862 incidents in developer software that FixLane serves, newest first. Each page shows the severity, whether the flaw is exploited in the wild, and the fixed version verified against a vendor or advisory source. The fix procedure for your system comes from the Telegram bot or the MCP server. Explained in plain words: guides. Raw NVD records: CVEs.
| Published | Incident | Severity | Fixed in |
|---|
| 2026-11-15 | MCP Server for WordPress privilege escalation flaw (up to 2.0.3) | high | |
| 2026-11-14 | Malicious wfx-loot npm package steals GitHub Actions secrets | | |
| 2026-11-14 | Kava Lend hacked | | |
| 2026-11-13 | Malicious npm package wfx steals credentials via postinstall | | |
| 2026-11-13 | Malware found in QBase drone ground-control software update | | |
| 2026-11-13 | ContextForge MCP Gateway header can override upstream credentials | high | 1.1.1 |
| 2026-11-13 | ContextForge MCP Gateway replays or leaks user identity claims | high | 1.1.1 |
| 2026-11-13 | Pennysia hacked | | |
| 2026-11-13 | ExcelJS lets crafted addImage paths read any local file | high | |
| 2026-11-13 | FrankenPHP Docker images before 1.1.11 ship stale system libraries | critical | 1.1.11 |
| 2026-11-12 | wfx-loot campaign uses stolen GitHub accounts to push malware | | |
| 2026-11-12 | pgEdge Postgres MCP Server SQL injection in custom pl-do tools | high | 1.1.0 |
| 2026-11-12 | pgEdge Postgres MCP Server read-only mode could allow database writes | high | 1.1.0 |
| 2026-11-12 | MongoDB Node.js driver DNS SRV flaw redirects connections | high | 7.8.0 |
| 2026-11-12 | Windows CLFS SignDrop zero-day gives SYSTEM via Defender | | |
| 2026-11-12 | Windows SignDrop zero-day grants attackers SYSTEM privileges | | |
| 2026-11-12 | Docker Sandboxes reuses unowned state directories when run as root | high | 0.53.0 |
| 2026-11-12 | Chrome 157 and Firefox 160 fix over 180 security flaws | | |
| 2026-11-12 | RMM+ ScreenConnect extension accepts blank access key | | |
| 2026-11-12 | PapaParse CSV parsing DoS before 5.7.1 (CVE-2026-127056) | high | 5.7.1 |
| 2026-11-12 | WFX script in GitHub Actions steals secrets and deletes its traces | | |
| 2026-11-12 | CI secret stealer pushed through compromised GitHub accounts | | |
| 2026-11-11 | Chrome ANGLE flaw lets a crafted web page bypass same-origin policy | high | 157.0.8103.78 |
| 2026-11-11 | Chrome Accessibility use-after-free lets pages run code in sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in BrowserTag allows sandboxed code execution | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Layout (CVE-2026-126918) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 memory corruption lets a webpage run code (CVE-2026-126917) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 integer overflow (CVE-2026-126916) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome Skia buffer overflow lets code run outside the sandbox | critical | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Accessibility lets pages run code | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion lets web pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Passwords runs code outside the sandbox | critical | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion flaw (CVE-2026-126908) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 flaw lets web pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Use-after-free in Chrome PDF handling (CVE-2026-126901) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome CSS use-after-free fixed in 157.0.8103.78 | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Elements (CVE-2026-126899) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion lets a web page run code inside the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 origin policy bypass in versions before 157.0.8103.78 | high | 157.0.8103.78 |
| 2026-11-11 | Chrome CSS use-after-free lets pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 out of bounds write allows code execution in sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome MediaStream use-after-free runs attacker code in sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome Media out-of-bounds read allows sandbox code execution | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 off-by-one bug lets web pages run code inside the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome Turbolev buffer overflow allows code execution via web pages | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Animation allows sandboxed code execution | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Frames lets web pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in ServiceWorker (CVE-2026-126885) | critical | 157.0.8103.78 |
