[ { "value": "cybersecurefox.com", "type": "domain", "first_seen": "2026-09-09", "last_seen": "2026-10-13", "status": "active", "confidence": "corroborated", "n_sources": 36, "stories": [ "citrix-netscaler-unpatched-rce-zero-days", "cve-2026-56164-sharepoint-privilege-escalation-exploited", "proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom", "cve-2026-105192-unpatched-critical-rce-in-lmcache-cvss-9-8", "apple-patches-coregraphics-out-of-bounds-write-cve-2026-86950", "atlassian-bamboo-cve-2026-21589-critical-path-traversal-cvss-9-3", "cisa-adds-exploited-wso2-adobe-commerce-sharepoint-and-routeros", "cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws-h", "google-fixes-actively-exploited-android-zero-day-on-pixel-device", "wordpress-7-1-2-patches-a-critical-wordpress-rce-vulnerability-c", "1-basic-information-original-title-cloud-takeover-mass-scanning", "12-year-old-postgresql-flaw-lets-backup-accounts-execute-code-an", "3bb-breach-meshcentral-used-as-a-backdoor-in-the-provider-s-netw", "a-newly-kev-listed-cisco-ise-bug-lets-an-unauthenticated-attacke", "an-exploited-velocloud-vulnerability-with-a-10-0-cvss-score-hits", "an-issabel-pbx-vulnerability-exploited-in-active-attacks-allows", "chrome-153-google-fixes-230-vulnerabilities-including-5-critical", "cisco-patches-critical-zero-day-in-secure-email-gateway-cve-2026", "critical-n-able-n-central-flaw-enables-pre-auth-remote-code-exec", "critical-orkes-conductor-vulnerability-exploited-in-attacks", "cve-2026-12780-aomei-backupper-driver-opens-the-way-to-uefi-atta", "cve-2026-6485-high-8-2-uefi-bios-embedded-shell-could-be-used-to", "cve-2026-84869-critical-9-9-a-condition-in-the-screenconnect-cli", "cve-2026-85889-critical-flaw-in-azure-ai-foundry-missing-authent", "fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day", "gitlab-s-critical-flaw-is-already-drawing-internet-wide-probes", "high-severity-vulnerabilities-patched-in-openssl-wolfssl", "marimo-rce-flaw-lets-hackers-steal-aws-credentials-and-pivot-to", "microsoft-july-2026-patch-tuesday-record-622-cves-two-exploited", "microsoft-s-september-2026-patch-tuesday-fixes-two-zero-day-flaw", "oracle-peoplesoft-cve-2026-35273-cvss-9-8-mitigations-released-m", "red-heron-hackers-exploit-critical-gitea-rce-to-steal-source-cod", "researcher-nightmareeclipse-has-disclosed-bigdiskbuster-a-zero-d", "skullcandy-dime-3-bluetooth-flaw-lets-nearby-attackers-hijack-au", "ssrf-vulnerability-in-onlyoffice-plugin-for-owncloud-no-patch-av", "windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy" ], "sources": [ "https://cybersecurefox.com/en/cisa-critical-vulnerabilities-citrix-netscaler-adc-gateway-cve-2026-88771", "https://cybersecurefox.com/en/zero-day-cve-2026-88779-in-citrix-netscaler-saml", "https://cybersecurefox.com/en/critical-vulnerabilities-in-citrix-netscaler-cve-2026-88771-88772", "https://cybersecurefox.com/en/cve-2026-56164-privilege-escalation-sharepoint", "https://cybersecurefox.com/en/shieldcrash-bypass-patch-cve-2026-69414-microsoft-defender", "https://cybersecurefox.com/en/cve-2026-85880-windows-alpc-heap-overflow-privilege-escalation", "https://cybersecurefox.com/en/critical-rce-in-lmcache-no-patch", "https://cybersecurefox.com/en/cve-2026-86950-apple-coregraphics-targeted-attacks-patch", "https://cybersecurefox.com