239 Incidents Logged on pwn.watch With 19 Critical Live

pwn.watch data shows 40 live incidents of which 19 remain critical. Arista VeloCloud Orchestrator CVE-2026-114625, GitLab CVE-2026-110264 rated CVSS 10.0, Keycloak CVE-2026-18963 now with public Exploit-DB proof-of-concept, and two Linux ksmbd CVSS 9.0 reports leaked on LKML constitute the active set. Each entry lists patch status, affected versions from 2014 onward, and exploit availability dates between 21-23 October 2026.

GitLab instances running versions 7.0 through current remain exposed unless the second October 21 patch is applied; prior regex-only fixes left the integer overflow reachable. Keycloak resets bypass email verification in all builds before 26.4.15, 26.6.6 and 26.7.2. The leaked ksmbd reports expose RDMA and guest-share attack surfaces with no CVE assignment or stable kernel release yet. Banks report third-party agents using customer credentials but record no quantified account takeovers.

Operational impact centers on self-managed infrastructure. Unpatched GitLab and Keycloak deployments face unauthenticated remote code execution and account takeover within days of public disclosure. Linux distributions shipping ksmbd must backport maintainer-tree fixes before the next stable cycle. Hosted services show faster remediation than on-prem appliances.

Next 30 days will determine whether the 19 critical items drop below 10 or spawn secondary incidents once exploit code proliferates beyond the initial disclosures.