Threats being exploited right now

Exploited vulnerabilities and malicious packages from CISA KEV, EPSS and OSV, merged into one feed. Checked every 10 minutes. Not every CVE: only the ones with proof of attacks or malware.

RSS Atom JSON Feed JSON API

MCP server for your agent

44 active threats in the last 7 days

Newest signal first

ACT NOW

Compromised packageMAL-2026-18527npm / @lynnidoffc/baileys

Malicious code in @lynnidoffc/baileys (npm)

Anyone who installed or ran this malicious package should assume an outside attacker has full control of the computer, with access to stored secrets and keys. Removing the package may not remove the malware. npm package @lynnidoffc/baileys, all versions. Rotate all secrets and keys stored on affected computers from a different, clean computer, remove the package, and treat the machine as fully compromised by rebuilding it if possible.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageMAL-2026-18525npm / blitzstrike

Malicious code in blitzstrike (npm)

The npm package blitzstrike has malicious code that can give an outside attacker full control of any computer that installed it, along with access to stored secrets and keys. npm package blitzstrike, version 2.4.180. Remove the package, rotate all secrets and keys from a different computer, and rebuild the affected machine since removal may not clear the malware.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageMAL-2026-18526npm / nulio-connector

Malicious code in nulio-connector (npm)

Malicious code in this npm package can give an attacker full control of any computer that installed it, and removing the package may not undo that damage. npm package nulio-connector, versions 1.1.10, 1.1.11 and 1.1.16. Treat any machine that installed these versions as fully compromised, rotate all secrets and keys from a different computer, rebuild the machine if possible, and check for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 4

ACT NOW

Compromised packageGHSA-qwpw-cwrq-333jnpm / @ubedsockets/baileys

Malicious code in @ubedsockets/baileys (npm)

Malicious code secretly makes every victim's WhatsApp account follow attacker-controlled channels as soon as it connects, letting the attacker push content through those accounts. npm package @ubedsockets/baileys, all published versions; a trojanized fork of the Baileys WhatsApp library. Remove @ubedsockets/baileys now and switch to the legitimate @whiskeysockets/baileys, then check your WhatsApp channel follows and project logs for unexpected newsletter subscriptions.

Hijacked release

Sources: OSV · AI summary first seen Nov 4 · updated Nov 4

ACT NOW

Compromised packageMAL-2026-18517npm / @atedone/workspace-context

Malicious code in @atedone/workspace-context (npm)

The npm package contains malicious code that can run on a developer's machine and may let an attacker take over the system or steal data. The npm package @atedone/workspace-context, including versions 0.0.14 through 0.0.25 such as 0.0.15, 0.0.20, 0.0.22, 0.0.23, and 0.0.25. Remove the package from projects, pin away from these versions, and check for signs of compromise such as unexpected processes or credential changes.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-18192npm / agentic-awesome-skills

Malicious code in agentic-awesome-skills (npm)

Attackers compromised this npm package and inserted malicious code, which can run on a developer's machine when the package is installed or used. npm package agentic-awesome-skills, including versions 18.9.0 through 19.9.0 and other listed releases. Remove the affected agentic-awesome-skills versions now, switch to a known clean release, and check for signs of compromise such as unexpected processes, new scripts, or credential theft.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-18193npm / opencode-skills-collection

Malicious code in opencode-skills-collection (npm)

Malicious code was published inside this npm package, so anyone who installs it can have their system run attacker-controlled code. npm package opencode-skills-collection, including versions 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, and about 23 other versions. Remove opencode-skills-collection from all projects, pin away from every listed version, and check for signs of compromise on any system that installed it.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-18522npm / dsh-moss-console

Malicious code in dsh-moss-console (npm)

Malicious code was published inside this npm package, so installing it can let attackers run harmful code on the machine that installs it. npm package dsh-moss-console, version 3.3.0. Remove or downgrade dsh-moss-console 3.3.0 now, and check systems that installed it for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-119977WordPress WordPress Core

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

Attackers can exploit a timing flaw during WordPress core upgrades to run code on the server without logging in, and this is being actively exploited in the wild. WordPress core. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 6

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-118527Ivanti Connect Secure

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

A remote attacker with a valid login can upload files with content they choose to a predictable spot on the disk, and attackers are actively exploiting this flaw. It can also be chained with two other flaws. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files on the appliance.

In CISA KEVFederal deadline Nov 13

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-111357Ivanti Connect Secure

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

An attacker who already has a login on Ivanti Connect Secure can skip a required check and gain higher privileges, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 2 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-97229GitLab Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

An unauthenticated attacker can run arbitrary code on the GitLab server using a specially crafted regular expression in a CI/CD configuration; this flaw is being actively exploited. GitLab Community Edition and Enterprise Edition. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 1 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

An unauthenticated remote attacker can crash the device by sending crafted traffic, causing it to reload unexpectedly and drop service; this flaw is being exploited in the wild. Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 1 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-41709Broadcom VMware ESX

Broadcom VMWare ESX Insufficient Logging Vulnerability

An attacker who already has admin access can carry out certain actions on the system without leaving a log entry, and this flaw is being actively exploited. Broadcom VMware ESX. Apply the vendor's mitigations or update now, and check for signs of compromise.

