{"page":"https://www.grayhavenindustries.com/watch","note":"Not security advice. Check the vendor's advisory before acting.","incidents":[{"slug":"luanti-2026-10","company":"Luanti","title":"Luanti says attacker broke into ContentDB servers","affected":"Luanti: ContentDB servers, including usernames, emails, hashed passwords, IP addresses of downloaders and uploaded packages","started":"2026-10-22","updated":"2026-10-27","checked":"2026-10-27","domains":["luanti.org"],"drafted":true,"summary":["Luanti said an attacker broke into ContentDB by exploiting two vulnerabilities, one of them in a third-party component that it reported to the maintainer.","Luanti said the attacker had access to ContentDB's internal configuration from 22nd October 13:00 UTC and used it to sign into a staff account.","Luanti said it confirmed that from 26th October 00:15 the attacker could run commands on its server inside a docker container, with full access to the database.","Luanti said the attacker had full access to secrets, the database, redis and uploads, including usernames, emails, bcrypt hashed passwords, and download IP addresses from the two weeks before 26th October.","Luanti said it checked every upload against backups and found no changes, but it has not ruled out that the attacker caused ContentDB to serve malicious uploads."],"sources":[{"label":"Luanti Blog, URGENT: ContentDB security incident: 22–26 October 2026, 2026-10-27","href":"https://blog.luanti.org/2026/10/27/contentdb-security-incident/","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#luanti-2026-10","status":"open"},{"slug":"firstvds-2026-10","company":"FirstVDS","title":"FirstVDS says attackers copied client server data via VMmanager","affected":"FirstVDS, a VDS hosting provider: data on client virtual servers hosted on 457 virtualization nodes where collector archives were found","started":"2026-10-17","updated":"2026-10-27","checked":"2026-10-27","domains":["firstvds.ru"],"drafted":true,"summary":["FirstVDS said that on 17 October 2026 it found a compromise of the VMmanager 6 virtualization management platform, made by ISPsystem, and that the attacker gained administrative access to the panel.","FirstVDS said the attacker used the panel's standard functions to run a data collector on virtualization nodes, and that it mounted client virtual machine disks in read only mode and copied selected files, including passwords, keys, tokens and configurations.","FirstVDS said collector archives were found on 457 virtualization nodes, and that this is a count of physical servers, not of clients or virtual machines.","FirstVDS said the archives are encrypted with the attacker's key, that it does not have the key, and that it cannot check from the archives which exact files were copied from each virtual machine.","FirstVDS said it began sending personal notices to affected clients on 18 October, and that clients who received one should treat the data on the listed servers as compromised."],"sources":[{"label":"FirstVDS, Postmortem: attack on FirstVDS 17.10.2026, 2026-10-27","href":"https://firstvds.ru/blog/postmortem-ataka-na-firstvds-17102026","kind":"company"},{"label":"FirstVDS, VMmanager vulnerability: change your credentials urgently, 2026-10-18 with updates","href":"https://firstvds.ru/blog/uyazvimost-vmmanager-srochno-smenite-dostupy","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#firstvds-2026-10","status":"open"},{"slug":"ovhcloud-2026-10","company":"OVHcloud","title":"OVHcloud CLI releases replaced with secret stealing binaries","affected":"OVHcloud, a cloud and hosting provider: ovhcloud-cli release binaries v0.11.0 to v0.15.0, downloaded on 19 October 2026 between 14h47 and 16h21 (UTC+2)","started":"2026-10-19","updated":"2026-10-23","checked":"2026-10-23","domains":["ovhcloud.com"],"drafted":true,"summary":["OVHcloud said a compromised OVHcloud GitHub developer account was used to replace several existing release assets of ovhcloud-cli with malicious binaries on 19 October 2026 between 14h47 (UTC+2) and 16h21 (UTC+2).","OVHcloud said the affected releases were v0.11.0 to v0.15.0, and that only users who installed the CLI in that window were affected.","OVHcloud said the source code and build chain were not affected and no other repository projects were affected.","OVHcloud said the malicious binaries were designed to steal secrets and files, including cloud credentials, SSH keys, Kubernetes and Docker configuration, and AI coding tool data.","OVHcloud said the main cause was that the GitHub repository was not configured for release immutability, and that this was corrected and applied to every repository."],"sources":[{"label":"OVHcloud, ovhcloud-cli security incident advisory (GitHub), 2026-10-20","href":"https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw","kind":"company"},{"label":"OVHcloud Community, ALERT Ovhcloud-CLI hacked here, 