SockAnalystHunt library
39 playbooks · 81 hunt queries. Metadata is extracted from playbooks and the official CISA KEV feed; missing fields are explicitly unspecified. Query links open the source playbook.
Apify breach: compromised credential exposed customer accounts, 2FA recovery codes and sign-in tokens
Vendor: Unspecified in source metadata · Product: Apify (web scraping and automation cloud platform)
CVE: Unspecified in source metadata · MITRE: T1078, T1528, T1199
UnrealIRCd CVE-2026-114713: labeled-response flaw lets any user run server-authority commands, exploited
Vendor: UnrealIRCd · Product: UnrealIRCd
CVE: CVE-2026-114713 · MITRE: T1190, T1531, T1489
Check Point Gaia CVE-2026-123039: PHP2Shell plus root zero-day exploited on Mobile Access gateways
Vendor: Check Point, PHP Group · Product: Check Point Security Gateway (Gaia OS)
CVE: CVE-2026-109618, CVE-2026-109619, CVE-2026-123039 · MITRE: T1190, T1068, T1505.003, T1021.004, T1485
ScreenConnect RMM+ extension: blank access key let attackers push the SCKit worm to 288 endpoints in 90 minutes
Vendor: Unspecified in source metadata · Product: ConnectWise ScreenConnect (RMM+ third-party extension)
CVE: Unspecified in source metadata · MITRE: T1219, T1072, T1053.005, T1547.001, T1562.001, T1539
Openwave Webtop Media Transcoder CVE-2026-111793: file-type restriction bypass exploited, on CISA KEV (due Nov 24)
Vendor: Openwave Messaging Limited · Product: Openwave Webtop Media Transcoder
CVE: CVE-2026-111793 · MITRE: T1078, T1213
Xen Orchestra VSA-2026-062: empty-object login cookie gives attackers admin and root on XCP-ng hosts, exploited in the wild
Vendor: Unspecified in source metadata · Product: Vates Xen Orchestra
CVE: Unspecified in source metadata · MITRE: T1190, T1550.001, T1053.003, T1090.003
Cisco BroadWorks CVE-2026-20320: unauthenticated OCI-P XXE now exploited to steal server keys, added to CISA KEV
Vendor: Cisco · Product: Cisco BroadWorks
CVE: CVE-2026-20320 · MITRE: T1190, T1005, T1552.004, T1048
Microsoft Outlook CVE-2026-124194: exploited zero-day leaks NTLMv2 hashes from a crafted message file, fixed in November Patch Tuesday
Vendor: Microsoft · Product: Microsoft Outlook
CVE: CVE-2026-124194 · MITRE: T1566.001, T1187, T1204.002
Barracuda ESG: pre-auth admin bypass chained to root command injection, now exploited
Vendor: Barracuda Networks · Product: Barracuda Email Security Gateway (ESG)
CVE: CVE-2026-111560, CVE-2026-116606 · MITRE: T1190, T1059.004, T1068, T1562.001
IBM Aspera Faspex 5 CVE-2026-123218: logged-in users can make themselves full admins, CISA says it is exploited
Vendor: IBM · Product: IBM Aspera Faspex 5
CVE: CVE-2026-123218 · MITRE: T1078, T1068, T1098
N-able N-central "Able2Shell": 33 public zero-days with PoCs, hosted service taken offline and on-prem servers told to shut down
Vendor: Unspecified in source metadata · Product: N-able N-central
CVE: Unspecified in source metadata · MITRE: T1190, T1072, T1136, T1552, T1496, T1068
SignalWire FreeSWITCH CVE-2026-116779: one SIP MESSAGE can run FreeSWITCH API and OS commands, exploited in the wild
Vendor: SignalWire · Product: SignalWire FreeSWITCH
CVE: CVE-2026-116779 · MITRE: T1190, T1059, T1059.004, T1552.001
Google Chrome CVE-2026-125350: XML use-after-free zero-day exploited in the wild, patched in Chrome 157
Vendor: Google · Product: Google Chrome
CVE: CVE-2026-125350 · MITRE: T1189, T1203
Node-RED / Siemens IoT2050 CVE-2026-58115 (CVSS 10): unauthenticated flow deployment is being exploited for Linux bots and webshells
Vendor: Unspecified in source metadata · Product: Node-RED (Siemens SIMATIC IoT2050)
CVE: CVE-2026-58115 · MITRE: T1190, T1059.004, T1105, T1505.003, T1036.005
Iris Ohyama's Iris Plaza breach: about 7.7 million people's data may be exposed via an external cloud service
Vendor: Unspecified in source metadata · Product: Iris Ohyama (Iris Plaza)
CVE: Unspecified in source metadata · MITRE: T1078.004, T1530, T1619, T1098.001
