Attackers exploit max-severity GitLab flaw CVE-2026-97229
The integer overflow allows unauthenticated code execution through a crafted CI/CD regular expression; fixes are 19.4.2, 19.3.5, and 19.2.8.
84
Organization
Shadowserver
- Mentions · 7d3
- Mentions · 30d11
- All mentions24
- First seenAug 21, 2026
- Last mentioned20h ago
Timeline
24 articles · newest firstCisco ASA and FTD SSL VPN zero-day crashed firewalls in attacks
Unauthenticated attackers can reload devices that have webvpn and SSL VPN enabled; Cisco found exploitation in October 2026.
78
Attackers scan for patched Oracle E-Business Suite flaw CVE-2026-101767
Defused saw exploratory SQL-injection exploits on decoys on October 27; Oracle has not marked the bug exploited.
74
GitLab patches max-severity regex compiler RCE (CVE-2026-110264)
An unauthenticated integer overflow can run arbitrary code; GitLab.com is already on the patched release.
78
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
87
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco patched actively exploited Secure Email Gateway zero-day CVE-2026-76519 enabling unauthenticated root execution.
86
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
CISA says patch Ivanti Connect Secure CVE-2026-104935, exploited as a zero-day for unauthenticated command execution.
88
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers exploit max-severity SonicWall SMA1000 flaw CVE-2026-102255 three days after patch; Previdian honeypots captured matching exploitation attempts.
85
Citrix warns admins to patch new NetScaler RCE flaw immediately
Citrix urges immediate patches for critical NetScaler RCE CVE-2026-107406, with no known exploitation yet.
76
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall patches maximum-severity unauthenticated SSRF CVE-2026-102255 in SMA1000 gateways; no exploitation reported.
76
Kiteworks patches max severity code injection vulnerability
Kiteworks patched CVE-2026-54154, an unauthenticated code-injection flaw that can give attackers root on Email Protection Gateway appliances.
74
Kiteworks patches critical flaw, brings customer systems online
Kiteworks patched a critical flaw and lifted a global shutdown advisory after finding no compromise.
66
CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA ordered federal agencies to patch two exploited critical Citrix NetScaler RCE flaws by September 30.
92
Hackers now exploit critical Roundcube flaw in code injection attacks
Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.
78
When Business Email Compromise Starts Rewriting Reality
Rapid7 and Zimbra research details 50+ Zimbra flaws enabling BEC attacks that impersonate senders, rewrite documents, and manipulate calendars.
62
F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127 for unauthenticated remote code execution.
88
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
85
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
F5 patched actively exploited BIG-IP APM zero-day CVE-2026-94127 enabling remote code execution; CISA added it to KEV with a federal patch deadline.
87
Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.
74
Critical ScreenConnect flaw now actively exploited in attacks
CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.
82
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
CISA confirms ransomware gangs are exploiting critical unauthenticated RCE CVE-2025-14733 in WatchGuard Firebox firewalls, with roughly 9,000 devices still unpatched.
80
ConnectWise warns of new ScreenConnect flaw without patch
ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.
60
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.
78
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
78
Related CVEs
by mentions- CVE-2026-154097%10.0Unauthenticated SSRF in SonicWall SMA1000 Appliances
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-9412725%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2025-39354%7.2ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE
- CVE-2026-102255<1%10.0Pre-auth SSRF in SonicWall SMA1000 Work Place interface
Appears with
- CISAorganization · 15
- Citrixvendor · 3
- Kiteworks Private Content Networkproduct · 2
- SpyCloudorganization · 2
- OpenAIorganization · 2
- APT28threat actor · 2
- Microsoftvendor · 2
- ScreenConnectproduct · 2
- Ciscovendor · 2
- ConnectWisevendor · 2
- Coinbaseorganization · 2
- Kiteworksvendor · 2
- Ivanti Connect Secureproduct · 2
- NetScaler Gatewayproduct · 2
- Ivantivendor · 2
- NetScaler ADCproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.