2026-10-20","href":"https://community.ovhcloud.com/t/alerte-ovhcloud-cli-pirate-hier/54162","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#ovhcloud-2026-10","status":"open"},{"slug":"railway-environment-variables","company":"Railway","title":"Railway customers told to rotate every stored secret","affected":"Railway, a hosting platform: environment variables stored for customers","started":"2026-10-21","updated":"2026-10-22","checked":"2026-10-22","domains":["railway.com"],"summary":["Railway said an unauthorized third party may have reached the encrypted environment variables it keeps for customers and decrypted some of them. It asked every customer to rotate every variable, API key and registry credential stored with it.","Railway invalidated all Railway API tokens, reset storage bucket credentials and the GitHub tokens it held, and published guides for checking unexpected use of AI service keys. It believes the breach is part of a series aimed at AI service providers. It had not published a cause as of 22 October."],"sources":[{"label":"Railway, security disclosure, 21 October 2026","href":"https://blog.railway.com/p/security-disclosure-wednesday-october-21st","kind":"company"},{"label":"Railway, incident QH8L8B3E status log","href":"https://status.railway.com/incident/QH8L8B3E","kind":"company"},{"label":"Railway, redeploy buckets and reconnect GitHub, 22 October 2026","href":"https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#railway-environment-variables","status":"open"},{"slug":"litellm-2026-10","company":"LiteLLM","title":"LiteLLM release v1.107.0 pushed with credential stealing malware","affected":"LiteLLM: release pipeline, PyPI package and Docker images for v1.107.0, plus credentials of users who installed or ran them","started":"2026-10-21","updated":"2026-10-22","checked":"2026-10-22","domains":["litellm.ai"],"drafted":true,"summary":["LiteLLM said its release pipeline was compromised in the early morning of October 21 and pushed v1.107.0 to the docker registry and PyPi.","LiteLLM said v1.107.0 contained compiled malware which steals credentials and loads remote-code execution tools.","LiteLLM said the malicious PyPI package was live from 11:39 UTC to 13:23 UTC, and the compromised Docker images were live from 11:46 UTC to 14:20 UTC.","LiteLLM said all previous versions are safe, the impacted releases have been pulled, and enterprise customers on the private enterprise release were not impacted.","LiteLLM said it believes it has identified the attack chain, and that it has not yet confirmed how the attacker gained access to its internal deployment but currently suspects a recently patched vulnerability.","LiteLLM said the incident was contained and the investigation was still in progress as of its October 21, 2026 20:30 UTC update."],"sources":[{"label":"LiteLLM, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, 2026-10-21","href":"https://docs.litellm.ai/blog/security-incident-oct-21-2026","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#litellm-2026-10","status":"open"},{"slug":"gmointernet-2026-10","company":"GMO Internet","title":"GMO Internet reports third-party intrusion into Onamae.com Desktop Cloud servers","affected":"GMO Internet, Onamae.com Desktop Cloud: 26,739 customer servers potentially affected, with stored data including trading account logins possibly viewed","started":"2026-10-20","updated":"2026-10-22","checked":"2026-10-22","domains":["internet.gmo","onamae.com"],"drafted":true,"summary":["GMO Internet said 26,739 servers were potentially affected and that information stored on the servers may have been viewed.","GMO Internet said it began shutting down customer servers in sequence from 4:00 on October 21, 2026, and had not yet set a date for resumption.","In its second report, GMO Internet said it had received customer reports of unauthorized operations on trading accounts linked to trading tools used on the servers.","GMO Internet said trading tool passwords and trading account credentials used on the servers may have been viewed by a third party, and that it was investigating with an external cybersecurity firm and had consulted the police on October 22."],"sources":[{"label":"GMO Internet, Apology and Notice Regarding Unauthorized Access by a Third Party to Onamae.com Desktop Cloud, 2026-10-21","href":"https://internet.gmo/en/news/article/246/","kind":"company"},{"label":"GMO Internet, Notice and Apology Regarding Unauthorized Access to Onamae.com Desktop Cloud (Second Report), 2026-10-22","href":"https://internet.gmo/en/news/article/247/","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#gmointernet-2026-10","status":"open"},{"slug":"opencode-console-keys","company":"OpenCode","title":"OpenCode console keys may have been exposed","affected":"OpenCode Console, the hosted service: AI provider keys saved by 1.4% of its users","started":"2026-10-16","updated":"2026-10-22","checked":"2026-10-22","domains":["opencode.ai","anoma.ly"],"summary":["OpenCode said a breach it called related to a large-scale distillation attack affected 1.4% of its console users, those who had linked outside AI providers, and