Spydr watches the CVE feeds, CISA’s known-exploited list and breach disclosures. Ask it from any terminal with
curl, wire it into CI and alerts — or read the week’s highlights in The Security Skim.
curl -L spydr.io curl -L "spydr.io/threats?exploited=1&since=7d&limit=5"
spydr · threats · exploited · since 7d 2 results · synced 21:34 UTC
──────────────────────────────────────────────────────────────────────────────
9.4 critical CVE-2026-114625 2026-10-22 KEV EPSS 1.0% Arista Networks V…
VeloCloud Orchestrator (VCO) on-prem has a security issue wher…
9.2 critical CVE-2026-111497 2026-10-22 KEV EPSS 88% Google Brotli
A buffer overflow vulnerability in the Brotli decoder (c/dec/d…
──────────────────────────────────────────────────────────────────────────────
page 1 of 1 · web: https://spydr.io/threats?exploited=1&since=7d&limit=5
covers: CVEs published since 2026-06-30 (the last 120 days), plus every CVE in CISA KEV
scripts: add &format=json (or ndjson, csv, rss) · help: curl -L spydr.io/help
Data: This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA KEV · FIRST EPSS.curl -L "spydr.io/threats?q=nginx,openssl,linux&cvss=7&limit=5"
spydr · threats · q=nginx,openssl,linux · cvss ≥ 7 3694 results · synced 21:34 UTC
note: 3010 more CVEs match but have no score yet, so cvss=/severity= left them out. Add unscored=1 to include them.
──────────────────────────────────────────────────────────────────────────────
9.2 critical CVE-2026-42530 2026-06-17 EPSS 6.5% F5 NGINX Open Sou…
NGINX Open Source has a vulnerability in the ngx_http_v3_modul…
9.2 critical CVE-2026-42055 2026-06-17 EPSS 6.5% F5 NGINX Open Sou…
NGINX Plus and NGINX Open Source have a vulnerability in the n…
7.1 high CVE-2026-102335 2026-09-28 EPSS 0.23% NginxProxyManager…
Nginx Proxy Manager through 2.16.0 fails to restrict the advan…
9.1 critical CVE-2026-102334 2026-09-28 EPSS 0.45% NginxProxyManager…
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on auth…
9.4 critical CVE-2026-107806 2026-10-09 EPSS 0.57% 0xJacky nginx-ui
Nginx UI is a web user interface for the Nginx web server. Fro…
──────────────────────────────────────────────────────────────────────────────
page 1 of 739 · web: https://spydr.io/threats?q=nginx%2Copenssl%2Clinux&cvss=7&limit=5 · next: &page=2
covers: CVEs published since 2026-06-30 (the last 120 days), plus every CVE in CISA KEV
scripts: add &format=json (or ndjson, csv, rss) · help: curl -L spydr.io/help
Data: This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA KEV · FIRST EPSS.curl -L "spydr.io/breaches?since=30d&limit=4"
spydr · breaches · since 30d 10 results · synced 19:25 UTC
──────────────────────────────────────────────────────────────────────────────
2026-10-27 AfD 345K accounts afd.de (sensitive)
Email addresses, Email messages
2026-10-20 Assurance Retraite 70K accounts lassura…
Dates of birth, Email addresses, Family members' names, Governmen…
2026-10-18 Gîtes de France 118K accounts gites-d…
Booking details, Email addresses, Names, Phone numbers, Physical…
2026-10-14 Crunchbase 560K accounts crunchb…
Email addresses, Employers, Job titles, Names, Phone numbers, Phy…
──────────────────────────────────────────────────────────────────────────────
page 1 of 3 · web: https://spydr.io/breaches?since=30d&limit=4
Breach data from Have I Been Pwned (haveibeenpwned.com), licensed under CC BY 4.0.Level B1 · The base
The same feed, raw or distilled. Use whichever fits the moment.
Room 01 · Terminal
Every page on this site is also an API. Filter by keyword, CVE, CVSS score, exploit status or date, and get a table, JSON, CSV or RSS back.
curl -L "spydr.io/threats?q=nginx&cvss=7"curl -L "spydr.io/threats?kev=1&since=7d"curl -L "spydr.io/breaches?since=30d"Room 02 · Mailroom
The Security Skim reads the feed for you: every Tuesday, the vulnerabilities being exploited, the breaches worth knowing about and what to patch first.
Level B2 · Bedrock
Straight from the feed. CVE data 26 min ago, breaches 3 hours ago.
| Score | CVE | Affected | Added to KEV |
|---|---|---|---|
| 7.8 high | CVE-2026-46300 KEV | Linux | 28 Oct 2026 |
| 2.7 low | CVE-2026-41709 KEV | VMware Cloud Foundation | 28 Oct 2026 |
| 9.3 critical | CVE-2026-48356 KEV | Adobe Commerce | 27 Oct 2026 |
| 9.2 critical | CVE-2026-111497 KEV | Google Brotli | 27 Oct 2026 |
| 9.2 critical | CVE-2026-109618 KEV | PHP Group PHP | 26 Oct 2026 |
| 9.2 critical | CVE-2026-109619 KEV | PHP Group PHP | 26 Oct 2026 |
| Score | CVE | Affected | Published |
|---|---|---|---|
| 9.9 critical | CVE-2026-44179 | xwikisas xwiki-pro-macros | 28 Oct 2026 |
| 9.8 critical | CVE-2026-103409 | Juniper Networks Session Smart Router | 28 Oct 2026 |
| 9.8 critical | CVE-2026-103406 | Juniper Networks Session Smart Conductor | 28 Oct 2026 |
| 9.8 critical | CVE-2026-115968 | Ultimate Member | 28 Oct 2026 |
| 9.8 critical | CVE-2026-114278 | Eclipse Foundation Eclipse Che | 28 Oct 2026 |
| 9.8 critical | CVE-2026-103780 | Dell PowerProtect Data Domain | 28 Oct 2026 |
Plain HTTP, stable URLs and exit codes you can script against. Three places to start:
0 * * * * curl -s "https://spydr.io/threats.json?q=nginx,postgres,openssl&exploited=1&since=1h" \
| jq -r '.results[] | "*\(.id)* \(.severity) — \(.products[0] // "")\n\(.url)"' \
| while read -r line; do
curl -s -X POST -H 'content-type: application/json' \
-d "$(jq -n --arg t "$line" '{text:$t}')" "$SLACK_WEBHOOK_URL"
done- name: Spydr gate
run: |
code=$(curl -s -o hits.txt -w '%{http_code}' \
"https://spydr.io/threats?q=django,celery,redis&cvss=9&since=1d&fail=1")
case $code in
200) echo "No new critical CVEs" ;;
409) cat hits.txt; exit 1 ;;
*) echo "Spydr unavailable ($code)"; exit 2 ;;
esachttps://spydr.io/threats.rss?exploited=1
https://spydr.io/threats.rss?q=kubernetes&cvss=7
https://spydr.io/breaches.rssA short email every Tuesday: what’s being exploited, which breaches matter, and the one thing to patch before Friday. Written by people, not scraped.
Free. Hosted on Substack at securityskim.com.