Live security incidents, brewed hourly

Decaf: just the things that can hurt you. Breaches, news and anything below high are off the menu.

30 of 82 specials. Clear

Order upFix available30

The fix exists. Somebody has to carry it.

Check Point Quantum Security32 d Check Point Multiple Products Path Traversal 🔥 On the fly · exploitedKEV overdue 29dcritical severity
Fixed in Quantum Security Gateway R82.10 Jumbo Hotfix above Take 43, Quantum Security Gateway R82 Jumbo Hotfix above Take 125 +5 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 32 days KEV ✓ Record ✓ Vendor ✓
Fortinet FortiMail23 d Path Traversal 🔥 On the fly · exploitedKEV overdue 20dcritical severity
Fixed in 8.0.2, 7.6.7 +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 23 days KEV ✓ Record ✓ Vendor ✓
Zammad22 d GmbH Zammad Improper Privilege Management 🔥 On the fly · exploitedKEV overdue 19dcritical severity
Fixed in 7.2.2 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 22 days KEV ✓ Record ✓ Vendor ✓

Cisco Secure Email10 d Gateway Relative Path Traversal 🔥 On the fly · exploitedKEV overdue 7dcritical severity
Fixed in 16.5.0-780, 15.5.5-014 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 10 days KEV ✓ Record ✓ Vendor ✓
WSO2 API Manager30 d WSO2 Multiple Products Path Traversal 🔥 On the fly · exploitedcritical severity
Fixed in WSO2 Universal Gateway 4.6.0.21, WSO2 Universal Gateway 4.5.0.57 +16 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 30 days KEV ✓ Record ✓ Vendor ✓
Citrix NetScaler ADC13 h Memory corruption 🔥 On the fly · exploitedcritical severity
Fixed in ADC 14.1-73.37, ADC 13.1-64.23 +3 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 27 days KEV ✓ Record ✓ Vendor ✓

ProFTPD16 d Improper Access Control 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dcritical severity
Fixed in 1.3.5a Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor ✓
AhsayCBS10 d Ahsay AhsayCBS Command Injection 🔥 On the fly · exploitedKEV overdue 7dcritical severity
Fixed in 10.3.4 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 10 days KEV ✓ Record ✓ Vendor ✓
Arista VeloCloud Orchestrator18 h SQL Injection 🔥 On the fly · exploitedKEV due in 2dcritical severity
Fixed in 6.4.2.12, 6.1.3.10 +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV ✓ Record ✓ Vendor ✓

F5 BIG-IP32 d APM Heap-based Buffer Overflow 🔥 On the fly · exploitedcritical severity
Fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG +1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 32 days KEV ✓ Record ✓ Vendor ✓
ONLYOFFICE Docs16 d Server Path Traversal 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13dcritical severity
Fixed in 5.6.3 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 16 days KEV ✓ Record ✓ Vendor ✓
Collabora Online5 h Built-in CODE Server OS Command Injection 🔥 On the fly · exploitedKEV due in 2dcritical severity
Fixed in 26.4.303 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV ✓ Record ✓ Vendor ✓

Adobe Commerce30 d And Magento Incorrect Authorization 🔥 On the fly · exploitedcritical severity
Fixed in Adobe Commerce 2.4.9-2026-aug, Adobe Commerce 2.4.8-2026-aug +13 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) Under the heat lamp: 30 days KEV ✓ Record ✓ Vendor ✓
FortiSIEM4 d Critical FortiSIEM Flaw Gets Public Exploit PoC public PoCcritical severity
Fixed in 7.5.1 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
GitLab18 h Remote code execution critical severity
Fixed in 19.5.1, 19.4.3 +5 Advisory
KEV – Record ✓ Vendor ✓

Kiloview E3 NDI Encoder2 d Vulnerabilities critical severity
Fixed in V1.30 Advisory
Fix found 24 Oct ~~1.30~~ → V1.30 KEV – Record ✓ Vendor ✓
Siemens RUGGEDCOM CROSSBOW2 d Vulnerability public PoCcritical severity
Fixed in Siemens RUGGEDCOM CROSSBOW Station Access Controller V6.0, Siemens RUGGEDCOM CROSSBOW V6.0 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Pillow4 d 13.0.0 (major upgrade): 5 security fixes public PoCcritical severity
Fixed in Pillow 13.0.0, 13.0.0 Advisory
Fix found 24 Oct ~~Pillow 13.0.0~~ → 13.0.0, Pillow 13.0.0 KEV – Record ✓ Vendor ✓

odhcpd15 h Remote code execution critical severity
Fixed in 25.12 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Gitea17 h 's Org-mode markup renderer processes INCLUDE directives supplied to the repository m Spreadingcritical severity
Now hitting Go (Gitea) too (added 24 Oct)Fixed in Gitea 1.27.1, 1.27.1 Advisorygo get Gitea@v1.27.1
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
GeoVision GV-ASManager18 h Critical vulnerability critical severity
Fixed in 6.4.0 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓

