STALE Last successful ingest finished — the hourly job may be failing.
319
community mentions of CVEs in the last 24 hours.
Loudest CVE-2026-109618 (not on the watchlist) — Upcoming critical PHP security release (CVE-2026-109618 / -109619) · 1452 points · 613 comments
watchlist
last 24 h
- advisories
- 474
- hacker news
- 16
- 14
- github
- 289
Social pulse
CVEs drawing advisories and conversation right now — ranked on this week's activity with a bonus for the last 24 hours.
On the watchlist
-
CVE-2026-63030+1/24h
-
CVE-2026-41853+1/24h
-
CVE-2026-41854+1/24h
-
CVE-2026-41839+1/24h
Elsewhere — not tracked yet
-
CVE-2026-109618+166/24h
-
CVE-2026-109619+109/24h
-
CVE-2026-108097+1/24h
-
CVE-2026-96652+1/24h
Threads — Hacker News & Reddit
- HN Upcoming critical PHP security release (CVE-2026-109618 / -109619) CVE-2026-109618
- HN Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming CVE-2026-109619CVE-2026-109618
- HN PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) CVE-2026-109618
- RDT What the PHP2Shell rumors got wrong, from inside the PHP security team CVE-2026-109618
- RDT Critical PHP2Shell Vulnerabilities (CVSS 9.2): CVE-2026-109618 & CVE-2026-109619 — Patch & Hunt Immediately CVE-2026-109618CVE-2026-109619
- HN PHP 8.2.35 CVE-2026-109619CVE-2026-109618
- HN Jesus Christ patch your shit now CVE-2026-109618
- HN For those who can't patch their PHP on their environment, use this proxy CVE-2026-109618
- HN PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out CVE-2026-109618
- HN What the PHP2Shell rumors got wrong, from inside the PHP security team CVE-2026-109618
- HN Simple Proxy to secure your PHP from vulnerability CVE-2026-109618 CVE-2026-109618
- HN Check/probe tool for PHP CVE-2026-109618/619 CVE-2026-109618
Trending on the watchlist
Ranked by trend score — KEV, EPSS and its 24 h move, public PoC, severity, advisories and chatter, halving every 30 days. How it's scored
| CVE | Score | Sev | CVSS | EPSS | Signals | Tech | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-104935 | 55.8 | N/A | — | 26.0% | KEVNUCLEI ↗ | Pulse Secure | — |
| CVE-2026-25243 | 50.8 | HIGH | 8.8 | 3.7% | KEVPOC | Redis | 2026-05-05 |
| CVE-2026-87902 | 38.3 | N/A | — | 40.0% | KEVNUCLEI ↗ | WordPress | — |
| CVE-2026-85706 | 31.8 | N/A | — | 92.0% ▼1.0 | KEVNUCLEI ↗ | GitLab | — |
| CVE-2025-61624 | 31.7 | MED | 6.0 | 1.1% ▲0.5 | KEVADV 1 | Fortinet FortiOS | 2026-04-14 |
| CVE-2026-65600 | 30.2 | MED | 5.3 | 0.6% | KEV | Traefik | 2026-07-22 |
| CVE-2026-97229 | 24.5 | CRIT | 10.0 | 0.5% | POCBUZZ 1 | GitLab | 2026-10-13 |
| CVE-2025-25252 | 21.7 | MED | 4.8 | 0.3% | KEVPOC | Fortinet FortiOS | 2025-10-14 |
| CVE-2025-25249 | 21.1 | HIGH | 8.1 | 3.8% | KEVPOC | Fortinet FortiOS | 2026-01-13 |
| CVE-2026-63292 | 16.1 | HIGH | 7.5 | 0.9% | POC | Apache HTTP Server | 2026-10-01 |
| CVE-2026-63030 | 15.1 | N/A | — | 10.6% | KEVNUCLEI ↗BUZZ 3 | WordPress | — |
| CVE-2026-20349 | 13.9 | HIGH | 8.6 | 1.0% | KEVPOCBUZZ 1 | Cisco ASA | 2026-08-11 |
Climbing fastest
What is accelerating, not just what is big.
Score climbing
Needs a second day of snapshots — starts tomorrow.
