Live security incidents, brewed hourly

Decaf: just the things that can hurt you. Breaches, news and anything below high are off the menu.

56 of 82 specials. Clear

Order upFix available56

The fix exists. Somebody has to carry it.

Arista VeloCloud Orchestrator32 d Improper Input Validation 🔥 On the fly · exploitedcritical severity
Fixed in 5.2.3.16, 6.4.2.8 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 32 days KEV ✓ Record ✓ Vendor –
WSO2 API Manager30 d WSO2 Multiple Products Path Traversal 🔥 On the fly · exploitedcritical severity
Fixed in WSO2 Universal Gateway 4.5.0.57, WSO2 Universal Gateway 4.6.0.21 +13 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 30 days KEV ✓ Record ✓ Vendor ✓
Citrix NetScaler ADC13 h Memory corruption 🔥 On the fly · exploitedcritical severity
Fixed in ADC 14.1-73.37, ADC 13.1-64.23 +2 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 27 days KEV ✓ Record ✓ Vendor ✓

AhsayCBS10 d Ahsay AhsayCBS Command Injection 🔥 On the fly · exploitedKEV overdue 7dcritical severity
Fixed in 10.3.4 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 10 days KEV ✓ Record ✓ Vendor ✓
Arista VeloCloud Orchestrator18 h SQL Injection 🔥 On the fly · exploitedKEV due in 2dcritical severity
Fixed in 5.2.3.18, 6.1.3.10 +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV ✓ Record ✓ Vendor ✓
F5 BIG-IP32 d APM Heap-based Buffer Overflow 🔥 On the fly · exploitedcritical severity
Fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 32 days KEV ✓ Record ✓ Vendor ✓

Check Point Quantum Security32 d Check Point Multiple Products Path Traversal 🔥 On the fly · exploitedcritical severity
Fixed in checkpoint gaia embedded r81.10.17, checkpoint gaia embedded r82.00.10 +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 32 days KEV ✓ Record ✓ Vendor –
Cisco Catalyst SD-WAN Manager24 d Hex Encoding 🔥 On the fly · exploitedcritical severity
Fixed in 20.9.10.1, 20.12.8.2 +3 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 24 days KEV ✓ Record ✓ Vendor –
Zammad22 d GmbH Zammad Improper Privilege Management 🔥 On the fly · exploitedcritical severity
Fixed in 6.5.4, 7.2.2 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 22 days KEV ✓ Record ✓ Vendor ✓

ONLYOFFICE Docs16 d Server Path Traversal 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dcritical severity
Fixed in 5.6.3 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor –
Cisco Secure Email10 d Gateway Relative Path Traversal 🔥 On the fly · exploitedKEV overdue 7dcritical severity
Fixed in 15.5.5-014, 16.5.0-780 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 10 days KEV ✓ Record ✓ Vendor –
Collabora Online5 h Built-in CODE Server OS Command Injection 🔥 On the fly · exploitedKEV due in 2dcritical severity
Fixed in 26.4.303 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV ✓ Record ✓ Vendor ✓

Adobe Commerce30 d And Magento Incorrect Authorization 🔥 On the fly · exploitedcritical severity
Fixed in adobe commerce 2.4.4, adobe commerce b2b 1.3.3 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 30 days KEV ✓ Record ✓ Vendor –
Zyxel GS1900 switches33 d Zyxel GS1900 Series Switches Stack-Based Buffer Overflow 🔥 On the fly · exploitedhigh severity
Fixed in zyxel gs1900-8 firmware 2.90\(aahh.2\)c0, zyxel gs1900-8hp firmware 2.90\(aahi.2\)c0 +8 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 33 days KEV ✓ Record ✓ Vendor –
Microsoft SharePoint Enterprise29 d Microsoft SharePoint Code Injection 🔥 On the fly · exploitedhigh severity
Fixed in Microsoft SharePoint Enterprise Server 2016 16.0.5565.1001, Microsoft SharePoint Server 2019 16.0.10417.20198 +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 29 days KEV ✓ Record ✓ Vendor ✓