In CISA KEVFederal deadline Nov 11

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-46300Linux Kernel

Linux Kernel Missing Initialization of a Variable Vulnerability

Attackers can modify data cached in memory for files on the system, and chained with other flaws they can plant PHP webshells and run commands as root. Linux Kernel. Apply the vendor's update now and check for signs of compromise, such as unexpected PHP files or unknown root processes.

In CISA KEVFederal deadline Oct 31 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-48356Adobe Commerce and Magento

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Attackers can upload dangerous file types to the store and run their own code, potentially taking over accounts or sessions. This flaw is being actively exploited. Adobe Commerce and Magento. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files or unfamiliar admin activity.

In CISA KEVFederal deadline Nov 10

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-111497PyPI / brotli, PyPI / brotlicffi

Google Brotli Unchecked Return Value Vulnerability

A remote attacker can send a specially crafted Brotli-compressed stream to corrupt memory, read sensitive memory contents, crash the program, or possibly run arbitrary code, and this flaw is being actively exploited. PyPI packages brotli (versions 1.0.3 up to 1.2.1) and brotlicffi (versions 1.0.3 up to 1.2.1.0). Upgrade brotli to 1.2.1 and brotlicffi to 1.2.1.0 now, and check for signs of compromise.

In CISA KEVFederal deadline Nov 10

Sources: CISA KEV, OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-109618PHP Group PHP

PHP Memory Corruption Vulnerability

Attackers can run their own code on the server without logging in, due to a memory bug in PHP, and this flaw is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 29 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-109619PHP Group PHP

PHP Stale Internal Request-State Vulnerability

An unauthenticated remote attacker can run arbitrary code on servers due to a stale request-state flaw, and this vulnerability is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 29 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-114625Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Attackers can send specially crafted database queries to reach privileged internal functions and affect the orchestrator host, and this flaw is being actively exploited. Arista VeloCloud Orchestrator on-prem. Apply the vendor's mitigations or update now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 26 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Exploited vulnerabilityCVE-2026-110447Collabora Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Attackers can run their own commands on the server remotely, because a flaw lets crafted input be passed to the operating system, and this is being actively exploited. Collabora Online built-in CODE Server, when used within the NextCloud platform. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 26 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-17650npm / tensorlake

Malicious code in tensorlake (npm)

Attackers have published malicious code inside this package, which can run harmful commands on any machine that installs it and may steal secrets or credentials. The npm package tensorlake, version 0.5.144. Remove or downgrade tensorlake 0.5.144 now, rotate any credentials on affected machines, and check for signs of compromise.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

ACT NOW

Compromised packageMAL-2026-3514npm / @tallyui/components

Malicious code in @tallyui/components (npm)

The npm package contains malicious code that can run on a developer's machine or build system once installed, potentially letting an attacker take control or steal data. npm package @tallyui/components, versions 1.0.1, 1.0.2 and 1.0.3. Remove these versions from your projects, pin to a known-safe release, and check for signs of compromise on any system that installed them.

Hijacked release

Sources: OSV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-106931EG Secure Solutions SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Attackers can run arbitrary operating system commands with root or SYSTEM privileges on the server, and this flaw is being actively exploited. EG Secure Solutions SiteGuard Server Edition. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 23 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96656Plex Media Server

Plex Media Server External Control of File Name or Path Vulnerability

An attacker who already has admin access can write arbitrary files to the server, and those files may run when loaded, letting them take control. This flaw is being exploited in the wild and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 23 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96655Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

An authenticated user can make the server send requests to internal or external addresses of their choosing, which is being actively exploited in attacks and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 3 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96654Plex Media Server

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

An attacker can exploit a web page flaw in Plex Media Server to call other plugin functions and supply their own inputs, and this is being actively exploited in the wild. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 23 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96652Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

An attacker with any valid-looking access token can make the Plex server send POST requests to a destination of their choosing, and this flaw is being actively exploited. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Nov 3 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-110936Siemens Software Center

Siemens Software Center Uncontrolled Search Path Element Vulnerability

A logged-in local user can plant a specially crafted DLL file where the program looks for libraries, tricking it into running attacker code with the app's privileges; this is being exploited in the wild. Siemens Software Center. Apply the vendor's mitigations now and check for signs of compromise, such as unexpected DLL files in the application's search directories.