Cooling down
Needs a second day of snapshots — starts tomorrow.
EPSS rising · 7 d
- CVE-2022-37454 +1.7 pts→ 7.4% PHP, Python (CPython)
- CVE-2020-13671 +0.8 pts→ 36.2% Drupal
- CVE-2022-21826 +0.8 pts→ 46.0% Pulse Secure
- CVE-2025-61624 +0.5 pts→ 1.1% Fortinet FortiOS
- CVE-2025-8723 +0.5 pts→ 18.0% Cloudflare
- CVE-2016-2102 +0.3 pts→ 2.3% HAProxy
- CVE-2023-44271 +0.2 pts→ 1.3% Python (CPython)
- CVE-2021-4189 +0.2 pts→ 3.4% Python (CPython)
Chatter accelerating
- CVE-2026-63030 +1/24h WordPress
- CVE-2025-27515 rising Laravel
What changed
KEV listings added in the last 24 h; PoCs, nuclei templates and CVEs first seen by Onyx since .
New KEV listings 1
New public PoCs 0
Nothing new.
New nuclei templates 0
Nothing new.
Newly tracked 2753
- CVE-2026-104935 N/A Pulse Secure
- CVE-2026-25243 HIGH Redis
- CVE-2026-87902 N/A WordPress
- CVE-2025-61624 MED Fortinet FortiOS
- CVE-2026-65600 MED Traefik
- CVE-2026-97229 CRIT GitLab
- CVE-2025-25252 MED Fortinet FortiOS
- CVE-2025-25249 HIGH Fortinet FortiOS
+2745 more
KEV additions per month
watchlist techs, last 12 monthstable
| Month | KEV additions |
|---|---|
| Nov 25 | 0 |
| Dec | 3 |
| Jan 26 | 1 |
| Feb | 2 |
| Mar | 2 |
| Apr | 3 |
| May | 3 |
| Jun | 2 |
| Jul | 4 |
| Aug | 1 |
| Sep | 4 |
| Oct | 4 |
New CVEs per tech per week
by publish date, last 12 weeks0140new CVEs / week
table
| Tech | Aug 3 | Aug 10 | Aug 17 | Aug 24 | Aug 31 | Sep 7 | Sep 14 | Sep 21 | Sep 28 | Oct 5 | Oct 12 | Oct 19 | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MongoDB | 0 | 7 | 0 | 23 | 10 | 40 | 14 | 0 | 0 | 6 | 0 | 0 | 100 |
| GitLab | 0 | 13 | 2 | 7 | 0 | 1 | 15 | 7 | 4 | 0 | 24 | 0 | 73 |
| Elasticsearch | 0 | 14 | 0 | 0 | 4 | 0 | 0 | 7 | 0 | 10 | 0 | 0 | 35 |
| PostgreSQL | 0 | 28 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 28 |
| Jenkins | 4 | 0 | 0 | 0 | 12 | 0 | 8 | 0 | 0 | 0 | 0 | 0 | 24 |
| .NET | 0 | 11 | 0 | 0 | 0 | 5 | 0 | 0 | 0 | 0 | 5 | 0 | 21 |
| Apache HTTP Server | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 20 | 0 | 0 | 0 | 20 |
| Spring Framework | 0 | 0 | 0 | 17 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 17 |
| Traefik | 4 | 0 | 0 | 0 | 4 | 9 | 0 | 0 | 0 | 0 | 0 | 0 | 17 |
| Cloudflare | 1 | 1 | 0 | 0 | 1 | 3 | 0 | 2 | 0 | 2 | 3 | 0 | 13 |
| Envoy Proxy | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 13 | 0 | 0 | 0 | 0 | 13 |
| GitHub Actions | 1 | 3 | 1 | 2 | 1 | 0 | 2 | 0 | 1 | 1 | 0 | 0 | 12 |
| Next.js | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 7 | 0 | 0 | 0 | 7 |
| Akamai | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 5 | 0 | 5 |
| Django | 4 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| Exim | 0 | 0 | 0 | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 0 | 4 |
| Python (CPython) | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 3 | 0 | 0 | 0 | 4 |
| Vue.js | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 4 |
| Fortinet FortiOS | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| Cisco ASA | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
Most discussed on the watchlist
Tracked CVEs cited by CERT / vendor advisories or talked about on HN, Reddit and GitHub in the last 7 days.
