ioc_value,ioc_type,severity,description,product,source,url,date,tags,stix_indicator_id,section,confidence
CVE-2026-102764,cve,CRITICAL,BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.,Remote Support (BeyondTrust),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-16,kev;cisa;active-exploitation,indicator--00000000-00000001-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2025-61624,cve,CRITICAL,"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.",Multiple Products (Fortinet),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-16,kev;cisa;active-exploitation,indicator--00000000-00000002-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-21589,cve,CRITICAL,"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to exte",Multiple Products (Atlassian),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-15,kev;cisa;active-exploitation,indicator--00000000-00000003-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-105134,cve,CRITICAL,Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoi,AhsayCBS (Ahsay),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-14,kev;cisa;active-exploitation,indicator--00000000-00000004-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-76519,cve,CRITICAL,"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.",Secure Email Gateway (Cisco),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-14,kev;cisa;active-exploitation,indicator--00000000-00000005-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-105133,cve,CRITICAL,Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with,AhsayCBS (Ahsay),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-14,kev;cisa;active-exploitation,indicator--00000000-00000006-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-0322,cve,CRITICAL,Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.,PAN-OS (Palo Alto Networks),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-14,kev;cisa;active-exploitation,indicator--00000000-00000007-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-104935,cve,CRITICAL,Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.,Connect Secure (Ivanti),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-13,kev;cisa;active-exploitation,indicator--00000000-00000008-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-96951,cve,CRITICAL,Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.,Windows (Microsoft),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-13,kev;cisa;active-exploitation,indicator--00000000-00000009-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2015-5477,cve,CRITICAL,ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.,BIND (ISC),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-08,kev;cisa;active-exploitation,indicator--00000000-00000010-0000-0000-0000-000000000000,PHISHING URL,100
http://www.roblox.ly/users/1036952856/profile,other,CRITICAL,Active phishing URL: http://www.roblox.ly/users/1036952856/profile,,OpenPhish,http://www.roblox.ly/users/1036952856/profile,,phishing;openphish,indicator--00000000-00000011-0000-0000-0000-000000000000,PHISHING URL,100
http://digitley-dhl.azurewebsites.net/login,other,CRITICAL,Active phishing URL: http://digitley-dhl.azurewebsites.net/login,,OpenPhish,http://digitley-dhl.azurewebsites.net/login,,phishing;openphish,indicator--00000000-00000012-0000-0000-0000-000000000000,PHISHING URL,100
https://www.roblox.com.ml/games/9872472334/HLWN-Evade?privateServerLinkCode=384328757637766641742433182819,other,CRITICAL,Active phishing URL: https://www.roblox.com.ml/games/9872472334/HLWN-Evade?privateServerLinkCode=384328757637766641742433182819,,OpenPhish,https://www.roblox.com.ml/games/9872472334/HLWN-Evade?privateServerLinkCode=384328757637766641742433182819,,phishing;openphish,indicator--00000000-00000013-0000-0000-0000-000000000000,PHISHING URL,100
