pwn.watch · live security incidents

pwn.watch is a live feed of security incidents, several of them unpatched. The first entry is an unauthenticated remote code execution flaw in InternLM LMDeploy's api_server (CVE-2026-119706, CVSS 3.1 9.8), affecting versions 0.9.0 through 0.18.0, with the fix pull request #4964 still open and unreleased. Another entry describes Time4Popcorn, an abandoned Popcorn Time fork whose unsigned updater fetched code over plain HTTP; it has no fix, and the listing advises uninstalling the app. A Fearless Wallet extension entry reports that it sent private keys to an attacker server, with eight users reporting losses totalling 17,286 DOT.