ARARA Message breach: 81 million email addresses taken from Japanese email-delivery service
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1078, T1530, T1567, T1566
Mirae Asset Securities hacked twice in two days: 3,800 customer account numbers and 35,255 staff records leaked
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1078, T1110, T1133, T1213, T1530
SonicWall SonicOS SSL-VPN flaw (CVE-2026-19868) lets attackers bypass SAML and MFA; exploited, on CISA KEV
Vendor: SonicWall · Product: SonicOS SSLVPN
CVE: CVE-2026-19868 · MITRE: T1133, T1078, T1556, T1190
DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1078, T1190, T1213, T1110, T1566
NTT Docomo: up to ~300k customer records leaked from My docomo / Online Shop
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1078, T1213, T1566, T1598
OpenSSH / Alpine “sshole” CVE-2026-123158: key-only account password-auth bypass
Vendor: OpenBSD · Product: OpenSSH
CVE: CVE-2026-123158 · MITRE: T1133, T1078, T1098.004
APT29 watering holes hit unpatched iOS/Android; CISA adds Apple CVE-2024-27834 to KEV
Vendor: Apple · Product: Multiple Products
CVE: CVE-2024-27834, CVE-2025-43529 · MITRE: T1189, T1195.002, T1203, T1539, T1557
Chainstack breached: customer data and password hashes accessed, node credentials treated as exposed
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1195.002, T1078, T1552.001, T1110.002
Attackers set French blood bank plasma freezers to 110°C through refrigeration vendor Coolworld
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T0822, T0836, T0831, T0883
Attackers drain BTCPay Server hot wallets on version 2.4.1 and older
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1190, T1078, T1657
OPSSHIELD cPGuard update channel hijacked: fake updates ran as root on ~2,950 Linux hosting servers
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1195.002, T1078, T1003.008, T1552.004, T1552.003, T1548.001, T1053.003, T1041
WordPress Core CVE-2026-119977: upgrade-window RCE now on CISA KEV (due Nov 6)
Vendor: WordPress · Product: WordPress Core
CVE: CVE-2026-119977 · MITRE: T1190, T1059, T1505.003
Supermarket freezers hacked overnight in Belgium and Sweden
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T0883, T0836, T0831
VOLTA infostealer uses AI models to rank victims by what they're worth
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1555.003, T1539, T1552.004, T1567, T1102
HYBE breach: hackers got in through a vendor's document-preview tool
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1199, T1190, T1213, T1567
Ivanti Connect Secure: three-CVE chain gives unauthenticated root
Vendor: Ivanti · Product: Connect Secure
CVE: CVE-2026-104935, CVE-2026-111357, CVE-2026-118527 · MITRE: T1190, T1068, T1003, T1552.001
Linux kernel CVE-2026-98432: no-login remote root via MPTCP listeners
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: CVE-2026-98432 · MITRE: T1210, T1068
Northflank breached: assume every env var was decrypted
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1552.001, T1078.004, T1496
VAPOR PANDA runs ARTEX AI-agent attack framework against 200+ orgs
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1110.003, T1574.002, T1036.005, T1071.001, T1518.001
Chainalysis discloses breach of customer contact data
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1078, T1213, T1566
MUJI app breach: up to 27.26M customer records
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1190, T1078, T1566
Binance hot wallet theft (~$6.3B): losses covered, withdrawals resuming in phases
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1078, T1199, T1657
Florida Dept. of Education: ~4.9M exposed in student financial aid site breach
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1190, T1530, T1566, T1656
Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others
Vendor: Unspecified in source metadata · Product: Unspecified in source metadata
CVE: Unspecified in source metadata · MITRE: T1078, T1199, T1213, T1566