Apple iOS25 d Apple Multiple Products Out-of-Bounds Write 🔥 On the fly · exploitedKEV overdue 11dhigh severity
Fixed in iOS and iPadOS 26.7.1, macOS 15.8.1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 25 days KEV ✓ Record ✓ Vendor ✓
Windows11 d Microsoft Windows Command Injection 🔥 On the fly · exploitedKEV overdue 8dhigh severity
Fixed in Outlook.com 20260925.100, Windows 10 Version 1607 10.0.14393.9612 +11 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 11 days KEV ✓ Record ✓ Vendor ✓
Ivanti Connect Secure11 d Authentication Bypass by Spoofing 🔥 On the fly · exploitedKEV overdue 8dhigh severity
Fixed in Connect Secure 25.1.3.1, Connect Secure 22.8R2.5 +2 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 11 days KEV ✓ Record ✓ Vendor ✓

SiteGuard Server Edition4 d EG Secure Solutions SiteGuard Server Edition OS Command Injection 🔥 On the fly · exploitedKEV overdue 1dhigh severity
Fixed in SiteGuard Server Edition for Apache httpd Ver8.00 Update 5, SiteGuard Server Edition for Apache httpd on FreeBSD Ver7.00 Update 6 +3 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 4 days KEV ✓ Record ✓ Vendor ✓
jfrog artifactory43 d Incorrect Authorization 🔥 On the fly · exploitedhigh severity
Fixed in 7.133.11, 7.111.20 +4 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 43 days KEV ✓ Record ✓ Vendor ✓
WordPress29 d Core Remote File Inclusion 🔥 On the fly · exploitedhigh severity
Fixed in 7.1.2 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 29 days KEV ✓ Record ✓ Vendor ✓

Apache Struts16 d Command Injection 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dhigh severity
Fixed in apache struts 2.3.20.3, apache struts 2.3.24.3 +4 AdvisoryOn 2.3.20.x?mvn versions:use-dep-version -Dincludes=org.apache.struts:struts2-core -DdepVersion=2.3.20.3 -DforceVersion=trueOn 2.3.24.x?mvn versions:use-dep-version -Dincludes=org.apache.struts:struts2-core -DdepVersion=2.3.24.3 -DforceVersion=true1 more release line
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor –
Citrix NetScaler ADC20 d Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer 🔥 On the fly · exploitedhigh severity
Fixed in 14.1-73.41, 13.1-64.28 +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 20 days KEV ✓ Record ✓ Vendor ✓
ISC BIND16 d Data Processing Errors 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dhigh severity
Fixed in juniper junos 12.1, juniper junos 13.2 +3 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor –

Atlassian Bamboo Data Center9 d Atlassian Multiple Products Files or Directories Accessible to External Parties 🔥 On the fly · exploitedKEV overdue 6dhigh severity
Fixed in atlassian bitbucket data center 9.4.26, atlassian bitbucket data center 10.2.8 +14 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 9 days KEV ✓ Record ✓ Vendor –
Palo Alto Networks Cloud NGFW10 d Palo Alto Networks PAN-OS Code Injection 🔥 On the fly · exploitedKEV overdue 7dhigh severity
Fixed in Cloud NGFW 11.2.16, PAN-OS 12.2.4 +4 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 10 days KEV ✓ Record ✓ Vendor ✓
Plex Media Server1 d External Control of File Name or Path 🔥 On the fly · exploitedKEV overdue 1dhigh severity
Fixed in 1.43.3.10861 Advisory
Re-plated 24 Oct ~~86'd (no fix yet)~~ → Order up (fix available) Under the heat lamp: 4 days KEV ✓ Record ✓ Vendor ✓

Mikrotik RouterOS29 d Improper Enforcement of Behavioral Workflow 🔥 On the fly · exploitedmedium severity
Fixed in 7.24.2, 7.23.4 +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 29 days KEV ✓ Record ✓ Vendor ✓
Siemens Software Center20 h Uncontrolled Search Path Element 🔥 On the fly · exploitedKEV due in 10dmedium severity
Fixed in V4.0.9.8 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV ✓ Record ✓ Vendor ✓
Fortinet FortiOS8 d Fortinet Multiple Products Path Traversal 🔥 On the fly · exploitedKEV overdue 5dmedium severity
Fixed in FortiOS 7.4.10, FortiProxy 7.4.12 +4 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 8 days KEV ✓ Record ✓ Vendor ✓