that it emailed each of them. The Hacker News reports that the keys saved in the hosted console may have been exposed, and that OpenCode's co-founder said keys used by its local apps never reach OpenCode.","OpenCode said it was working with Anthropic, OpenAI and Google, and had not said any key was copied or used."],"sources":[{"label":"OpenCode on X, 17 October 2026","href":"https://x.com/opencode/status/2111519637049319818","kind":"company"},{"label":"The Hacker News, OpenCode Console breach, 19 October 2026","href":"https://thehackernews.com/2026/10/opencode-console-breach-may-have.html","kind":"report"}],"url":"https://www.grayhavenindustries.com/watch#opencode-console-keys","status":"open"},{"slug":"zeabur-platform-database","company":"Zeabur","title":"Zeabur platform database read by an attacker","affected":"Zeabur, a hosting platform: 3,218,965 environment variable records and 321,810 accounts","started":"2026-10-14","updated":"2026-10-22","checked":"2026-10-22","domains":["zeabur.com"],"summary":["Zeabur reported that on 14 and 15 October an attacker used leaked internal credentials to work through its systems and read 3,218,965 environment variable records and 321,810 accounts from its platform database.","Zeabur gives the cause: long-lived admin credentials stored in plaintext that could be used from the public internet, unchanged since January 2024. More than 16 hours of attack activity raised no alert. Zeabur judges from the attacker's commands that it was mainly after API keys, especially for AI services."],"sources":[{"label":"Zeabur, October 2026 security incident, 19 October 2026","href":"https://zeabur.com/blogs/october-2026-security-incident","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#zeabur-platform-database","status":"open"},{"slug":"pingcap-2026-09","company":"PingCAP","title":"PingCAP says stolen credentials let an attacker copy data and source code","affected":"PingCAP, maker of TiDB Cloud: internal systems, exported customer account and billing records, and source code","started":"2026-09-09","updated":"2026-10-22","checked":"2026-10-22","domains":["pingcap.com"],"drafted":true,"summary":["PingCAP said that between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain internal systems, copy data, and obtain source code.","PingCAP said exported records included user names, email addresses, organization and project associations, SQL editor text and errors, customer contacts, contract terms, orders, pricing, and billing configuration.","PingCAP said an exported table contained encrypted TiDB Cloud API-key values, and that whether other usable credentials were exposed remains to be determined.","PingCAP said there is no evidence that data stored in TiDB was impacted, and that an external firm found no evidence the attacker ran commands or kept persistent access in the production systems it reviewed.","PingCAP said it became aware of the incident on October 7, and that as of October 14 all identified compromised credentials were invalidated and the identified unauthorized access paths were blocked.","PingCAP said it is still determining which customers and data types were affected, and that it will notify affected customers directly once customer-specific impact is established."],"sources":[{"label":"PingCAP, Security Incident Report: Unauthorized Access to PingCAP Cloud Resources, October 19, 2026","href":"https://www.pingcap.com/trust-hub/security/security-update-october-2026/","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#pingcap-2026-09","status":"open"},{"slug":"vercel-context-ai","company":"Vercel","title":"Vercel breach that began at an employee's AI tool","affected":"Vercel: non-sensitive environment variables of a limited set of customers","started":"2026-04-19","updated":"2026-10-22","closed":"2026-10-16","checked":"2026-10-22","domains":["vercel.com"],"summary":["Vercel said its April breach began with Context.ai, a third-party AI tool one employee used, whose Google Workspace connection was compromised. The attacker took over the employee's accounts, moved into a Vercel environment and decrypted non-sensitive environment variables for a limited set of customers.","Vercel closed the incident on 16 October 2026."],"sources":[{"label":"Vercel, April 2026 security incident","href":"https://vercel.com/kb/bulletin/vercel-april-2026-security-incident","kind":"company"}],"url":"https://www.grayhavenindustries.com/watch#vercel-context-ai","status":"closed"}],"exploited":{"source":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","catalogReleased":"2026-11-04","days":30,"flaws":[{"cve":"CVE-2024-27834","vendor":"Apple","product":"Multiple Products","name":"Apple Multiple Products Improper Authentication