CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
84
Organization
Previdian
- Mentions · 7d2
- Mentions · 30d17
- All mentions23
- First seenAug 27, 2026
- Last mentioned2d ago
Timeline
23 articles · newest firstCISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
86
U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Atlassian CVE-2026-21589 to KEV, ordering federal fixes by October 18, 2026.
86
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Honeypots recorded 1,423 attempts exploiting Langflow's critical authenticated RCE, CVE-2026-105740.
78
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA put actively exploited Ivanti Connect Secure flaw CVE-2026-104935 on KEV, with federal fixes due October 16.
87
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are exploiting CVE-2026-102255, a CVSS 10 unauthenticated SSRF flaw in SonicWall SMA 1000 appliances.
86
SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 pre-auth SSRF CVE-2026-102255, a CVSS 10.0 flaw with no workaround.
88
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers made 135 attempts to exploit critical pre-auth SSRF CVE-2026-102255 in SonicWall SMA 1000 days after patching.
84
Critical SonicWall Vulnerability Exploited Days After Disclosure
Attackers began exploiting critical SonicWall SMA1000 SSRF CVE-2026-102255 within two days of its October 6 disclosure.
86
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers exploit max-severity SonicWall SMA1000 flaw CVE-2026-102255 three days after patch; Previdian honeypots captured matching exploitation attempts.
85
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Attackers probed critical Atlassian CVE-2026-21589 within hours of a public PoC, with 190 honeypot attempts.
80
Critical Flaw in Multiple Atlassian Products Exploited in the Wild
Unauthenticated Atlassian flaw CVE-2026-21589 is exploited in the wild to read Data Center application files.
80
Atlassian Vulnerability Comes Under Attack Hours After Details Go Public
Attackers are exploiting critical Atlassian flaw CVE-2026-21589 to read sensitive files on Data Center products.
85
Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)
Attackers are probing Atlassian Data Center products for critical file-read flaw CVE-2026-21589 one day after patches.
85
Hackers exploit critical Atlassian flaw after public PoC release
Attackers began exploiting critical Atlassian flaw CVE-2026-21589 within hours of a public proof of concept.
88
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Unauthenticated Atlassian Data Center flaw CVE-2026-21589 saw exploitation attempts within two hours.
83
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Sucuri details SC, a self-healing WordPress backdoor that rebuilds from files, the database, and RAM.
60
Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks
Attackers are exploiting patched Microsoft SharePoint flaw CVE-2026-65660, which CISA added to KEV.
82
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.
90
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Unauthenticated RCE CVE-2026-58138 in Orkes Conductor is actively exploited; Fortinet blocked ~7,000 attacks; patch to 3.30.2.
82
Critical NetScaler Vulnerability Exploited in Attacks
CISA added critical Citrix NetScaler flaw CVE-2026-19490 (CVSS 9.3) to its KEV catalog after confirming exploitation of gateway and AAA virtual servers in the wild.
90
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix patches critical NetScaler Gateway and AAA authentication bypass CVE-2026-19490 (CVSS 9.3) plus a SIP ALG memory overflow flaw; exploitation attempts observed.
72
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.
72
Related CVEs
by mentions- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-102255<1%10.0Pre-auth SSRF in SonicWall SMA1000 Work Place interface
- CVE-2026-154097%10.0Unauthenticated SSRF in SonicWall SMA1000 Appliances
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-1541012%7.2Authenticated OS Command Injection in SonicWall SMA 1000 Appliance Management Console
- CVE-2026-10493587%8.6Auth Bypass to Command Execution in Ivanti Connect Secure
- CVE-2022-09959%7.8Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
- CVE-2026-19489<1%8.8Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-845116%8.8Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML…
Appears with
- CISAorganization · 9
- Crucibleproduct · 7
- Atlassianvendor · 7
- Fisheyeproduct · 7
- watchTowrorganization · 6
- Bamboo Data Centerproduct · 5
- Confluence Data Centerproduct · 5
- Crowd Data Centerproduct · 5
- Bitbucket Data Centerproduct · 5
- Jira Software Data Centerproduct · 4
- Jira Service Management Data Centerproduct · 4
- SonicWallvendor · 4
- Microsoftvendor · 3
- Defused Cyberorganization · 3
- Defusedorganization · 3
- SMA 1000product · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.