| CVE | Adv | Mentions | Where | Sev | Tech | Score |
|---|---|---|---|---|---|---|
| CVE-2026-63030 KEV | 0 | 3 | GH 3 | N/A | WordPress | 15.1 |
| CVE-2025-61624 KEV | 1 | 0 | — | MED | Fortinet FortiOS | 31.7 |
| CVE-2026-47883 | 1 | 0 | — | MED | Spring Framework | 11.5 |
| CVE-2026-14669 | 1 | 0 | — | HIGH | PostgreSQL | 9.6 |
| CVE-2026-14662 | 1 | 0 | — | HIGH | PostgreSQL | 9.6 |
| CVE-2026-6471 | 1 | 0 | — | HIGH | PostgreSQL | 9.5 |
| CVE-2026-48931 | 1 | 0 | — | LOW | Node.js | 6.5 |
| CVE-2026-15741 | 1 | 0 | — | HIGH | PostgreSQL | 5.1 |
| CVE-2026-18408 | 1 | 0 | — | HIGH | PostgreSQL | 5.1 |
| CVE-2026-14666 | 1 | 0 | — | MED | PostgreSQL | 5.0 |
| CVE-2026-56850 | 1 | 0 | — | MED | Node.js | 5.0 |
| CVE-2026-41855 | 1 | 0 | — | HIGH | Spring Framework | 5.0 |
| CVE-2026-41850 | 1 | 0 | — | HIGH | Spring Framework | 5.0 |
| CVE-2026-41842 | 1 | 0 | — | HIGH | Spring Framework | 5.0 |
| CVE-2026-41845 | 1 | 0 | — | HIGH | Spring Framework | 5.0 |
Discussed, not on the watchlist
Talked about, but no watchlist tech matches them yet — too new for vulnx, or outside the watchlist. Worth a look.
-
CVE-2026-109618 ADV 4 BUZZ 164 +166/24h GH 145 · HN 13 · RDT 6 ·
- GH unbelievable-digital/is-my-php-pwned — Did php2shell (CVE-2026-109618/109619) already own your servers? One read-only script to find out.
- GH nirzadokox/php2shell-vulnerability-check-for-CVE-2026-109618-CVE-2026-109619 — vulnerability check for CVE-2026-109618 / CVE-2026-109619
- GH denizkoekden/php56-el-backports — PHP 5.6.40 with the deb.sury.org security backports (incl. CVE-2026-109618/109619), rebuilt as RPMs for CentOS/RHEL 6 and 7
- RDT What the PHP2Shell rumors got wrong, from inside the PHP security team
- GH maikbehring/php-notbetrieb — Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
- GH luivc1/php-vuln-responder — Agent plugin to scan, patch, verify and check for compromise after critical PHP vulnerabilities (PHP2Shell CVE-2026-109618/109619).