Strapi16 d Cleartext Storage of Sensitive Information 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dmedium severity
Fixed in strapi strapi 4.8.0, @strapi/strapi 4.8.0 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor –
jxrlib3 h Heap buffer overflow unknown severity
Fixed in mircomir/jxrlib 1.4.4 Advisory
Re-scored 24 Oct ~~high~~ → unknown KEV – Record – Vendor –
GitLab17 h Remote code execution critical severity
Fixed in 18.11.13, 19.0.10 +5 Advisory
KEV – Record ✓ Vendor ✓

Kiloview E3 NDI Encoder2 d Vulnerabilities critical severity
Fixed in V1.30 Advisory
Fix found 24 Oct ~~1.30~~ → V1.30 KEV – Record ✓ Vendor ✓
Siemens RUGGEDCOM CROSSBOW2 d Vulnerability public PoCcritical severity
Fixed in V6.0 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Pillow4 d 13.0.0 (major upgrade): 5 security fixes public PoCcritical severity
Fixed in Pillow 13.0.0, pillow 13.0.0 +1 Advisory
Fix found 24 Oct ~~Pillow 13.0.0~~ → 13.0.0, Pillow 13.0.0 KEV – Record ✓ Vendor ✓

odhcpd15 h Remote code execution critical severity
Fixed in 25.12 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Gitea17 h 's Org-mode markup renderer processes INCLUDE directives supplied to the repository m critical severity
Fixed in 1.27.1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
GeoVision GV-ASManager17 h Critical vulnerability critical severity
Fixed in 6.4.0 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓

Splunk Enterprise17 h Critical vulnerability critical severity
Fixed in 10.4.3, 10.2.7 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
PHP19 h PHP2Shell Bugs critical severity
Fixed in PHP 8.2.35, PHP 8.3.36 +7 Advisory
Fix found 24 Oct ~~8.2.35, 8.3.36, 8.4.27, 8.5.12~~ → PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, PHP… KEV – Record ✓ Vendor ✓
Cisco Expressway3 d Cisco Expressway RCE critical severity
The vendor: “Cisco has released software updates that address this vulnerability.” See the vendor's fixed-release table
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓

FortiSIEM4 d Critical FortiSIEM Flaw Gets Public Exploit PoC public PoCcritical severity
Fixed in 7.5.1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Brotli2 h HTTP2Shell SpreadingNot fixed everywherecritical severity
Now hitting Python (Brotli) too (added 23 Oct)Fixed in Node.js 26.12.1, Node.js 24.22.1 +4 Advisorypip install --upgrade "Brotli>=1.2.1"
Re-plated 24 Oct ~~86'd (no fix yet)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Laravel15 h Authentication bypass critical severity
Fixed in framework 12.68.0, laravel/framework 13.29.0 +1 AdvisoryOn 12.x?composer require laravel/framework:^12.68.0On 13.x?composer require laravel/framework:^13.29.0
Fix found 24 Oct ~~laravel/framework 13.29.0…~~ → framework 12.68.0, laravel/framework… KEV – Record ✓ Vendor ✓

Oracle Java SE6 h Trusts compromised eMudhra CA certificates critical severity
The vendor: “Update to the latest Java release, which distrusts the impacted eMudhra intermediate CAs.” See the vendor's fixed-release table
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Sentry JavaScript SDK2 d Sentry-JavaScript: Middleware Bypass when using Tunnel route critical severity
Fixed in @sentry/nextjs 9.47.2, @sentry/nextjs 10.75.2 +1 AdvisoryOn 9.x?npm install @sentry/nextjs@9.47.2On 10.x?npm install @sentry/nextjs@10.75.2
KEV – Record ✓ Vendor –
Next.js2 d Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays Spreadingcritical severity
Now hitting npm (next) too (added 24 Oct)Fixed in next 16.4.1 Advisorynpm install next@16.4.1
KEV – Record ✓ Vendor –

Next.js2 d Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used Spreadingcritical severity
Now hitting npm (next) too (added 24 Oct)Fixed in next 15.5.28, next 16.4.1 AdvisoryOn 16.x?npm install next@16.4.1
KEV – Record ✓ Vendor –
Siemens SIMATIC WinCC2 d Siemens WinCC Database Privilege Escalation high severity
Fixed in V8.0 Update 11, V8.1 Update 7 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Siemens Industrial Edge App2 d Publisher high severity
Fixed in V1.27.9 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓

