LIVE — UPDATED AS NEW CVES BREAK

The self-host threat map

Name: Live Self-Host Threat Map
Author: Ingenious AI

Five critical vulnerabilities attackers are using against self-hosted servers right now. Plain English, no jargon — and a free 30-second check for each one.

Last updated: October 15, 2026. Sources: CISA KEV catalog, NVD, vendor advisories.

CRITICAL · CVSS 10.0

CVE-2026-21962 — Oracle WebLogic Proxy Plug-in

What it is: A flaw in the WebLogic Server proxy plug-in that lets attackers run their own code on the server — the worst kind of vulnerability, and it is on CISA's exploited-in-the-wild list.

Fix: Apply Oracle's patch immediately; restrict proxy plug-in exposure to trusted networks only.

Check my server free →

CRITICAL · CVSS 9.8

CVE-2026-60004 — Gitea before 1.27.1

What it is: Remote code execution in self-hosted Gitea — attackers can run commands on any unpatched instance. Added to CISA's known-exploited list.

Fix: Upgrade to Gitea 1.27.1 or newer; audit access logs for unexpected requests.

Check my server free →

CRITICAL · CVSS 9.7

CVE-2026-34205 — Home Assistant Supervisor

What it is: Add-ons configured with host network mode expose unauthenticated endpoints to your local network — any device on the same Wi-Fi can reach them without logging in.

Fix: Update Supervisor to 2026.03.2; review which add-ons use host network mode and whether they need to.

Rate my homelab free →

CRITICAL · EXPLOITED IN THE WILD

CVE-2026-110447 — Nextcloud Collabora Built-in CODE

What it is: Command injection in proxy.php of Nextcloud's built-in Collabora CODE Server app. Attackers planted PHP web shells with web-server permissions in September and October 2026 — and disabling the app does not fix it.

Fix: Update richdocumentscode to 26.4.303 or newer, or remove the app entirely.

Run the free 30-second check →

CRITICAL · EXPLOITED IN THE WILD

CVE-2026-105740 — Langflow MCP stdio transport

What it is: Authenticated remote code execution — any Langflow user, even low-privilege, can add a malicious MCP server and get full command execution on the host.

Fix: Upgrade to 1.10.3 or newer (1.9.0 minimum); audit every configured MCP server for commands you did not authorize.

Run the free 30-second check →

Put this map on your blog — free

Bloggers, forum mods, and Discord admins: paste this one line into any HTML page. It embeds this live threat map as a frame — no JavaScript supply-chain risk, no cookies, no fingerprinting of your visitors. Just keep the "Powered by Ingenious AI" line under it.

<iframe src="https://ingeniousai-security-checks.netlify.app/threat-map.html" width="100%" height="600" style="border:0" title="Live Self-Host Threat Map"></iframe>
<p style="font-size:12px">Live threat map powered by <a href="https://ingeniousai-security-checks.netlify.app/threat-map.html">Ingenious AI</a></p>

Privacy promise: the embed sets no cookies, runs no trackers, and collects no visitor data. Your readers stay yours.

Honest scope: this map tracks the self-host CVEs getting real-world exploitation attention. It is a triage aid, not a pentest — patch everything, and verify with a real scan.

Scan my server for all known exposures — free →