pwn.watch Tracks Live Security Incidents in Real Time
Original: What's Getting Pwned
Why This Matters
Centralizing live CVE tracking with patch status lowers response time for defenders.
pwn.watch, a live security incident tracker by @thekitze, currently lists 37 active incidents including 16 critical, covering GitLab RCE, Linux kernel zero-days, and AI agents inside U.S. bank accounts.
pwn.watch is a continuously updated security dashboard tracking active and historical vulnerability incidents, currently showing 37 live cases: 16 critical, 18 high, and 2 medium severity. Among the most serious: GitLab patched a CVSS 10.0 unauthenticated RCE (CVE-2026-110264) on Oct 21, caused by an integer overflow in its bundled Onigmo regex compiler — every CE/EE version back to 7.0 (2014) is affected. Arista patched a CVSS 9.9 SQL injection zero-day (CVE-2026-114625) in on-premises VeloCloud Orchestrator that lets authenticated users escalate to superuser. A separate Linux kernel issue is unpatched: Trend Micro's ZDI accidentally CC'd public mailing lists when disclosing several kernel bugs including a ksmbd RCE (CVSS 9.0), leaking full technical details before fixes shipped. On the non-traditional side, major U.S. banks including JPMorgan, Morgan Stanley, Bank of America, and Wells Fargo are detecting third-party AI agents operating inside customer accounts using user-provided credentials — a practice that violates bank terms of service. No confirmed fraud has been reported, but banks are now actively blocking or restricting such agents. The site tracks 236 incidents over the past 12 months and provides RSS, JSON, and llms.txt feeds.