/en/critical-atlassian-vulnerability-cve-2026-21589", "https://cybersecurefox.com/en/critical-vulnerability-atlassian-data-center-cve-2026-21589", "https://cybersecurefox.com/en/cisa-kev-wso2-cve-2026-5430-adobe-commerce-cve-2026-71362", "https://cybersecurefox.com/en/cisa-kev-sharepoint-mikrotik-routeros-september-2026", "https://cybersecurefox.com/en/cisa-three-linux-kernel-vulnerabilities-kev-ktls-ebtables-af-alg", "https://cybersecurefox.com/en/cve-2026-58704-pixel-modem-privilege-escalation-cisa-kev", "https://cybersecurefox.com/en/cve-2026-87902-critical-lfi-in-wordpress-core", "https://cybersecurefox.com/en/cve-2026-39364-mass-scanning-vite-servers-cloud-credentials-theft", "https://cybersecurefox.com/en/postgresql-cve-2026-6471-logical-decoding", "https://cybersecurefox.com/en/3bb-breach-meshcentral-backdoor-fortigate-cve-2024-21762", "https://cybersecurefox.com/en/cve-2026-76460-cisco-ise-authentication-bypass-cvss-10-0", "https://cybersecurefox.com/en/cve-2026-93952-arista-velocloud-orchestrator-cvss-10-active-exploitation", "https://cybersecurefox.com/en/cve-2026-89026-issabel-framework-jwt-rce", "https://cybersecurefox.com/en/chrome-153-230-vulnerabilities-5-critical-webgl-cast", "https://cybersecurefox.com/en/cve-2026-76461-cisco-secure-email-gateway-sql-injection", "https://cybersecurefox.com/en/n-able-n-central-critical-rce-cve-2026-86218", "https://cybersecurefox.com/en/cve-2026-58138-orkes-conductor-unauthenticated-rce", "https://cybersecurefox.com/en/cve-2026-12780-aomei-backupper-amwrtdrv-uefi-vulnerability", "https://cybersecurefox.com/en/vu-718077-uefi-shell-spi-flash-secure-boot-bypass", "https://cybersecurefox.com/en/screenconnect-cve-2026-84869-wormable-vbscript", "https://cybersecurefox.com/en/cve-2026-85889-azure-ai-foundry-cvss-10-privilege-escalation", "https://cybersecurefox.com/en/critical-fortimail-vulnerability-cve-2026-104286", "https://cybersecurefox.com/en/cve-2026-85706-gitlab-cvss-10-file-reading", "https://cybersecurefox.com/en/cve-2026-84782-openssl-dtls-heap-memory-leak", "https://cybersecurefox.com/en/cve-2026-39987-marimo-rce-ssh-bastion-8-seconds", "https://cybersecurefox.com/en/cve-2026-56155-ad-fs-privilege-escalation-exploited", "https://cybersecurefox.com/en/cve-2026-81963-windows-update-stack-privilege-escalation", "https://cybersecurefox.com/en/shinyhunters-claims-fbi-breach-oracle-peoplesoft-cve-2026-35273", "https://cybersecurefox.com/en/red-heron-gitea-cve-2026-60004-rce-campaign", "https://cybersecurefox.com/en/bigdiskbuster-poc-blocks-microsoft-defender-updates", "https://cybersecurefox.com/en/skullcandy-dime-3-bluetooth-pairing-vulnerability-cve-2025-20701", "https://cybersecurefox.com/en/ssrf-onlyoffice-owncloud-plugin-cve-2026-84282", "https://cybersecurefox.com/en/cve-2026-68820-use-after-free-windows-afd-winsock-exploitation" ], "reason": "BlueMoon exploit kit infrastructure domain (Proofpoint, chaining Chrome/V8 + Windows ALPC)" }, { "value": "8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb", "type": "sha256", "first_seen": "2026-09-21", "last_seen": "2026-09-21", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom" ], "sources": [ "https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/" ], "reason": "CLEANGULP backdoor delivered by UTA0565 Chrome zero-day chain" } ]