What broke in the last two weeks
Exploited vulnerabilities, critical package advisories and data breaches, collected from CISA, GitHub and Have I Been Pwned every 30 minutes. Nobody edits it.
22 live incidents, 15 exploited in the wild. Updated 04:31 UTC.
Sources
Tuesday, October 20
- CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CISA due Oct 23, 2026
- CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability CISA due Oct 23, 2026
- CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CISA due Nov 3, 2026
- CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CISA due Oct 23, 2026
- CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CISA due Nov 3, 2026
- CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability CISA due Nov 3, 2026
- Assurance Retraite data breach 70,372 accounts
Sunday, October 18
- Gîtes de France data breach 117,574 accounts
Friday, October 16
- CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CISA due Oct 19, 2026
- CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CISA due Oct 19, 2026
Thursday, October 15
- CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CISA due Oct 18, 2026
Wednesday, October 14
- CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability CISA due Oct 17, 2026
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CISA due Oct 17, 2026
- CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CISA due Oct 17, 2026
- CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CISA due Oct 17, 2026
- Crunchbase data breach 559,908 accounts
Tuesday, October 13
- CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability CISA due Oct 16, 2026
- CVE-2026-96951 Microsoft Windows Command Injection Vulnerability CISA due Oct 16, 2026
Monday, October 12
- Sharecare data breach 318,185 accounts
Friday, October 9
- CVE-2026-68582 Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) Critical, go ·
- CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite Critical, go ·
- Neogen data breach 435,963 accounts
Every half hour
- Up to 30 minutesFirst, CISA, GitHub and Have I Been Pwned publish; we poll all three every 30 minutes.
- MinutesThen records merge by CVE, and the pages, feeds and JSON follow within minutes.
- Minutes to an hourLast, a model translates each one into Portuguese, checked so no ID, version or link changes.