Vulnerability","description":"Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.","added":"2026-11-04","due":"2026-11-18","ransomware":false,"advisories":["https://support.apple.com/en-us/120896","https://support.apple.com/en-us/120898","https://support.apple.com/en-us/120901","https://support.apple.com/en-us/120902","https://support.apple.com/en-us/120903","https://support.apple.com/en-us/120905"],"page":"https://www.grayhavenindustries.com/watch/CVE-2024-27834","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-27834"},{"cve":"CVE-2026-119977","vendor":"WordPress","product":"WordPress Core","name":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","description":"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.","added":"2026-11-03","due":"2026-11-06","ransomware":false,"advisories":["https://wordpress.org/news/2026/10/wordpress-7-1-4","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-119977","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977"},{"cve":"CVE-2026-118527","vendor":"Ivanti","product":"Connect Secure","name":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","description":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","added":"2026-10-30","due":"2026-11-13","ransomware":false,"advisories":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-118527","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118527"},{"cve":"CVE-2026-111357","vendor":"Ivanti","product":"Connect Secure","name":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","description":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.","added":"2026-10-30","due":"2026-11-02","ransomware":false,"advisories":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-111357","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111357"},{"cve":"CVE-2026-97229","vendor":"GitLab","product":"Community Edition and Enterprise Edition","name":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","description":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","added":"2026-10-29","due":"2026-11-01","ransomware":false,"advisories":["https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves","https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-97229","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229"},{"cve":"CVE-2026-76418","vendor":"Cisco","product":"Secure Firewall ASA Software and Cisco Secure FTD Software","name":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability","description":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","added":"2026-10-29","due":"2026-11-01","ransomware":false,"advisories":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-76418","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76418"},{"cve":"CVE-2026-46300","vendor":"Linux","product":"Kernel","name":"Linux Kernel Missing Initialization of a Variable Vulnerability","description":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.","added":"2026-10-28","due":"2026-10-31","ransomware":false,"advisories":["https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987","https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c","https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5","https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0","https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e","https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a","https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111","https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-46300","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-46300"},{"cve":"CVE-2026-41709","vendor":"Broadcom","product":"VMware ESX","name":"Broadcom VMWare ESX Insufficient Logging Vulnerability","description":"Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.","added":"2026-10-28","due":"2026-11-11","ransomware":false,"advisories":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-41709","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-41709"},{"cve":"CVE-2026-48356","vendor":"Adobe","product":"Commerce and Magento","name":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","description":"Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.","added":"2026-10-27","due":"2026-11-10","ransomware":false,"advisories":["https://www.adobe.com/trust/security/products/commerce/apsb26-73.html"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-48356","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356"},{"cve":"CVE-2026-111497","vendor":"Google","product":"Brotli","name":"Google Brotli Unchecked Return Value Vulnerability","description":"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.","added":"2026-10-27","due":"2026-11-10","ransomware":false,"advisories":["https://github.com/google/brotli/releases/tag/v1.2.1"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-111497","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"},{"cve":"CVE-2026-109619","vendor":"PHP Group","product":"PHP","name":"PHP Stale Internal Request-State Vulnerability","description":"PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.","added":"2026-10-26","due":"2026-10-29","ransomware":false,"advisories":["https://www.php.net/"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-109619","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619"},{"cve":"CVE-2026-109618","vendor":"PHP