NGINX Plus15 h Nginx RCE high severity
Fixed in NGINX Plus 37.1.0.1, NGINX Plus 37.0.5.1 +2 Advisory
Fix found 24 Oct ~~1.31.7, 1.30.6~~ → NGINX Plus 37.1.0.1, NGINX Plus 37.0.5.1… KEV – Record ✓ Vendor ✓
Snort 33 d Open Source Snort 3 Command Execution high severity
The vendor: “Cisco has released software updates that address this vulnerability.” See the vendor's fixed-release table
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Cisco IOS XR3 d IPv4 DoS high severity
The vendor: “Cisco has released software updates that address this vulnerability.” See the vendor's fixed-release table
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓

IO::Compress::Brotli14 h Out-of-Bounds Write unknown severity
Fixed in 0.023 Advisory
Re-scored 24 Oct ~~high~~ → unknown KEV – Record – Vendor –
OpenCode2 d OpenCode Flaw unknown severity
Fixed in 1.18.33 Advisory
Re-scored 24 Oct ~~high~~ → unknown KEV – Record – Vendor –

Your usual

Choose

Pick what you run and the board and the fire shrink to just that.

Hottest on the menu

Patched since yesterday

Under the heat lamp

Past the KEV deadline, or on the rail for over a week.

Sent back to the kitchen

All

Merged Pillow 13.0.0 (major upgrade): 5 security fixesmerged with its twin
Re-scored OpenCode Flaw~~high~~ → unknown
Re-scored IO::Compress::Brotli Out-of-Bounds Write~~high~~ → unknown
Re-scored Hackers Hid Vasilek Backdoor in VMware Tools~~high~~ → unknown

Ask your agent

Cursor, Codex, Claude Code, Gemini CLI, Windsurf or Zed reads your lockfiles and hands back the exact upgrades.

pwned.coffee/mcp Setup and prompts

Check this project and its deployment for exposure to the live security incidents below (from pwned.coffee).

For each one: search lockfiles, manifests, Dockerfiles, CI workflows and infra config for the affected product or package. If it's present, report the version in use, whether it's in the affected range, and the exact upgrade or mitigation. If an incident involves leaked secrets at a provider we use, list which of our secrets live there so they can be rotated. Don't change anything yet; report first.

