CVE-2026-0257

Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials

FortiGate GlobalProtect attacks by suspected initial access broker k0t against network edge devices

Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials

Do Son October 23, 2026

At a glance Actor Operator using the alias “k0t,” with suspected collaborators; possible initial access broker Activity...

Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access CVE-2026-0257 GlobalProtect authentication bypass exploited by ransomware gangs to open VPN sessions

CVE-2026-0257 GlobalProtect authentication bypass exploited by ransomware gangs to open VPN sessions

Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access

Do Son October 20, 2026

At a glance Malware family Qilin, Inc, and Settra ransomware; Cobalt Strike and BloodHound in related activity...

Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud Operation Master invoice fraud pipeline from GlobalProtect VPN breach to fake utility bills

Operation Master invoice fraud pipeline from GlobalProtect VPN breach to fake utility bills

Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud

Do Son September 29, 2026

Fake energy bills went out to Brazilian customers more than 2.4 million times this summer. Each one...

Qilin Ransomware Deployed via Palo Alto GlobalProtect Flaw CVE-2026-0257 Qilin ransomware attack chain starting with a Palo Alto GlobalProtect CVE-2026-0257 authentication bypass

Qilin ransomware attack chain starting with a Palo Alto GlobalProtect CVE-2026-0257 authentication bypass

Qilin Ransomware Deployed via Palo Alto GlobalProtect Flaw CVE-2026-0257

Do Son July 21, 2026

During June 2026, Arctic Wolf Labs traced several ransomware intrusions to one entry point. Attackers exploited a...

PAN-OS Authentication Bypass Flaw Exploited in the Wild

PAN-OS authentication bypass flaw exploited in the wild

PAN-OS Authentication Bypass Flaw Exploited in the Wild

Do Son May 30, 2026

Serious Attacks Hit GlobalProtect VPN Gateways A dangerous security vulnerability is currently impacting enterprise perimeter networks across...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 27, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 27, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 27, 2026
CVE-2026-106173CVSS 9.8
A improper limitation of a pathname to a restricted directory (\'path traversal\') vulnerability in Fortinet FortiSIEM 7.5.0 may...
Admin intel📅 Updated: Oct 25, 2026
CVE-2014-125133CVSS 8.7
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary...
Watchtower Verified📅 Updated: Oct 24, 2026
CVE-2015-20128CVSS 8.8
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries...
Watchtower Verified📅 Updated: Oct 24, 2026
CVE-2016-20104CVSS 8.7
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to...
Watchtower Verified📅 Updated: Oct 24, 2026
CVE-2026-110447CVSS 9.2
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in...
CISA KEV📅 Added to KEV: Oct 23, 2026

CVE-2023-25693CVSS 9.8
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions...
📅 Updated: Oct 26, 2026
CVE-2025-67108CVSS 10.0
eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.
📅 Updated: Oct 26, 2026
CVE-2025-50526CVSS 9.8
Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function.
📅 Updated: Oct 26, 2026
CVE-2025-29229CVSS 9.8
linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus.
📅 Updated: Oct 26, 2026
CVE-2025-51511CVSS 9.8
Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.
📅 Updated: Oct 26, 2026
CVE-2026-33976CVSS 9.6
Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS...
📅 Updated: Oct 26, 2026
CVE-2026-5288CVSS 9.6
Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who...
📅 Updated: Oct 26, 2026
CVE-2026-5289CVSS 9.6
Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised...
📅 Updated: Oct 26, 2026