In CISA KEVFederal deadline Nov 3 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-102764BeyondTrust Remote Support

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

A remote attacker can bypass login by spoofing identity and then perform file operations on the appliance, and this flaw is being actively exploited. BeyondTrust Remote Support. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 19 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2025-61624Fortinet Multiple Products

Fortinet Multiple Products Path Traversal Vulnerability

An attacker with admin-level login can use specific command-line commands to write or delete arbitrary files on the device, and this flaw is being actively exploited. Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Apply the vendor's fixes and mitigations now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 19 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-21589Atlassian Multiple Products

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

An unauthenticated attacker can access files inside the web application's root directory without logging in, and this flaw is being actively exploited. Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 18 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-105134Ahsay AhsayCBS

Ahsay AhsayCBS Command Injection Vulnerability

Attackers can run operating system commands on the server by tampering with a parameter in a web request, and this flaw is being actively exploited. Ahsay AhsayCBS. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 17 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-76519Cisco Secure Email Gateway

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

An unauthenticated remote attacker can write arbitrary files onto the underlying operating system, and this flaw is being actively exploited. Cisco Secure Email Gateway. Apply the vendor's mitigations or update now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 17 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-105133Ahsay AhsayCBS

Ahsay AhsayCBS Improper Authentication Vulnerability

A remote attacker can bypass login checks in AhsayCBS by manipulating a parameter sent to its API, and this flaw is being actively exploited in the wild. Ahsay AhsayCBS; no fixed versions are listed, so this applies to all AhsayCBS deployments. Apply the vendor's update now and check for signs of compromise, including unexpected admin logins or new accounts.

In CISA KEVFederal deadline Oct 17 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-0322Palo Alto Networks PAN-OS

Palo Alto Networks PAN-OS Code Injection Vulnerability

An authenticated attacker with network access can run arbitrary code with root privileges on the firewall, and this flaw is being exploited in the wild. Palo Alto Networks PAN-OS. Apply the vendor's mitigations and update now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 17 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-104935Ivanti Connect Secure

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

A remote attacker with no login can bypass authentication by spoofing and run arbitrary commands on the device, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's mitigations or update now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 16 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-96951Microsoft Windows

Microsoft Windows Command Injection Vulnerability

An unauthorized attacker over a network can bypass a Windows security feature through a command injection flaw, and this flaw is being actively exploited. Microsoft Windows Shell. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 16 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2015-5477ISC BIND

ISC BIND Data Processing Errors Vulnerability

Remote attackers can crash the BIND DNS server by sending specially crafted TKEY queries, causing denial of service, and this flaw is being actively exploited. ISC BIND DNS server software. Apply the vendor's update now and check for signs of compromise, such as unexpected DNS server crashes or restarts.

In CISA KEVFederal deadline Oct 11 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2016-3081Maven / org.apache.struts:struts2-core

Apache Struts Command Injection Vulnerability

Remote attackers can run their own commands on servers through a crafted method: prefix when Dynamic Method Invocation is enabled, and this flaw is being actively exploited. Apache Struts, Maven org.apache.struts:struts2-core versions 2.3.20 through 2.3.28. Upgrade to fixed versions 2.3.20.3, 2.3.24.3, or 2.3.28.1 now, and check for signs of compromise.

In CISA KEVFederal deadline Oct 11 passed

Sources: CISA KEV, OSV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2023-22894npm / @strapi/strapi

Strapi Cleartext Storage of Sensitive Information Vulnerability

Attackers who can log into the Strapi admin panel can use query filters to read sensitive user details stored in cleartext, and it is being exploited in the wild and can be chained toward remote code execution. Strapi (npm package @strapi/strapi), versions 3.2.1 up to but not including 4.8.0. Upgrade @strapi/strapi to 4.8.0 or later now, and check for signs of compromise such as unexpected admin logins or unusual query activity.

In CISA KEVFederal deadline Oct 11 passed

Sources: CISA KEV, OSV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2021-3199ONLYOFFICE Docs

ONLYOFFICE Docs Server Path Traversal Vulnerability

Attackers are actively exploiting a path traversal flaw, using a /.. sequence in an image upload parameter when JWT is enabled, which can lead to remote code execution on the server. ONLYOFFICE Docs Server, installations that use JWT. Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 11 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2015-3306ProFTPD ProFTPD

ProFTPD Improper Access Control Vulnerability

Remote attackers can read and write arbitrary files on the server through the site cpfr and site cpto commands, and this flaw is being actively exploited. ProFTPD (ProFTPD server; no versions given in the advisory). Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 11 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

WATCH

Exploited vulnerabilityCVE-2026-88779Citrix NetScaler

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

An attacker can crash Citrix NetScaler devices through a memory buffer bug, and this flaw is being actively exploited in the wild. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Apply the vendor's update now and check for signs of compromise.

In CISA KEVFederal deadline Oct 7 passed

Sources: CISA KEV · AI summary first seen Nov 3 · updated Nov 3

Bulk malware in the last 7 days: 228 on npm, 23 on PyPI and 8 on RubyGems. Mostly typosquats with no real users, so they stay out of the main list. Dependency checks still catch them. Show all 259

Summaries are written by AI from the linked sources and regenerated when a source changes.