- **Fortinet FortiMail Path Traversal Vulnerability** (critical, exploited). Fortinet FortiMail; CVE-2026-104286; patch: fix status unknown. https://pwned.coffee/i/fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286
- **ProFTPD Improper Access Control Vulnerability** (critical, exploited). ProFTPD; CVE-2015-3306; patch: fix status unknown. https://pwned.coffee/i/proftpd-improper-access-control-vulnerability-cve-2015-3306
- **BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability** (critical, exploited). BeyondTrust Remote Support; CVE-2026-102764; patch: fix status unknown. https://pwned.coffee/i/beyondtrust-remote-support-authentication-bypass-by-spoo-cve-2026-102764
- **Arista VeloCloud Orchestrator Improper Input Validation Vulnerability** (critical, exploited). Arista VeloCloud Orchestrator; CVE-2026-93952; fixed in 5.2.3.16, 6.4.2.8. https://pwned.coffee/i/arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952
- **F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability** (critical, exploited). F5 BIG-IP; CVE-2026-94127; fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. https://pwned.coffee/i/f5-big-ip-apm-heap-based-buffer-overflow-vulnerability-cve-2026-94127
- **Check Point Multiple Products Path Traversal Vulnerability** (critical, exploited). Check Point Quantum Security Gateway; CVE-2026-85102, CVE-2026-93616; fixed in checkpoint gaia embedded r81.10.17, checkpoint gaia embedded r82.00.10, checkpoint gaia os r81.10. https://pwned.coffee/i/check-point-multiple-products-path-traversal-vulnerability
- **WSO2 Multiple Products Path Traversal Vulnerability** (critical, exploited). WSO2 API Manager and Universal Gateway; CVE-2026-5430; fixed in WSO2 Universal Gateway 4.5.0.57, WSO2 Universal Gateway 4.6.0.21, WSO2 Traffic Manager 4.5.0.56, WSO2 API Control Plane 4.5.0.58, WSO2 API Control Plane 4.6.0.22, WSO2 API Manager 4.1.0.257, WSO2 API Manager 4.2.0.197, WSO2 API Manager 4.3.0.108, WSO2 API Manager 4.4.0.72, WSO2 Carbon API Manager Rest API Utility 9.20.74.401, WSO2 Carbon API Manager Rest API Utility 9.28.116.417, WSO2 Carbon API Manager Rest API Utility 9.29.120.236, WSO2 Carbon API Manager Rest API Utility 9.30.67.167, WSO2 Carbon API Manager Rest API Utility 9.31.86.158, WSO2 Carbon API Manager Rest API Utility 9.32.147.59. https://pwned.coffee/i/wso2-multiple-products-path-traversal-vulnerability-cve-2026-5430
- **Adobe Commerce and Magento Incorrect Authorization Vulnerability** (critical, exploited). Adobe Commerce; CVE-2026-71362; fixed in adobe commerce 2.4.4, adobe commerce b2b 1.3.3. https://pwned.coffee/i/adobe-commerce-and-magento-incorrect-authorization-vulne-cve-2026-71362
- **Citrix NetScaler ADC: memory corruption** (critical, exploited). Citrix NetScaler ADC and Gateway; CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777; fixed in ADC 14.1-73.37, ADC 13.1-64.23, ADC 13.1-37.279 and NDcPP, citrix netscaler application delivery controller 13.1.37.279. https://pwned.coffee/i/citrix-netscaler-adc-memory-corruption-cve-2026-88777
- **Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability** (critical, exploited). Cisco Catalyst SD-WAN Manager; CVE-2026-76504; fixed in 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1. https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-hex-encoding-vulnerability-cve-2026-76504
- **Zammad GmbH Zammad Improper Privilege Management Vulnerability** (critical, exploited). Zammad; CVE-2026-102489, CVE-2026-102490; fixed in 6.5.4, 7.2.2. https://pwned.coffee/i/zammad-gmbh-zammad-improper-privilege-management-vulnerability
- **ONLYOFFICE Docs Server Path Traversal Vulnerability** (critical, exploited). ONLYOFFICE Docs; CVE-2021-3199; fixed in 5.6.3. https://pwned.coffee/i/onlyoffice-docs-server-path-traversal-vulnerability-cve-2021-3199
- **Ahsay AhsayCBS Command Injection Vulnerability** (critical, exploited). AhsayCBS; CVE-2026-105133, CVE-2026-105134; fixed in 10.3.4. https://pwned.coffee/i/ahsay-ahsaycbs-command-injection-vulnerability
- **Cisco Secure Email Gateway Relative Path Traversal Vulnerability** (critical, exploited). Cisco Secure Email; CVE-2026-76519; fixed in 15.5.5-014, 16.5.0-780. https://pwned.coffee/i/cisco-secure-email-gateway-relative-path-traversal-vulne-cve-2026-76519
