05:45Z","added":"2026-11-03T22:23:55.101Z","kind":"wider-attacks","text":"Between 05:45 and 09:20 UTC, Check Point recorded more than 40,000 attack attempts, which it attributed to the RondoDox botnet. Targets included organisations in Australia.","url":"https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/","by":"Check Point Research","patch":null,"title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/"},{"incident":"hpe-oneview-code-injection-attacks-jan-2026","at":"2026-01-07","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2025-37164 to its Known Exploited Vulnerabilities catalogue, confirming evidence of attacks.","url":"https://www.rapid7.com/blog/post/etr-cve-2025-37164-critical-unauthenticated-rce-affecting-hewlett-packard-enterprise-oneview/","by":"Rapid7","patch":null,"title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/"},{"incident":"hpe-oneview-code-injection-attacks-jan-2026","at":"2025-12-21","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"Check Point detected its first exploitation attempts that evening, after deploying protection for the flaw.","url":"https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/","by":"Check Point Research","patch":null,"title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/"},{"incident":"hpe-oneview-code-injection-attacks-jan-2026","at":"2025-12-17","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"HPE says it released an initial hotfix on this date. This was subsequently superseded by enhanced remediation in January.","url":"https://www.techzine.eu/news/security/138004/rondodox-botnet-exploits-hpe-oneview-vulnerability-on-a-massive-scale/","by":"Techzine, quoting HPE","patch":"partial","title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/"},{"incident":"hpe-oneview-code-injection-attacks-jan-2026","at":"2025-12-16","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"HPE disclosed CVE-2025-37164 in OneView, its business infrastructure management software. The flaw allows someone who can reach a vulnerable appliance to run code without logging in.","url":"https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/","by":"Check Point Research","patch":null,"title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/"},{"incident":"roundcube-webmail-exploited-flaws-feb-2026","at":"2025-12-13","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Roundcube released 1.5.12 and 1.6.12 to fix the SVG cross-site scripting flaw CVE-2025-68461. These versions include fixes for both flaws in this record.","url":"https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12","by":"Roundcube","patch":"patched","title":"Roundcube Webmail flaws CVE-2025-49113 and CVE-2025-68461 used in attacks; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/roundcube-webmail-exploited-flaws-feb-2026/"},{"incident":"roundcube-webmail-exploited-flaws-feb-2026","at":"2025-06-01","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Roundcube released 1.5.10 and 1.6.11 to fix the authenticated server code-execution flaw later identified as CVE-2025-49113.","url":"https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10","by":"Roundcube","patch":"patched","title":"Roundcube Webmail flaws CVE-2025-49113 and CVE-2025-68461 used in attacks; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/roundcube-webmail-exploited-flaws-feb-2026/"},{"incident":"teamt5-threatsonar-upload-attacks-feb-2026","at":"2024-08-12","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"TWCERT/CC published CVE-2024-7694, describing an upload flaw requiring administrator privileges. It specified version 3.5.0 or later, or Hotfix-20240715, as the remedy.","url":"https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html","by":"TWCERT/CC","patch":null,"title":"TeamT5 ThreatSonar Anti-Ransomware upload flaw CVE-2024-7694 exploited; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/teamt5-threatsonar-upload-attacks-feb-2026/"},{"incident":"teamt5-threatsonar-upload-attacks-feb-2026","at":"2024-07-15","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"TeamT5 published a notice covering ThreatSonar Anti-Ransomware 3.4.5 and earlier and offered Hotfix-240715. It said cloud customers had already been patched on 12 July.","url":"https://teamt5.org/en/support/vulnerability-notification/vulnerability-notice-threat-sonar-anti-ransomware-20240715","by":"TeamT5","patch":"patched","title":"TeamT5 ThreatSonar Anti-Ransomware upload flaw CVE-2024-7694 exploited; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/teamt5-threatsonar-upload-attacks-feb-2026/"},{"incident":"icagenda-file-upload-attacks-jun-2026","at":"2026-10-27","added":"2026-11-03T22:23:50.754Z","kind":"other","text":"JoomliC released 4.0.17 and PRO 3.9.17 for separate security flaws, making these the current update targets. Free 3.9 support had ended on 13 October; PRO support was extended to 13 October 2027.","url":"https://www.joomlic.com/news/icagenda-security-update/icagenda-security-update-version-4-0-17","by":"JoomliC","patch":null,"title":"iCagenda file-upload flaw CVE-2026-48939 exploited to run code on Joomla websites; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/icagenda-file-upload-attacks-jun-2026/"},{"incident":"rockwell-logix-authentication-bypass-mar-2026","at":"2026-08-10","added":"2026-11-03T22:23:50.754Z","kind":"other","text":"Tenable’s updated review associated this flaw with Iranian-affiliated industrial-controller attacks. It also noted that CISA’s campaign advisory did not identify a specific exploited CVE, so that campaign link remains a research attribution.","url":"https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know","by":"Tenable","patch":null,"title":"Rockwell Logix controller flaw CVE-2021-22681 used in attacks; no patch available","severity":"critical","category":"patch","now":"none","page":"https://hard.fyi/live/rockwell-logix-authentication-bypass-mar-2026/"},{"incident":"zimbra-classic-email-theft-mar-2026","at":"2026-07-23","added":"2026-11-03T22:23:50.754Z","kind":"other","text":"Proofpoint documented TA488 attacks dating back to at least July 2025 against Ukrainian government and US government, scientific and defence targets. It reported stolen emails and credentials, but said it had observed no TA488 activity since February 2026.","url":"https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits","by":"Proofpoint","patch":null,"title":"Zimbra Classic webmail flaw CVE-2025-66376 used to steal emails; fixes available","severity":"high","category":"patch","now":"patched","page":"https://hard.fyi/live/zimbra-classic-email-theft-mar-2026/"},{"incident":"icagenda-file-upload-attacks-jun-2026","at":"2026-07-10","added":"2026-11-03T22:23:50.754Z","kind":"cisa-added","text":"CISA added CVE-2026-48939 to its Known Exploited Vulnerabilities catalogue, as recorded by MCP Security Research.","url":"https://mcpsec.dev/icagenda-security/","by":"MCP Security Research","patch":null,"title":"iCagenda file-upload flaw CVE-2026-48939 exploited to run code on Joomla websites; fixes available","severity":"critical","category":"patch","now":"patched","page":"https://hard.fyi/live/icagenda-file-upload-attacks-jun-2026/"}]}