Do now Vendor won't fix: replace or isolate it. Murrelektronik will not provide a fix. Advisory
Re-plated 24 Oct
Decaf: just the things that can hurt you. Breaches, news and anything below high are off the menu.
10 of 82 specials. Clear
86'dNo fix yet10
Nobody has a patch. Unplug things.
-
Murrelektronik AAS Edge Client Critical vulnerability On hold (status unknown)→ 86'd (no fix yet) KEV – Record ✓ Vendor – -
Siemens SIMATIC S7 PLCs Web Server Do now Restrict access to the S7-1500 web server and disable it if unused until a vendor fix is available. AdvisoryRe-plated 24 OctOn hold (status unknown)→ 86'd (no fix yet) KEV – Record ✓ Vendor – -
InterSystems IRIS for Health Cleartext Transmission of Sensitive Information Do now Enable TLS on InterSystems IRIS for Health and restrict network access until a vendor fix is available. AdvisoryRe-plated 24 OctOn hold (status unknown)→ 86'd (no fix yet) KEV – Record ✓ Vendor –
-
PHP Session upload progress RCE in an unusual configuration Do now Check whether session upload progress is enabled in your PHP setup and disable it until fixed. AdvisoryRe-plated 24 OctOrder up (fix available)→ 86'd (no fix yet) KEV – Record – Vendor ✓ -
Apache Vysper Unbounded Allocation Do now Restrict network access to Apache Vysper XML parsing endpoints and monitor memory use until a fix is released. AdvisoryRe-scored 24 Octhigh→ unknown KEV – Record – Vendor – -
x402 SDK x402 SDK Flaw Do now Avoid calling untrusted APIs with x402 SDKs and limit agent token balances until a fix is available. AdvisoryRe-scored 24 Octcritical→ unknown KEV – Record – Vendor –
-
Linux kernel Linux KSMBD RCE Flaws Do now Disable Linux KSMBD or block its network access until a mainline kernel fix is released. AdvisoryRe-scored 24 Octcritical→ unknown KEV – Record – Vendor – -
Siemens SIMATIC S7 1500 TM MFP Do now Restrict network access to the Siemens SIMATIC S7-1500 TM MFP and watch for a vendor fix. AdvisoryRe-scored 24 Octhigh→ unknown KEV – Record – Vendor – -
QPACK QPACK Flaws Do now Disable HTTP/3 on servers exposed to untrusted clients until QPACK fixes are available. AdvisoryRe-scored 24 Octhigh→ unknown KEV – Record – Vendor –
-
Argo CD AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks Do now Upgrade Argo CD to 3.3.15, 3.4.10, or 3.5.4 matching your release branch now. AdvisoryRe-plated 24 OctOrder up (fix available)→ 86'd (no fix yet) Under the heat lamp: 8 days KEV – Record ✓ Vendor –
359 spills in 12 months
Worst days: 23 Oct 2026 (33 new), 22 Oct 2026 (19 new), 24 Oct 2026 (5 new), 20 Apr 2026 (7 new), 21 Oct 2026 (9 new)
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.