- **Collabora Online – Built-in CODE Server OS Command Injection Vulnerability** (critical, exploited). Collabora Online; CVE-2026-110447; fixed in 26.4.303. https://pwned.coffee/i/collabora-online-built-in-code-server-os-command-injecti-cve-2026-110447
- **Arista VeloCloud Orchestrator SQL Injection Vulnerability** (critical, exploited). Arista VeloCloud Orchestrator; CVE-2026-114625; fixed in 5.2.3.18, 6.1.3.10, 6.4.2.12. https://pwned.coffee/i/arista-velocloud-orchestrator-sql-injection-vulnerabilit-cve-2026-114625
- **Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability** (high, exploited). Zyxel GS1900 switches; CVE-2026-7273; fixed in zyxel gs1900-8 firmware 2.90\(aahh.2\)c0, zyxel gs1900-8hp firmware 2.90\(aahi.2\)c0, zyxel gs1900-10hp firmware 2.90\(aazi.2\)c0, zyxel gs1900-16 firmware 2.90\(aahj.2\)c0, zyxel gs1900-24 firmware 2.90\(aahl.2\)c0, zyxel gs1900-24e firmware 2.90\(aahk.2\)c0, zyxel gs1900-24ep firmware 2.90\(abto.2\)c0, zyxel gs1900-24hpv2 firmware 2.90\(abtp.2\)c0, zyxel gs1900-48 firmware 2.90\(aahn.2\)c0, zyxel gs1900-48hpv2 firmware 2.90\(abtq.2\)c0. https://pwned.coffee/i/zyxel-gs1900-series-switches-stack-based-buffer-overflow-cve-2026-7273
- **JFrog Artifactory Incorrect Authorization Vulnerability** (high, exploited). jfrog artifactory; CVE-2026-42016, CVE-2026-42018; fixed in 7.133.11, 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8. https://pwned.coffee/i/jfrog-artifactory-incorrect-authorization-vulnerability
- **Microsoft SharePoint Code Injection Vulnerability** (high, exploited). Microsoft SharePoint Enterprise Server 2016; CVE-2026-65660; fixed in Microsoft SharePoint Enterprise Server 2016 16.0.5565.1001, Microsoft SharePoint Server 2019 16.0.10417.20198, Microsoft SharePoint Server Subscription Edition 16.0.19725.20522. https://pwned.coffee/i/microsoft-sharepoint-code-injection-vulnerability-cve-2026-65660
- **WordPress Core Remote File Inclusion Vulnerability** (high, exploited). WordPress; CVE-2026-87902; fixed in 7.1.2. https://pwned.coffee/i/wordpress-core-remote-file-inclusion-vulnerability-cve-2026-87902
- **Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability** (high, exploited). Citrix NetScaler ADC and Gateway; CVE-2026-88779; fixed in 14.1-73.41, 13.1-64.28, 13.1-37.282. https://pwned.coffee/i/citrix-netscaler-improper-restriction-of-operations-with-cve-2026-88779
- **ISC BIND Data Processing Errors Vulnerability** (high, exploited). ISC BIND; CVE-2015-5477; fixed in juniper junos 12.1, juniper junos 13.2, hpe vcx 9.8.18, isc bind 9.9.7, isc bind 9.10.2. https://pwned.coffee/i/isc-bind-data-processing-errors-vulnerability-cve-2015-5477
- **Apache Struts Command Injection Vulnerability** (high, exploited). Apache Struts; CVE-2016-3081; fixed in apache struts 2.3.20.3, apache struts 2.3.24.3, apache struts 2.3.28.1, org.apache.struts:struts2-core 2.3.20.3, org.apache.struts:struts2-core 2.3.28.1, org.apache.struts:struts2-core 2.3.24.3. https://pwned.coffee/i/apache-struts-command-injection-vulnerability-cve-2016-3081
- **Apple Multiple Products Out-of-Bounds Write Vulnerability** (high, exploited). Apple iOS and iPadOS; CVE-2026-86950; fixed in iOS and iPadOS 26.7.1, macOS 15.8.1. https://pwned.coffee/i/apple-multiple-products-out-of-bounds-write-vulnerabilit-cve-2026-86950
- **Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability** (high, exploited). Ivanti Connect Secure; CVE-2026-104935; fixed in Connect Secure 25.1.3.1, Connect Secure 22.8R2.5, Connect Secure 22.7R2.14, ivanti connect secure 25.1.1.2. https://pwned.coffee/i/ivanti-connect-secure-authentication-bypass-by-spoofing-cve-2026-104935
- **Microsoft Windows Command Injection Vulnerability** (high, exploited). Windows; CVE-2026-96951; fixed in Outlook.com 20260925.100, Windows 10 Version 1607 10.0.14393.9612, Windows 10 Version 1809 10.0.17763.9376, Windows 10 Version 21H2 10.0.19044.7807, Windows 10 Version 22H2 10.0.19045.7807, Windows 11 version 23H2 10.0.22631.7652, Windows 11 Version 24H2 10.0.26100.9711, Windows 11 Version 25H2 10.0.26200.9711, Windows 11 version 26H1 10.0.28000.3231, Windows 11 Version 26H2 10.0.26300.9711, Windows Server 2012 R2 6.3.9600.23470, Windows Server 2022 10.0.20348.5761, Windows Server 2025 10.0.26100.33650. https://pwned.coffee/i/microsoft-windows-command-injection-vulnerability-cve-2026-96951
