Remote

KEV Ransomware Flip Monitor

@kev_Stalker@infosec.exchange

mastodon 4.8.0-alpha.3+glitch

🤖 Monitoring the CISA KEV JSON for silent flips.

When knownRansomwareCampaignUse goes from No → Yes, I toot. Based upon the findings of https://www.greynoise.io/blog/unmasking-cisas-hidden-kev-ransomware-updates
#CISA #KEV #CyberSecurity #threatintel

0 Followers

0 Following

10 Posts

Joined February 05, 2026

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 7mo ago

CVE-2026-1731 - Changed to Known Ransomware Status

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityVendor: BeyondTrustProduct: Remote Support (RS) and Privileged Remote Access (PRA)BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system https://nvd.nist.gov/vuln/detail/CVE-2026-1731

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 7mo ago

CVE-2026-23760 - Changed to Known Ransomware Status

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityVendor: SmarterToolsProduct: SmarterMailSmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token whenhttps://nvd.nist.gov/vuln/detail/CVE-2026-23760

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 8mo ago

CVE-2026-24423 - Changed to Known Ransomware Status

SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityVendor: SmarterToolsProduct: SmarterMailSmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead https://nvd.nist.gov/vuln/detail/CVE-2026-24423

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 3mo ago

CVE-2025-3248 - Changed to Known Ransomware Status Langflow Missing Authentication VulnerabilityVendor: LangflowProduct: LangflowLangflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: July 07, 2026 at 15:00:35 UTCDate Addedhttps://nvd.nist.gov/vuln/detail/CVE-2025-3248

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 2mo ago

CVE-2026-0257 - Changed to Known Ransomware Status Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityVendor: Palo Alto NetworksProduct: PAN-OSPalo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: July 22, 2026 at 00:00:35 UTCDate https://nvd.nist.gov/vuln/detail/CVE-2026-0257

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 2mo ago

CVE-2026-12569 - Changed to Known Ransomware Status PTC Windchill and FlexPLM Improper Input Validation VulnerabilityVendor: PTCProduct: Windchill and FlexPLMPTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: July 24,https://nvd.nist.gov/vuln/detail/CVE-2026-12569

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 2mo ago

CVE-2026-15409 - Changed to Known Ransomware Status SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityVendor: SonicWallProduct: SMA1000 AppliancesSonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.Status changed from Unknown to Known for ransomware campaign usage.Flip https://nvd.nist.gov/vuln/detail/CVE-2026-15409

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 2mo ago

CVE-2026-15410 - Changed to Known Ransomware Status SonicWall SMA1000 Appliances Code Injection VulnerabilityVendor: SonicWallProduct: SMA1000 AppliancesSonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: https://nvd.nist.gov/vuln/detail/CVE-2026-15410

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 2mo ago

CVE-2025-26399 - Changed to Known Ransomware Status SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityVendor: SolarWindsProduct: Web Help DeskSolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: August 04, 2026 at 18:08:17 UTCDate https://nvd.nist.gov/vuln/detail/CVE-2025-26399

nvd.nist.gov

KEV Ransomware Flip Monitor @kev_Stalker@infosec.exchange

· 2w ago

CVE-2026-63077 - Changed to Known Ransomware Status JetBrains TeamCity Deserialization of Untrusted Data VulnerabilityVendor: JetBrainsProduct: TeamCityJetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: September 23, 2026 at 14:08:17 UTCDate Added https://nvd.nist.gov/vuln/detail/CVE-2026-63077

nvd.nist.gov