| 2026-11-14 | Apify breach: compromised credential exposed customer accounts, 2FA recovery codes and sign-in tokens | Data breach | Apify platform accounts accessed Nov 9 to 10, 2026 (count not disclosed). Apify reports 91,000 customers worldwide. | High | Apify Status: security incident updates (Nov 11-13, 2026) |
| 2026-11-14 | UnrealIRCd CVE-2026-114713: labeled-response flaw lets any user run server-authority commands, exploited | Exploited vuln | UnrealIRCd 6.0.0 up to (not including) 6.2.7.1. Fixed in 6.2.7.1 or hot-patch bundle-20261107. | High | UnrealIRCd: 6.2.7.1 released & hot-patch to fix 9 security issues, including one CRITICAL (CVE-2026-114713) |
| 2026-11-13 | Check Point Gaia CVE-2026-123039: PHP2Shell plus root zero-day exploited on Mobile Access gateways | Exploited vuln | CVE-2026-123039: Gaia R81, R81.10, R81.20, R82, R82.10, R82.20 (Force Firewalls, Management/Log Servers, MDS, Maestro). PHP2Shell: Security Gateways with Mobile Access Portal, R80 to R82.20, and listed Spark versions. · updated 2026-11-14 | High | Check Point: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026) |
| 2026-11-12 | ScreenConnect RMM+ extension: blank access key let attackers push the SCKit worm to 288 endpoints in 90 minutes | Active attack | ScreenConnect panels with RMM+ family third-party extensions installed (RMM+ 1.0.31 and 1.0.32 accept a blank access key); ScreenConnect 26.6.6.9747 and 26.7.6.9783 panels observed in the campaign | Critical | ConnectWise Trust Center: ScreenConnect security advisory, precautionary extension disabling and partner guidance |
| 2026-11-12 | Openwave Webtop Media Transcoder CVE-2026-111793: file-type restriction bypass exploited, on CISA KEV (due Nov 24) | Exploited vuln | Openwave Webtop Media Transcoder versions prior to 1.1.22.0 | Medium | CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026) |
| 2026-11-11 | Xen Orchestra VSA-2026-062: empty-object login cookie gives attackers admin and root on XCP-ng hosts, exploited in the wild | Exploited vuln | Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest); Xen Orchestra Appliance (XOA); xo-server before 5.211.2 / 5.213.1 | Critical | Vates security advisory VSA-2026-062: Empty-object login token |
| 2026-11-11 | Cisco BroadWorks CVE-2026-20320: unauthenticated OCI-P XXE now exploited to steal server keys, added to CISA KEV | Exploited vuln | Cisco BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform releases earlier than RI.2026.07 | High | Cisco Security Advisory cisco-sa-bworks-xxe-uwUd7CEt: BroadWorks Out-of-Band Blind XXE (CVE-2026-20320) |
| 2026-11-11 | Microsoft Outlook CVE-2026-124194: exploited zero-day leaks NTLMv2 hashes from a crafted message file, fixed in November Patch Tuesday | Exploited vuln | Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit) before the November 10, 2026 security update | High | CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026) |
| 2026-11-10 | Barracuda ESG: pre-auth admin bypass chained to root command injection, now exploited | Exploited vuln | Barracuda ESG < 9.4.0.030 (both CVEs); ADC < 6.4.0, WAF < 11.0.1, WSG < 16.1.100.100, BMA < 5.5.4.0, WCC < 2.2.1 (CVE-2026-111560) · updated 2026-11-11 | Critical | Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities (updated Nov 9, 2026 with exploitation) |
| 2026-11-10 | IBM Aspera Faspex 5 CVE-2026-123218: logged-in users can make themselves full admins, CISA says it is exploited | Exploited vuln | IBM Aspera Faspex 5.0.0 through 5.0.19 (fixed in 5.0.19 PL1) | Critical | IBM Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass (CVE-2026-123218) |
| 2026-11-10 | N-able N-central "Able2Shell": 33 public zero-days with PoCs, hosted service taken offline and on-prem servers told to shut down | Exploit | N-able N-central Appliance 2026.4.0.31 (and likely earlier), hosted and on-premises · updated 2026-11-13 | Critical | N-able: Update on N-central 2026.4 HF2 and ongoing security response |
| 2026-11-10 | SignalWire FreeSWITCH CVE-2026-116779: one SIP MESSAGE can run FreeSWITCH API and OS commands, exploited in the wild | Exploited vuln | SignalWire FreeSWITCH <= 1.11.2 (fixed in 1.11.3) | Critical | SignalWire FreeSWITCH advisory GHSA-mg63-h38w-8p9p (exploitation observed in the wild) |
| 2026-11-10 | Google Chrome CVE-2026-125350: XML use-after-free zero-day exploited in the wild, patched in Chrome 157 | Exploited vuln | Google Chrome desktop < 157.0.8103.50 (Windows, macOS, Linux) · updated 2026-11-11 | High | Chrome Releases: Stable Channel Update for Desktop (Nov 9, 2026) |
| 2026-11-09 | Node-RED / Siemens IoT2050 CVE-2026-58115 (CVSS 10): unauthenticated flow deployment is being exploited for Linux bots and webshells | Exploited vuln | Siemens SIMATIC IoT2050 (Industrial OS with Node-RED) < V4.3.4-1; Node-RED instances without adminAuth | Critical | Siemens ProductCERT: SSA-834709 (SIMATIC IoT2050, CVE-2026-58115) |
| 2026-11-09 | Iris Ohyama's Iris Plaza breach: about 7.7 million people's data may be exposed via an external cloud service | Data breach | Iris Plaza (Iris Ohyama) online store customer data in an external cloud service (discovered Oct 28, 2026) | High | Iris Plaza / Iris Ohyama: second notice (Nov 5, 2026, Japanese PDF) |