https://tiktokvip.cyou/,other,CRITICAL,Active phishing URL: https://tiktokvip.cyou/,,OpenPhish,https://tiktokvip.cyou/,,phishing;openphish,indicator--00000000-00000014-0000-0000-0000-000000000000,PHISHING URL,100
http://rss2.sayler.at/go/z2b4u2/z274y274,other,CRITICAL,Active phishing URL: http://rss2.sayler.at/go/z2b4u2/z274y274,,OpenPhish,http://rss2.sayler.at/go/z2b4u2/z274y274,,phishing;openphish,indicator--00000000-00000015-0000-0000-0000-000000000000,PHISHING URL,100
http://worker-shy-leaf-da6e.njperk308.workers.dev/,other,CRITICAL,Active phishing URL: http://worker-shy-leaf-da6e.njperk308.workers.dev/,,OpenPhish,http://worker-shy-leaf-da6e.njperk308.workers.dev/,,phishing;openphish,indicator--00000000-00000016-0000-0000-0000-000000000000,PHISHING URL,100
http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/,other,CRITICAL,Active phishing URL: http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/,,OpenPhish,http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/,,phishing;openphish,indicator--00000000-00000017-0000-0000-0000-000000000000,PHISHING URL,100
https://www.roblox.com.am/users/296446714432/profile,other,CRITICAL,Active phishing URL: https://www.roblox.com.am/users/296446714432/profile,,OpenPhish,https://www.roblox.com.am/users/296446714432/profile,,phishing;openphish,indicator--00000000-00000018-0000-0000-0000-000000000000,PHISHING URL,100
https://sp24ct-rumi-biz-kelak-zati.pages.dev/,other,CRITICAL,Active phishing URL: https://sp24ct-rumi-biz-kelak-zati.pages.dev/,,OpenPhish,https://sp24ct-rumi-biz-kelak-zati.pages.dev/,,phishing;openphish,indicator--00000000-00000019-0000-0000-0000-000000000000,DOMAIN,100
www.roblox,domain-name,CRITICAL,Phishing domain: www.roblox,,OpenPhish,http://www.roblox.ly/users/1036952856/profile,,phishing;openphish;domain,indicator--00000000-00000020-0000-0000-0000-000000000000,DOMAIN,100
digitley-dhl.azurewebsites,domain-name,CRITICAL,Phishing domain: digitley-dhl.azurewebsites,,OpenPhish,http://digitley-dhl.azurewebsites.net/login,,phishing;openphish;domain,indicator--00000000-00000021-0000-0000-0000-000000000000,DOMAIN,100
tiktokvip.cyou,domain-name,CRITICAL,Phishing domain: tiktokvip.cyou,,OpenPhish,https://tiktokvip.cyou/,,phishing;openphish;domain,indicator--00000000-00000022-0000-0000-0000-000000000000,DOMAIN,100
rss2.sayler,domain-name,CRITICAL,Phishing domain: rss2.sayler,,OpenPhish,http://rss2.sayler.at/go/z2b4u2/z274y274,,phishing;openphish;domain,indicator--00000000-00000023-0000-0000-0000-000000000000,DOMAIN,100
njperk308.workers,domain-name,CRITICAL,Phishing domain: njperk308.workers,,OpenPhish,http://worker-shy-leaf-da6e.njperk308.workers.dev/,,phishing;openphish;domain,indicator--00000000-00000024-0000-0000-0000-000000000000,DOMAIN,100
qerqumi-kxt-belfavi-p8t1hk53.pages,domain-name,CRITICAL,Phishing domain: qerqumi-kxt-belfavi-p8t1hk53.pages,,OpenPhish,http://qerqumi-kxt-belfavi-p8t1hk53.pages.dev/,,phishing;openphish;domain,indicator--00000000-00000025-0000-0000-0000-000000000000,DOMAIN,100
sp24ct-rumi-biz-kelak-zati.pages,domain-name,CRITICAL,Phishing domain: sp24ct-rumi-biz-kelak-zati.pages,,OpenPhish,https://sp24ct-rumi-biz-kelak-zati.pages.dev/,,phishing;openphish;domain,indicator--00000000-00000026-0000-0000-0000-000000000000,DOMAIN,100
clktp0b58pz-kphzwlsi-4f9g1b-clk20c.pages,domain-name,CRITICAL,Phishing domain: clktp0b58pz-kphzwlsi-4f9g1b-clk20c.pages,,OpenPhish,https://clktp0b58pz-kphzwlsi-4f9g1b-clk20c.pages.dev/,,phishing;openphish;domain,indicator--00000000-00000027-0000-0000-0000-000000000000,DOMAIN,100
vormita-kxt-felquro-r2t7dw84.pages,domain-name,CRITICAL,Phishing domain: vormita-kxt-felquro-r2t7dw84.pages,,OpenPhish,http://vormita-kxt-felquro-r2t7dw84.pages.dev/,,phishing;openphish;domain,indicator--00000000-00000028-0000-0000-0000-000000000000,DOMAIN,100