Group","product":"PHP","name":"PHP Memory Corruption Vulnerability","description":"PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.","added":"2026-10-26","due":"2026-10-29","ransomware":false,"advisories":["https://www.php.net/"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-109618","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618"},{"cve":"CVE-2026-114625","vendor":"Arista","product":"VeloCloud Orchestrator","name":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","description":"Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","added":"2026-10-23","due":"2026-10-26","ransomware":false,"advisories":["https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-114625","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114625"},{"cve":"CVE-2026-110447","vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","name":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","description":"Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","added":"2026-10-23","due":"2026-10-26","ransomware":false,"advisories":["https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-110447","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447"},{"cve":"CVE-2026-96656","vendor":"Plex","product":"Media Server","name":"Plex Media Server External Control of File Name or Path Vulnerability","description":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","added":"2026-10-20","due":"2026-10-23","ransomware":false,"advisories":["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-96656","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-96656"},{"cve":"CVE-2026-96655","vendor":"Plex","product":"Media Server","name":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","description":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","added":"2026-10-20","due":"2026-11-03","ransomware":false,"advisories":["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-96655","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-96655"},{"cve":"CVE-2026-96654","vendor":"Plex","product":"Media Server","name":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","description":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","added":"2026-10-20","due":"2026-10-23","ransomware":false,"advisories":["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-96654","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-96654"},{"cve":"CVE-2026-96652","vendor":"Plex","product":"Media Server","name":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","description":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.","added":"2026-10-20","due":"2026-11-03","ransomware":false,"advisories":["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-96652","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652"},{"cve":"CVE-2026-110936","vendor":"Siemens","product":"Software Center","name":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","description":"Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","added":"2026-10-20","due":"2026-11-03","ransomware":false,"advisories":["https://productcert.siemens.com/productcert/html/ssa-580366.html"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-110936","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110936"},{"cve":"CVE-2026-106931","vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","name":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","description":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","added":"2026-10-20","due":"2026-10-23","ransomware":false,"advisories":["https://www.eg-secure.co.jp/siteguard/news/alert-202610-1"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-106931","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-106931"},{"cve":"CVE-2026-102764","vendor":"BeyondTrust","product":"Remote Support","name":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","description":"BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.","added":"2026-10-16","due":"2026-10-19","ransomware":false,"advisories":["https://www.beyondtrust.com/trust-center/security-advisories/bt26-05"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-102764","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764"},{"cve":"CVE-2025-61624","vendor":"Fortinet","product":"Multiple Products","name":"Fortinet Multiple Products Path Traversal Vulnerability","description":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","added":"2026-10-16","due":"2026-10-19","ransomware":false,"advisories":["https://fortiguard.fortinet.com/psirt/FG-IR-26-122"],"page":"https://www.grayhavenindustries.com/watch/CVE-2025-61624","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-61624"},{"cve":"CVE-2026-21589","vendor":"Atlassian","product":"Multiple Products","name":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","description":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","added":"2026-10-15","due":"2026-10-18","ransomware":false,"advisories":["https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-21589","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-21589"},{"cve":"CVE-2026-76519","vendor":"Cisco","product":"Secure