| 2026-11-07 | ARARA Message breach: 81 million email addresses taken from Japanese email-delivery service | Breach | ARARA Message (Paycloud Holdings) email-delivery clients and their recipients | High | ARARA third report (Japanese, Nov 6, 2026, primary) |
| 2026-11-07 | Mirae Asset Securities hacked twice in two days: 3,800 customer account numbers and 35,255 staff records leaked | Data breach | Mirae Asset Securities mobile-web phone-auth login and mi-global groupware (Nov 4-5, 2026) | High | Mirae Asset Securities notice: employee personal information leak (Nov 7, 2026, Korean) |
| 2026-11-07 | SonicWall SonicOS SSL-VPN flaw (CVE-2026-19868) lets attackers bypass SAML and MFA; exploited, on CISA KEV | Exploited vuln | SonicWall SonicOS Gen7 <=7.3.3-7015 and Gen8 <=8.2.2-8015 (SSL-VPN with SAML) | High | CISA: CISA Adds One Known Exploited Vulnerability to Catalog (Nov 6, 2026) |
| 2026-11-06 | DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen | Breach | DreamHost File Manager / FTP-SFTP / webmail customers (subset; <~10%) | High | DreamHost October Security Incident notice (primary) |
| 2026-11-06 | NTT Docomo: up to ~300k customer records leaked from My docomo / Online Shop | Breach | NTT Docomo Online Shop and My docomo customers (Japan; up to ~300k) | High | NTT Docomo official notice (primary; third report, Nov 6 18:00 JST) |
| 2026-11-05 | OpenSSH / Alpine “sshole” CVE-2026-123158: key-only account password-auth bypass | Exploited vuln | Alpine / musl OpenSSH SSH servers (PAM off, password auth on) · updated 2026-11-10 | High | Alpine Linux security advisory (primary; conditions and branch-specific fixes) |
| 2026-11-04 | APT29 watering holes hit unpatched iOS/Android; CISA adds Apple CVE-2024-27834 to KEV | Exploited vuln | Unpatched iOS/Android users; orgs whose sites or trackers were abused as watering holes | High | CISA KEV alert |
| 2026-11-04 | Chainstack breached: customer data and password hashes accessed, node credentials treated as exposed | Breach | Chainstack platform customers | High | Chainstack incident report |
| 2026-11-04 | Attackers set French blood bank plasma freezers to 110°C through refrigeration vendor Coolworld | OT / Healthcare | Coolworld-managed refrigeration at EFS sites; networked cold-storage / industrial refrigeration controllers generally (grocery, cold storage, healthcare) · updated 2026-11-05 | High | FBI/CISA/HHS/USDA/DoT CSA (IC3) — Industrial refrigeration & cold-chain hardening |
| 2026-11-03 | Attackers drain BTCPay Server hot wallets on version 2.4.1 and older | Exploit | BTCPay Server 2.4.1 and earlier | Critical | BTCPay Server |
| 2026-11-03 | OPSSHIELD cPGuard update channel hijacked: fake updates ran as root on ~2,950 Linux hosting servers | Supply chain | OPSSHIELD cPGuard 5.88.12-5.88.19 (installed Nov 2, 2026); fixed in 5.88.25/5.88.26 | Critical | OPSSHIELD: cPGuard security advisory, update channel compromise (Nov 3, 2026) |
| 2026-11-03 | WordPress Core CVE-2026-119977: upgrade-window RCE now on CISA KEV (due Nov 6) | Exploited vuln | WordPress Core sites not on 7.1.4 / security backports | High | CISA KEV alert |
| 2026-11-02 | Supermarket freezers hacked overnight in Belgium and Sweden | Attack | Delhaize, Carrefour Belgium, ICA, Coop stores | High | Delhaize: IT-incident status (company notice) |
| 2026-11-02 | VOLTA infostealer uses AI models to rank victims by what they're worth | Malware | Windows endpoints | High | Cisco Talos |
| 2026-11-02 | HYBE breach: hackers got in through a vendor's document-preview tool | Breach | HYBE staff and partners | Medium | The Korea Times |
| 2026-10-30 | Ivanti Connect Secure: three-CVE chain gives unauthenticated root | Exploited vuln | Ivanti VPN customers | Critical | CISA alert |
| 2026-10-30 | Linux kernel CVE-2026-98432: no-login remote root via MPTCP listeners | Patch | Linux servers | Critical | oss-security |
| 2026-10-30 | Northflank breached: assume every env var was decrypted | Breach | Northflank customers | Critical | Northflank status page |
| 2026-10-30 | VAPOR PANDA runs ARTEX AI-agent attack framework against 200+ orgs | Threat actor | 200+ orgs, 14+ countries | High | CrowdStrike |
| 2026-10-30 | Chainalysis discloses breach of customer contact data | Breach | Chainalysis customers · updated 2026-11-06 | Medium | Chainalysis |
| 2026-10-30 | MUJI app breach: up to 27.26M customer records | Breach | Up to 27.26M | Medium | Ryohin Keikaku notice |
| 2026-10-29 | Binance hot wallet theft (~$6.3B): losses covered, withdrawals resuming in phases | Breach | Binance users · updated 2026-11-08 | High | Binance: Security Incident Update |
| 2026-10-29 | Florida Dept. of Education: ~4.9M exposed in student financial aid site breach | Breach | ~4.9M people (FloridaStudentFinancialAidSG.org applicants) · updated 2026-11-02 | High | FLDOE data breach notice |
| 2026-10-28 | Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others | Breach | Amadeus-hosted airline bookings (SIA, Cathay Pacific, JAL, ANA, Malaysia Airlines, Korean Air, Asiana) · updated 2026-11-11 | High | JAL notice |
SockAnalyst