ioc_value,ioc_type,severity,description,product,source,url,date,tags,stix_indicator_id,section,confidence
CVE-2026-102895,cve,CRITICAL,"GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code",GPUStack (GPUStack),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-11-09,kev;cisa;active-exploitation,indicator--00000000-00000001-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-123158,cve,CRITICAL,OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.,OpenSSH (OpenBSD),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-11-09,kev;cisa;active-exploitation,indicator--00000000-00000002-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-116779,cve,CRITICAL,"SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.",FreeSwitch (SignalWire),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-11-09,kev;cisa;active-exploitation,indicator--00000000-00000003-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-123218,cve,CRITICAL,"IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.",Aspera Faspex (IBM),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-11-09,kev;cisa;active-exploitation,indicator--00000000-00000004-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-19868,cve,CRITICAL,SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass,SonicOS SSLVPN (SonicWall),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-11-06,kev;cisa;active-exploitation,indicator--00000000-00000005-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2024-27834,cve,CRITICAL,"Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.",Multiple Products (Apple),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-11-04,kev;cisa;active-exploitation,indicator--00000000-00000006-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-119977,cve,CRITICAL,"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging",WordPress Core (WordPress),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-11-03,kev;cisa;active-exploitation,indicator--00000000-00000007-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-118527,cve,CRITICAL,Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chaine,Connect Secure (Ivanti),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-30,kev;cisa;active-exploitation,indicator--00000000-00000008-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-111357,cve,CRITICAL,Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.,Connect Secure (Ivanti),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-30,kev;cisa;active-exploitation,indicator--00000000-00000009-0000-0000-0000-000000000000,CISA KEV (KNOWN EXPLOITED VULNERABILITY),100
CVE-2026-97229,cve,CRITICAL,GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD confi,Community Edition and Enterprise Edition (GitLab),CISA KEV Catalog,https://www.cisa.gov/known-exploited-vulnerabilities-catalog,2026-10-29,kev;cisa;active-exploitation,indicator--00000000-00000010-0000-0000-0000-000000000000,PHISHING URL,100
https://streamlined-three-995346.framer.app/,other,CRITICAL,Active phishing URL: https://streamlined-three-995346.framer.app/,,OpenPhish,https://streamlined-three-995346.framer.app/,,phishing;openphish,indicator--00000000-00000011-0000-0000-0000-000000000000,PHISHING URL,100
https://fanpage-case.vercel.app/,other,CRITICAL,Active phishing URL: https://fanpage-case.vercel.app/,,OpenPhish,https://fanpage-case.vercel.app/,,phishing;openphish,indicator--00000000-00000012-0000-0000-0000-000000000000,PHISHING URL,100
http://pagina-inicial-instagram.vercel.app/,other,CRITICAL,Active phishing URL: http://pagina-inicial-instagram.vercel.app/,,OpenPhish,http://pagina-inicial-instagram.vercel.app/,,phishing;openphish,indicator--00000000-00000013-0000-0000-0000-000000000000,PHISHING URL,100
https://pagina-inicial-instagram-anesoledar.vercel.app/,other,CRITICAL,Active phishing URL: https://pagina-inicial-instagram-anesoledar.vercel.app/,,OpenPhish,https://pagina-inicial-instagram-anesoledar.vercel.app/,,phishing;openphish,indicator--00000000-00000014-0000-0000-0000-000000000000,PHISHING URL,100
http://tokeimx-cdnnode-sg16.xyz/,other,CRITICAL,Active phishing URL: http://tokeimx-cdnnode-sg16.xyz/,,OpenPhish,http://tokeimx-cdnnode-sg16.xyz/,,phishing;openphish,indicator--00000000-00000015-0000-0000-0000-000000000000,PHISHING URL,100
http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/,other,CRITICAL,Active phishing URL: http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/,,OpenPhish,http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/,,phishing;openphish,indicator--00000000-00000016-0000-0000-0000-000000000000,PHISHING URL,100
http://instagram-session.vercel.app/,other,CRITICAL,Active phishing URL: http://instagram-session.vercel.app/,,OpenPhish,http://instagram-session.vercel.app/,,phishing;openphish,indicator--00000000-00000017-0000-0000-0000-000000000000,PHISHING URL,100
https://chp-courriersdomicile.bolt.host/,other,CRITICAL,Active phishing URL: https://chp-courriersdomicile.bolt.host/,,OpenPhish,https://chp-courriersdomicile.bolt.host/,,phishing;openphish,indicator--00000000-00000018-0000-0000-0000-000000000000,PHISHING URL,100
https://coinbaseplogininin.gitbook.io/us,other,CRITICAL,Active phishing URL: https://coinbaseplogininin.gitbook.io/us,,OpenPhish,https://coinbaseplogininin.gitbook.io/us,,phishing;openphish,indicator--00000000-00000019-0000-0000-0000-000000000000,DOMAIN,100
streamlined-three-995346.framer,domain-name,CRITICAL,Phishing domain: streamlined-three-995346.framer,,OpenPhish,https://streamlined-three-995346.framer.app/,,phishing;openphish;domain,indicator--00000000-00000020-0000-0000-0000-000000000000,DOMAIN,100
fanpage-case.vercel,domain-name,CRITICAL,Phishing domain: fanpage-case.vercel,,OpenPhish,https://fanpage-case.vercel.app/,,phishing;openphish;domain,indicator--00000000-00000021-0000-0000-0000-000000000000,DOMAIN,100
pagina-inicial-instagram.vercel,domain-name,CRITICAL,Phishing domain: pagina-inicial-instagram.vercel,,OpenPhish,http://pagina-inicial-instagram.vercel.app/,,phishing;openphish;domain,indicator--00000000-00000022-0000-0000-0000-000000000000,DOMAIN,100
pagina-inicial-instagram-anesoledar.vercel,domain-name,CRITICAL,Phishing domain: pagina-inicial-instagram-anesoledar.vercel,,OpenPhish,https://pagina-inicial-instagram-anesoledar.vercel.app/,,phishing;openphish;domain,indicator--00000000-00000023-0000-0000-0000-000000000000,DOMAIN,100
tokeimx-cdnnode-sg16.xyz,domain-name,CRITICAL,Phishing domain: tokeimx-cdnnode-sg16.xyz,,OpenPhish,http://tokeimx-cdnnode-sg16.xyz/,,phishing;openphish;domain,indicator--00000000-00000024-0000-0000-0000-000000000000,DOMAIN,100
gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages,domain-name,CRITICAL,Phishing domain: gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages,,OpenPhish,http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/,,phishing;openphish;domain,indicator--00000000-00000025-0000-0000-0000-000000000000,DOMAIN,100
instagram-session.vercel,domain-name,CRITICAL,Phishing domain: instagram-session.vercel,,OpenPhish,http://instagram-session.vercel.app/,,phishing;openphish;domain,indicator--00000000-00000026-0000-0000-0000-000000000000,DOMAIN,100
chp-courriersdomicile.bolt,domain-name,CRITICAL,Phishing domain: chp-courriersdomicile.bolt,,OpenPhish,https://chp-courriersdomicile.bolt.host/,,phishing;openphish;domain,indicator--00000000-00000027-0000-0000-0000-000000000000,DOMAIN,100
coinbaseplogininin.gitbook,domain-name,CRITICAL,Phishing domain: coinbaseplogininin.gitbook,,OpenPhish,https://coinbaseplogininin.gitbook.io/us,,phishing;openphish;domain,indicator--00000000-00000028-0000-0000-0000-000000000000,DOMAIN,100