- GH Liam-G/php2shell-audit — Non-destructive scanner for CVE-2026-109618 and CVE-2026-109619
- GH adamtamenne/php2shell-lab — Docker lab for reproducing CVE-2026-109618 and CVE-2026-109619 (php2shell), OOM corruption and stale global state RCE in PHP core
-
CVE-2026-109619 ADV 4 BUZZ 107 +109/24h GH 99 · HN 4 · RDT 4 ·
- GH nirzadokox/php2shell-vulnerability-check-for-CVE-2026-109618-CVE-2026-109619 — vulnerability check for CVE-2026-109618 / CVE-2026-109619
- GH maikbehring/php-notbetrieb — Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
- GH Liam-G/php2shell-audit — Non-destructive scanner for CVE-2026-109618 and CVE-2026-109619
- GH adamtamenne/php2shell-lab — Docker lab for reproducing CVE-2026-109618 and CVE-2026-109619 (php2shell), OOM corruption and stale global state RCE in PHP core
- GH josemingorance/php74-php2shell-backport-docker — php:7.4-fpm rebuilt from source with the official PHP2Shell backport (CVE-2026-109618 / CVE-2026-109619): the three things that break a 7.4
- RDT Critical PHP2Shell Vulnerabilities (CVSS 9.2): CVE-2026-109618 & CVE-2026-109619 — Patch & Hunt Immediately
- GH kiran-ox/php2shell-check — Read-only checker for PHP2Shell (CVE-2026-109618, CVE-2026-109619): finds vulnerable PHP, services still running old code after an update, a
- GH julio-romo-muninn/PHP2SHELL — Isolated Docker lab to verify CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress cross-request UAF -> RCE)
-
CVE-2026-99999 BUZZ 20 GH 10 · HN 8 · RDT 2 ·
- GH 01luyicheng/CVE-2026-99999-exploit — CVE-2026-99999 Working PoC — real VM escape for Linux kernel csum_start bug (CVSS 9.3). Guest-to-Host heap leak. See also: CVE-2026-99999-an
- GH 01luyicheng/CVE-2026-99999-analysis — CVE-2026-99999 Educational Analysis — attack chain simulation of Linux kernel csum_start bug (CVSS 9.3). See also: CVE-2026-99999-exploit (W
- GH sqzer-x/cve-2026-99999-scanner — Checks whether a Linux system is affected by CVE-2026-99999 (PwnEscape) and prints or applies the distribution-specific kernel fix
- GH alvaroguzmancode/CVE-2026-99999
- GH nsrg-fmlorg/kpatch-rocky-cve-2026-99999 — kpatch livepatch build and load test for CVE-2026-99999 on Rocky Linux 8.10 (4.18.0-553.144.1.el8_10)
- HN PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
- GH shizuku198411/CVE-2026-99999-KVM-checksum-metadata-non-destructive-PoC
- GH gandli/CVE-2026-99999-pwnescape — CVE-2026-99999 (PwnEscape) reproduction: IPv4 csum_start validation bug — IHL rewrite and 32-byte kernel heap disclosure
-
CVE-2026-108097 ADV 1 BUZZ 4 +1/24h GH 2 · RDT 2 ·
-
CVE-2026-64560 ADV 1 BUZZ 4 GH 4 ·
- GH Yunnijian/OnePlus16-Jailbreak — OnePlus 16 (PYB110) jailbreak: CVE-2026-64560 + KernelSU / KernelSU Next / BakaSU / SukiSU Ultra LKM
- GH Feng1586/CVE-2026-64560-sources — Corresponding source for the CVE-2026-64560 public binaries
- GH Feng1586/CVE-2026-64560-public — CVE-2026-64560 staged security research package
- GH ChaYeWuu/prague-CVE-2026-64560-OS4.0 — REDMI K90 Max在OS4.0.0.14.XAACNXM利用CVE-2026-64560获取ROOT权限。
- ADV Multiples vulnérabilités dans le noyau Linux d'Ubuntu (16 octobre 2026)
-
CVE-2026-96652 ADV 1 BUZZ 3 +1/24h GH 3 ·
- GH w116tjb/plex2shell-windows-hunt — Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script
- ADV CISA Adds Six Known Exploited Vulnerabilities to Catalog
- GH ChrisLPJones/plex2shell-check — Read-only Linux check for Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) exploitation and the XMRig/proxy payloads seen in the wild
- GH code-zm/plex2shell — CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
-
CVE-2026-106173 BUZZ 4 +1/24h GH 2 · HN 1 · RDT 1 ·
- HN CVE-2026-106173: FortiSIEM gRPC Path Traversal RCE
- GH 0xBlackash/CVE-2026-106173 — CVE-2026-106173
- RDT CVE-2026-106173 Deep-Dive: Fortinet FortiSIEM gRPC Path Traversal File Write to RCE
- GH horizon3ai/CVE-2026-106173 — Proof of concept exploit for CVE-2026-106173, a path traversal file write leading to RCE for Fortinet FortiSIEM
-
CVE-2026-98260 BUZZ 3 GH 3 ·
-
CVE-2026-43499 BUZZ 4 GH 4 ·
- GH Romk-a/CVE-2026-43499-ghostlock-vivo-x100-ultra-root — GhostLock: Android kernel root exploit for Vivo X100 Ultra (PD2366) via CVE-2026-43499 PI-futex race. KernelSU integration with vr.ko anti-r
- GH AuroraMythweaver/iqoo-neo9-ghostlock-pc — GhostLock (CVE-2026-43499) PC-side driver for iQOO Neo9 (PD2338): boot-window campaign over adb, temporary root via KernelSU late-load. One
- GH Escosis/V2463A-LPE — 基于 CVE-2026-43499 的锁屏界面自动提权工具，面向 iQOO Neo10 Pro+ 及相同芯片（骁龙8e）相同系统版本（OriginOS 6）设备
- GH MSEDGE-CORE/GhostLock-HonorFne — Honor 70 (FNE-AN00) privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loading
Recent KEV additions
Watchlist CVEs CISA lists as exploited in the wild, newest first.
