Emerging BETA · EXPERIMENTAL RSS ↗
Emerging is a BETA feed that watches a curated set of trusted security-news outlets and links what they report to the 653 products IsItPatched tracks — often ahead of full NVD enrichment. Every item is attributed to its source and links out; IsItPatched never asserts its own findings here. Right now it surfaces 120 machine-linked reports, 13 describing active exploitation.
⚠ Items are machine-linked third-party reporting and may be wrong. Each shows its source and links out — we never assert our own findings here. Treat low-confidence items as leads, and always verify against the source and the vendor advisory.
120
linked reports · last 45 days
13
describing active exploitation
91
CVEs referenced
See news about the software you run Add your products to My Stack and Emerging flags reporting that hits them — a violet node on the graph, “you run this” on the feed.
Open My Stack → Sign in free → Monday 2 November
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
No items match.
Unlock the full newsroom — free 115 more linked reports, the live Connections graph, filters, and “you run this” flags on software in your stack.
Sign in free → or RSS ↗ Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Alpine Linux rebuilds GitLab after attempted RCE attack
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
New Android SMS of Death exploit can remotely crash unpatched phones
Chromium: CVE-2026-118304 Improper input validation in SVG
Chromium: CVE-2026-118313 Use after free in Video
Chromium: CVE-2026-118311 Memory corruption in Media
Chromium: CVE-2026-118317 Memory corruption in HTML
Chromium: CVE-2026-118315 Improper input validation in SVG
Chromium: CVE-2026-118312 Memory corruption in Paint
Chromium: CVE-2026-118316 Improper input validation in V8
Chromium: CVE-2026-118318 Improper access control in V8
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Devs Hit by Trojanized Claude Code Extension for Cursor
Vulnerabilities in Node.js Affecting Cisco Products: October 2026
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Anthropic: That Claude Code extension compromise… couldn't be us
Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Malicious Claude Code extension on Cursor planted SSH backdoors
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)
Cisco Finesse Server-Side Request Forgery Vulnerability
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability
ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability
ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability
ZDI-26-840: MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability
ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-838: FreeBSD Kernel TTY Race Condition Local Privilege Escalation Vulnerability
ZDI-26-837: Linux Kernel XFRM Subsystem Use-After-Free Local Privilege Escalation Vulnerability
ZDI-26-836: Linux Kernel CIFS File System Use-After-Free Privilege Escalation Vulnerability
ZDI-26-835: Linux Kernel Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation Vulnerability
ZDI-26-834: Linux Kernel IPv6 AH Routing Header Integer Underflow Local Privilege Escalation Vulnerability
GitLab Patch Release and Security Update: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Wazuh and AI for Enhanced SOC Workflows
Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own
ZDI-26-832: AVG Internet Security avgToolsSvc Link Following Local Privilege Escalation Vulnerability
ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability
ZDI-26-829: (0Day) (Pwn2Own) Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability
SVD-2026-1015: Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026
EPICS Base
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Alibaba's Qwen AI caught trying to contact server in China
LiteLLM supply chain attack started with an exposed master key
Microsoft releases emergency .NET security fixes for Google Brotli bug
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Node2Shell CVEs
How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943)
Metasploit Wrap Up: Langflow, MongoDB, and More
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
CISA Adds One Known Exploited Vulnerability to Catalog
Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
Max-severity GitLab bug allows remote code execution over 12 years of releases
Siemens RUGGEDCOM APE1808 Devices
InterSystems Corporation InterSystems IRIS for Health
Siemens Software Center
Siemens SIMATIC S7 PLCs Web Server
Kiloview E3 NDI Encoder
SVD-2026-1013: Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026
LiteLLM supply chain attack hoovers up passwords and secrets
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
The Science of Exploitability: Decoding BlueHammer
PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now
GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
SVD-2026-1009: Third-Party Package Updates in Splunk Enterprise - October 2026
SVD-2026-1008: Security Hardening in Splunk Enterprise - October 2026
SVD-2026-1007: Security Vulnerabilities in Splunk Enterprise - October 2026
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Severity: HIGH)
CVE-2026-0320 PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIUM)
CVE-2026-0321 PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services (Severity: MEDIUM)
CVE-2026-0317 PAN-OS: Denial of Service Vulnerability (Severity: LOW)
CVE-2026-0316 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability (Severity: LOW)
Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability (Severity: MEDIUM)
CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (Severity: LOW)
CVE-2026-0315 GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (Severity: MEDIUM)
CVE-2026-0312 Checkov by Prisma Cloud: Path Traversal Vulnerabilities (Severity: MEDIUM)
CVE-2026-0314 GlobalProtect App: Local Denial of Service (DoS) on Windows (Severity: MEDIUM)
CVE-2026-0318 PAN-OS: Denial of Service (DoS) on Panorama (Severity: MEDIUM)
CVE-2026-0319 PAN-OS: Improper Input Handling Vulnerability (Severity: MEDIUM)
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
Cisco NX-OS Software Python Sandbox Escape Vulnerability
Cisco NX-OS Software Control Plane Denial of Service Vulnerability
How this week’s reporting connects — 22 products, 44 CVEs and 14 sources. Lines are attributed links from the items above; positions are illustrative. Tap a node to open it. Violet = software in your stack.
In your stack Product CVE CVE (exploited) Source
Prefer the list? Switch back to . The graph is a visual aid; the timeline above carries every item with full attribution.
About this BETA
Emerging ingests only a hard-coded allow-list of trusted outlets — first-party vendor advisories (Microsoft MSRC, Cisco PSIRT, Fortinet, Palo Alto, Ivanti), security research (Google Project Zero, Rapid7, Qualys) and established reporting (CISA, Krebs on Security, BleepingComputer, The Hacker News, SecurityWeek, Dark Reading, The Register) — no open-web crawl, no social feeds, no user submissions. We store and show only a headline, the source, the time, an outbound link and (where available) a short own-words takeaway — never article text. Links between a report and a product or CVE are made by software and carry a confidence level; they can be wrong. This is an early experiment in linking breaking reporting to the software you actually run — tell us when we get a link wrong →.
Newest first · refreshes on every sync · sources retain all rights to their reporting. See our disclaimer.