- **Palo Alto Networks PAN-OS Code Injection Vulnerability** (high, exploited). Palo Alto Networks Cloud NGFW; CVE-2026-0322; fixed in Cloud NGFW 11.2.16, PAN-OS 12.2.4, PAN-OS 12.1.10-h2, PAN-OS 11.1.16-h3, PAN-OS 10.2.18-h12, paloaltonetworks pan-os 10.2.0. https://pwned.coffee/i/palo-alto-networks-pan-os-code-injection-vulnerability-cve-2026-0322
- **Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability** (high, exploited). Atlassian Bamboo Data Center; CVE-2026-21589; fixed in atlassian bitbucket data center 9.4.26, atlassian bitbucket data center 10.2.8, atlassian bitbucket data center 10.5.1, atlassian confluence data center 9.2.26, atlassian confluence data center 10.2.19, atlassian crowd 6.3.7, atlassian crowd 7.0.3, atlassian crowd 7.1.7, atlassian crowd 7.2.4, atlassian jira data center 9.12.40, atlassian jira data center 10.3.26, atlassian jira data center 11.3.12, atlassian jira service management 5.12.40, atlassian bamboo 10.2.24, atlassian bamboo 12.1.12, atlassian crucible 4.9.15. https://pwned.coffee/i/atlassian-multiple-products-files-or-directories-accessi-cve-2026-21589
- **Plex Media Server External Control of File Name or Path Vulnerability** (high, exploited). Plex Media Server; CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; fixed in 1.43.3.10861. https://pwned.coffee/i/plex-media-server-external-control-of-file-name-or-path-vulnerability
- **EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability** (high, exploited). SiteGuard Server Edition; CVE-2026-106931; fixed in SiteGuard Server Edition for Apache httpd Ver8.00 Update 5, SiteGuard Server Edition for Apache httpd on FreeBSD Ver7.00 Update 6, e-guardian siteguard 8.00, e-guardian siteguard 7.00, e-guardian siteguard 3.10. https://pwned.coffee/i/eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931
- **Murrelektronik AAS Edge Client: critical vulnerability** (critical). Murrelektronik AAS Edge Client; CVE-2026-94293; patch: no fix yet. https://pwned.coffee/i/an-unauthenticated-remote-attacker-can-modify-asset-admi-cve-2026-94293
- **Siemens SIMATIC S7 PLCs Web Server Vulnerabilities** (critical). Siemens SIMATIC S7; CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357; patch: no fix yet. https://pwned.coffee/i/siemens-simatic-s7-plcs-web-server-vulnerabilities
- **InterSystems IRIS for Health Cleartext Transmission of Sensitive Information** (high). InterSystems IRIS for Health; CVE-2026-111594; patch: no fix yet. https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594
- **Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks** (critical). Argo CD; CVE-2026-77459; fixed in github.com/argoproj/argo-cd/v3 3.3.15, github.com/argoproj/argo-cd/v3 3.4.10, github.com/argoproj/argo-cd/v3 3.5.4; patch: partial fix. https://pwned.coffee/i/argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459
- **YOOtheme Pro for Joomla: remote code execution** (critical). YOOtheme Pro for Joomla; CVE-2026-102785; patch: fix status unknown. https://pwned.coffee/i/joomla-extension-yootheme-com-unauthenticated-remote-cod-cve-2026-102785
- **SMA1000 Appliance Work Place: server-side request forgery** (critical). SonicWall SMA 1000; CVE-2026-102255; patch: fix status unknown. https://pwned.coffee/i/sma1000-appliance-work-place-server-side-request-forgery-cve-2026-102255
- **Openapi-typescript-codegen: code injection** (critical). openapi-typescript-codegen; CVE-2026-108551; patch: fix status unknown. https://pwned.coffee/i/openapi-typescript-codegen-code-injection-cve-2026-108551
- **HTTP2Shell** (critical). Brotli; CVE-2026-111497; fixed in Node.js 26.12.1, Node.js 24.22.1, Node.js 22.23.4, Brotli 1.0.10, Brotli 1.1.1, Brotli 1.2.1. https://pwned.coffee/i/node2shell-rce-exploit-cve-2026-111497
- **Oracle Java SE: trusts compromised eMudhra CA certificates** (critical). Oracle Java SE; CVE-2026-91403. https://pwned.coffee/i/vulnerability-in-the-oracle-java-se-oracle-graalvm-for-j-cve-2026-91403
- **odhcpd: remote code execution** (critical). odhcpd; CVE-2026-53921; fixed in 25.12. https://pwned.coffee/i/odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-ser-cve-2026-53921