Email Gateway","name":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","description":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.","added":"2026-10-14","due":"2026-10-17","ransomware":false,"advisories":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-76519","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76519"},{"cve":"CVE-2026-105134","vendor":"Ahsay","product":"AhsayCBS","name":"Ahsay AhsayCBS Command Injection Vulnerability","description":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.","added":"2026-10-14","due":"2026-10-17","ransomware":false,"advisories":["https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-105134","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105134"},{"cve":"CVE-2026-105133","vendor":"Ahsay","product":"AhsayCBS","name":"Ahsay AhsayCBS Improper Authentication Vulnerability","description":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.","added":"2026-10-14","due":"2026-10-17","ransomware":false,"advisories":["https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-105133","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105133"},{"cve":"CVE-2026-0322","vendor":"Palo Alto Networks","product":"PAN-OS","name":"Palo Alto Networks PAN-OS Code Injection Vulnerability","description":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","added":"2026-10-14","due":"2026-10-17","ransomware":false,"advisories":["https://security.paloaltonetworks.com/CVE-2026-0322"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-0322","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-0322"},{"cve":"CVE-2026-96951","vendor":"Microsoft","product":"Windows","name":"Microsoft Windows Command Injection Vulnerability","description":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","added":"2026-10-13","due":"2026-10-16","ransomware":false,"advisories":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951"],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-96951","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951"},{"cve":"CVE-2026-104935","vendor":"Ivanti","product":"Connect Secure","name":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","description":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","added":"2026-10-13","due":"2026-10-16","ransomware":false,"advisories":[],"page":"https://www.grayhavenindustries.com/watch/CVE-2026-104935","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935"},{"cve":"CVE-2023-22894","vendor":"Strapi","product":"Strapi","name":"Strapi Cleartext Storage of Sensitive Information Vulnerability","description":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.","added":"2026-10-08","due":"2026-10-11","ransomware":false,"advisories":["https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve","https://github.com/strapi/strapi/releases"],"page":"https://www.grayhavenindustries.com/watch/CVE-2023-22894","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-22894"},{"cve":"CVE-2021-3199","vendor":"ONLYOFFICE","product":"Docs","name":"ONLYOFFICE Docs Server Path Traversal Vulnerability","description":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.","added":"2026-10-08","due":"2026-10-11","ransomware":false,"advisories":["https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563"],"page":"https://www.grayhavenindustries.com/watch/CVE-2021-3199","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-3199"},{"cve":"CVE-2016-3081","vendor":"Apache","product":"Struts","name":"Apache Struts Command Injection Vulnerability","description":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","added":"2026-10-08","due":"2026-10-11","ransomware":false,"advisories":["https://cwiki.apache.org/confluence/display/WW/S2-032"],"page":"https://www.grayhavenindustries.com/watch/CVE-2016-3081","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-3081"},{"cve":"CVE-2015-5477","vendor":"ISC","product":"BIND","name":"ISC BIND Data Processing Errors Vulnerability","description":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","added":"2026-10-08","due":"2026-10-11","ransomware":false,"advisories":["https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272","https://access.redhat.com/errata/RHSA-2015:1513.html;","https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477"],"page":"https://www.grayhavenindustries.com/watch/CVE-2015-5477","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-5477"},{"cve":"CVE-2015-3306","vendor":"ProFTPD","product":"ProFTPD","name":"ProFTPD Improper Access Control Vulnerability","description":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","added":"2026-10-08","due":"2026-10-11","ransomware":false,"advisories":["https://lists.debian.org/debian-security-announce/2015/msg00154.html","https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/"],"page":"https://www.grayhavenindustries.com/watch/CVE-2015-3306","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3306"}]}}