| 2026-11-11 | Chrome media bug lets web pages run code outside the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion lets a web page run code (CVE-2026-126880) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Layout lets pages run code (CVE-2026-126879) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome Skia integer overflow lets a web page run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 origin policy bypass (CVE-2026-126875) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion bug allows code execution via web page | high | 157.0.8103.78 |
| 2026-11-11 | Chrome Extensions use-after-free allows code execution outside sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome FileSystem flaw lets crafted pages run code outside sandbox | critical | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Frames allows code execution in sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion flaw lets web pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free flaw allows code execution outside sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome extension authorization flaw allows sandboxed code execution | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in DOM lets pages run code (CVE-2026-126865) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 use-after-free lets a web page run code (CVE-2026-126864) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in HTML lets pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Media lets web pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome FileSystem flaw lets code run outside the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome sandbox escape via crafted link in FileSystem | critical | 157.0.8103.78 |
| 2026-11-11 | Chrome MediaStream use-after-free executes code (CVE-2026-126852) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Accessibility allows sandboxed code execution | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion lets web pages run code (CVE-2026-126849) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome V8 type confusion lets a webpage run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Skia (CVE-2026-126846) | critical | 157.0.8103.78 |
| 2026-11-11 | Chrome Turbolev type confusion lets pages run code in the sandbox | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in ANGLE allows code execution outside sandbox | critical | 157.0.8103.78 |
| 2026-11-11 | Chrome sandbox code execution via out-of-bounds write in network | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Compositing (sandbox escape) | high | 157.0.8103.78 |
| 2026-11-11 | Chrome sandbox escape CVE-2026-126902 fixed in 157.0.8103.78 | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free lets a sandboxed attacker run code | high | 157.0.8103.78 |
| 2026-11-11 | Chrome use-after-free in Dawn sandbox escape | high | 157.0.8103.78 |
| 2026-11-11 | eBPF rootkit code and tutorials circulating on underground forums | | |
| 2026-11-11 | Heym lets any logged-in user run commands on the server | high | |
| 2026-11-11 | Heym HTTP workflow node SSRF against internal hosts | high | |
| 2026-11-11 | Heym Playwright node runs arbitrary Python from any logged-in user | high | |
| 2026-11-11 | Heym skill executor runs untrusted Python without sandbox isolation | high | |
| 2026-11-11 | Heym SSRF in the MCP fetch-tools endpoint | high | |
| 2026-11-11 | ScreenConnect panels breached to push rogue remote access tools | | |
| 2026-11-11 | blueprintUE Self-Hosted Edition database root login without password | critical | 4.3.7 |
| 2026-11-11 | SSRF in mcp-gateway-registry server registration API | high | 1.35.0 |
| 2026-11-11 | Node.js TLS handshake bug lets remote attacker crash the server | high | 26.13.1, 24.22.3 |
| 2026-11-11 | Node.js HTTP/2 use-after-free corrupts server memory (CVE-2026-123874) | high | 26.13.1, 24.22.3 |
| 2026-11-11 | Node.js TLS client-certificate auth bypass via renegotiation | high | 26.13.1, 24.22.3, 22.23.5 |
| 2026-11-11 | Node.js HTTP/2 use-after-free leaks server memory to a peer | high | 26.13.1, 24.22.3, 22.23.5 |
| 2026-11-11 | Node.js HTTP/2 bug lets any client permanently drain server memory | high | 26.13.1, 24.22.3, 22.23.5 |
| 2026-11-11 | Node.js HTTPS flaw leaks TLS keys and memory (CVE-2026-123864) | high | 26.13.1, 24.22.3, 22.23.5 |
| 2026-11-11 | Node.js HTTP/2 flaw lets any client crash the server (CVE-2026-123863) | high | 26.13.1, 24.22.3 |
| 2026-11-11 | Zoom Workplace for Windows: privilege escalation (CVE-2026-108186) | | |
| 2026-11-11 | Linux kernel flaws from Microsoft FORGE Lab scan | | |
| 2026-11-11 | Git flaw lets malicious repos run code during recursive clones | | |
| 2026-11-10 | VOS Node.js ZTP web service uses predictable session IDs | critical | |
| 2026-11-10 | Node.js 24 security release fixes a high-severity vulnerability | high | 24.22.3 |
| 2026-11-10 | Node.js 26.13.1 security release fixes vulnerabilities | high | 26.13.1 |