Full machine-readable list: https://pwned.coffee/incidents.json. MCP server: https://pwned.coffee/mcp (check_repo does all of this in one call).

🔔 Today's pass from pwned.coffee. 34 exploited, 10 with no fix.

86'd, no fix yet (10):
• Murrelektronik AAS Edge Client: Critical vulnerability. Do now: Block untrusted network access to Murrelektronik AAS Edge Client's PATCH and GET endpoints until a vendor fix. https://pwned.coffee/i/an-unauthenticated-remote-attacker-can-modify-asset-admi-cve-2026-94293
• Siemens SIMATIC S7: PLCs Web Server. Do now: Restrict access to the S7-1500 web server and disable it if unused until a vendor fix is available. https://pwned.coffee/i/siemens-simatic-s7-plcs-web-server-vulnerabilities
• InterSystems IRIS for Health: Cleartext Transmission of Sensitive Information. Do now: Enable TLS on InterSystems IRIS for Health and restrict network access until a vendor fix is available. https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594
• PHP: Session upload progress RCE in an unusual configuration. Do now: Check whether session upload progress is enabled in your PHP setup and disable it until fixed. https://pwned.coffee/i/php-rce-flaws
• Apache Vysper: Unbounded Allocation. Do now: Restrict network access to Apache Vysper XML parsing endpoints and monitor memory use until a fix is released. https://pwned.coffee/i/apache-vysper-unbounded-allocation-cve-2026-115721

Order up, fix available (56):
• Arista VeloCloud Orchestrator: Improper Input Validation (exploited). Fixed in Arista VeloCloud Orchestrator 5.2.3.16 / 6.4.2.8. https://pwned.coffee/i/arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952
• WSO2 API Manager: WSO2 Multiple Products Path Traversal (exploited). Fixed in WSO2 Universal Gateway 4.5.0.57 / 4.6.0.21; WSO2 Traffic Manager 4.5.0.56; WSO2 API Control Plane 4.5.0.58 / 4.6.0.22; WSO2 API Manager 4.1.0.257 / 4.2.0.197 / 4.3.0.108 / 4.4.0.72; WSO2 Carbon API Manager Rest API Utility 9.20.74.401 / 9.28.116.417 / 9.29.120.236 / 9.30.67.167 / 9.31.86.158 / 9.32.147.59. https://pwned.coffee/i/wso2-multiple-products-path-traversal-vulnerability-cve-2026-5430
• Citrix NetScaler ADC: Memory corruption (exploited). Fixed in ADC 13.1-37.279 and NDcPP / 13.1-64.23 / 14.1-73.37; citrix netscaler application delivery controller 13.1.37.279. https://pwned.coffee/i/citrix-netscaler-adc-memory-corruption-cve-2026-88777
• AhsayCBS: Ahsay AhsayCBS Command Injection (exploited). Fixed in AhsayCBS 10.3.4. https://pwned.coffee/i/ahsay-ahsaycbs-command-injection-vulnerability
• Arista VeloCloud Orchestrator: SQL Injection (exploited). Fixed in VeloCloud Orchestrator 5.2.3.18 / 6.1.3.10 / 6.4.2.12. https://pwned.coffee/i/arista-velocloud-orchestrator-sql-injection-vulnerabilit-cve-2026-114625

Full board: https://pwned.coffee/

359 spills in 12 months

Worst days: 23 Oct 2026 (33 new), 22 Oct 2026 (19 new), 24 Oct 2026 (5 new), 20 Apr 2026 (7 new), 21 Oct 2026 (9 new)

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Today's specials: 82 live security incidents, brew temperature 666°C

Order upFix available56

359 spills in 12 months