| Added | CVE | Sev | Tech | Score |
|---|---|---|---|---|
| 2026-10-21 | CVE-2026-65600 | MED | Traefik | 30.2 |
| 2026-10-17 | CVE-2026-25243 POC | HIGH | Redis | 50.8 |
| 2026-10-16 | CVE-2025-61624 | MED | Fortinet FortiOS | 31.7 |
| 2026-10-13 | CVE-2026-104935 | N/A | Pulse Secure | 55.8 |
| 2026-09-25 | CVE-2026-87902 | N/A | WordPress | 38.3 |
| 2026-09-11 | CVE-2026-85706 | N/A | GitLab | 31.8 |
| 2026-09-11 | CVE-2025-25252 POC | MED | Fortinet FortiOS | 21.7 |
| 2026-09-09 | CVE-2025-25249 POC | HIGH | Fortinet FortiOS | 21.1 |
| 2026-08-11 | CVE-2026-20349 POC | HIGH | Cisco ASA | 13.9 |
| 2026-07-27 | CVE-2025-68686 | MED | Fortinet FortiOS | 4.9 |
| 2026-07-23 | CVE-2025-62631 | MED | Fortinet FortiOS | 3.8 |
| 2026-07-21 | CVE-2026-63030 | N/A | WordPress | 15.1 |
| 2026-07-21 | CVE-2026-60137 POC | MED | WordPress | 9.6 |
| 2026-06-15 | CVE-2026-53435 POC | HIGH | Jenkins | 2.9 |
| 2026-06-15 | CVE-2026-54420 | N/A | LiteSpeed Web Server | 1.5 |
Recent public PoCs
| CVE | Score | Sev | CVSS | EPSS | Signals | Tech | Published |
|---|---|---|---|---|---|---|---|
| CVE-2011-3187 | <0.1 | MED | 4.3 | 6.7% | POC | Ruby on Rails | 2011-08-29 |
| CVE-2026-20349 | 13.9 | HIGH | 8.6 | 1.0% | KEVPOCBUZZ 1 | Cisco ASA | 2026-08-11 |
| CVE-2026-22153 | 0.1 | HIGH | 8.1 | 0.8% | POC | Fortinet FortiOS | 2026-02-10 |
| CVE-2026-24858 | 0.2 | CRIT | 9.8 | 85.8% | KEVPOC | Fortinet FortiOS | 2026-01-27 |
| CVE-2025-25249 | 21.1 | HIGH | 8.1 | 3.8% | KEVPOC | Fortinet FortiOS | 2026-01-13 |
| CVE-2025-59718 | 0.1 | CRIT | 9.8 | 68.3% | KEVPOC | Fortinet FortiOS | 2025-12-09 |
| CVE-2025-25252 | 21.7 | MED | 4.8 | 0.3% | KEVPOC | Fortinet FortiOS | 2025-10-14 |
| CVE-2025-25253 | <0.1 | HIGH | 7.5 | 0.1% | POC | Fortinet FortiOS | 2025-10-14 |
| CVE-2025-25255 | <0.1 | MED | 5.3 | 0.4% | POC | Fortinet FortiOS | 2025-10-14 |
| CVE-2025-20333 | <0.1 | CRIT | 9.9 | 71.2% | KEVPOC | Cisco ASA | 2025-09-25 |
Store
- rows by source
- kev 97 · vulnx 2855 ·
- epss-scored
- 2911 of 2912
- watchlist
- 43 techs, 42 with records