Splunk Enterprise18 h Critical vulnerability critical severity
Fixed in 10.4.3, 10.2.7 Advisory
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
PHP20 h PHP2Shell Bugs critical severity
Fixed in 8.5.12, 8.4.27 +2 Advisory
Fix found 24 Oct ~~PHP 8.2.35, PHP 8.3.36, PHP…~~ → 8.5.12, 8.4.27, 8.3.36, 8.2.35 KEV – Record ✓ Vendor ✓
Cisco Expressway3 d Cisco Expressway RCE critical severity
The vendor: “Cisco has released software updates that address this vulnerability.” See the vendor's fixed-release table
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓

Brotli2 h HTTP2Shell SpreadingNot fixed everywherecritical severity
Now hitting Python (Brotli) too (added 23 Oct)Fixed in Node.js 26.12.1, Node.js 24.22.1 +4 Advisorypip install --upgrade "Brotli>=1.2.1"
Re-plated 24 Oct ~~86'd (no fix yet)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓
Laravel15 h Authentication bypass critical severity
Fixed in Laravel 13.29.0, Laravel 12.68.0 +1 AdvisoryOn 12.x?composer require Laravel:^12.68.0On 13.x?composer require Laravel:^13.29.0
Fix found 24 Oct ~~laravel/framework 13.29.0…~~ → framework 12.68.0, laravel/framework… KEV – Record ✓ Vendor ✓
Oracle Java SE7 h Trusts compromised eMudhra CA certificates critical severity
The vendor: “Update to the latest Java release, which distrusts the impacted eMudhra intermediate CAs.” See the vendor's fixed-release table
Re-plated 24 Oct ~~On hold (status unknown)~~ → Order up (fix available) KEV – Record ✓ Vendor ✓

Sentry JavaScript SDK2 d Sentry-JavaScript: Middleware Bypass when using Tunnel route critical severity
Fixed in Sentry JavaScript SDK 11.0.0-rc.1, Sentry JavaScript SDK 10.75.2 +1 AdvisoryOn 9.x?npm install Sentry JavaScript SDK@9.47.2On 10.x?npm install Sentry JavaScript SDK@10.75.2
KEV – Record ✓ Vendor –
Next.js2 d Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays Spreadingcritical severity
Now hitting npm (Next.js) too (added 24 Oct)Fixed in Next.js 16.4.1 Advisorynpm install Next.js@16.4.1
KEV – Record ✓ Vendor –
Next.js2 d Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used Spreadingcritical severity
Now hitting npm (Next.js) too (added 24 Oct)Fixed in Next.js 16.4.1, Next.js 15.5.28 AdvisoryOn 16.x?npm install Next.js@16.4.1
KEV – Record ✓ Vendor –

Your usual

Choose

Pick what you run and the board and the fire shrink to just that.

Hottest on the menu

Patched since yesterday

Under the heat lamp

Past the KEV deadline, or on the rail for over a week.

Sent back to the kitchen

All

Spreading Next.js: Unauthenticated Remote Code Execution…Now hitting npm (Next.js) too
Spreading Next.js: Unauthenticated Remote Code Execution…Now hitting npm (Next.js) too
Spreading Gitea's Org-mode markup renderer processes…Now hitting Go (Gitea) too
Spreading Gitea's Org-mode markup renderer processes…Now hitting Go (gitea.dev) too

Ask your agent

Cursor, Codex, Claude Code, Gemini CLI, Windsurf or Zed reads your lockfiles and hands back the exact upgrades.

pwned.coffee/mcp Setup and prompts

Check this project and its deployment for exposure to the live security incidents below (from pwned.coffee).

For each one: search lockfiles, manifests, Dockerfiles, CI workflows and infra config for the affected product or package. If it's present, report the version in use, whether it's in the affected range, and the exact upgrade or mitigation. If an incident involves leaked secrets at a provider we use, list which of our secrets live there so they can be rotated. Don't change anything yet; report first.

- **Arista VeloCloud Orchestrator Improper Input Validation Vulnerability** (critical, exploited). Arista VeloCloud Orchestrator; CVE-2026-93952; fixed in 6.4.2.8, 5.2.3.16; patch: partial fix. https://pwned.coffee/i/arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952
- **Check Point Multiple Products Path Traversal Vulnerability** (critical, exploited). Check Point Quantum Security Gateway; CVE-2026-85102, CVE-2026-93616; fixed in Quantum Security Gateway R82.10 Jumbo Hotfix above Take 43, Quantum Security Gateway R82 Jumbo Hotfix above Take 125, Quantum Security Gateway R81.20 Jumbo Hotfix above Take 165, Quantum Security Management R82.20 with any Jumbo Hotfix, Quantum Security Management R82.10 Jumbo Hotfix above Take 44, Quantum Security Management R82 Jumbo Hotfix above Take 126, Quantum Security Management R81.20 Jumbo Hotfix above Take 166; patch: partial fix. https://pwned.coffee/i/check-point-multiple-products-path-traversal-vulnerability
- **Fortinet FortiMail Path Traversal Vulnerability** (critical, exploited). Fortinet FortiMail; CVE-2026-104286; fixed in 8.0.2, 7.6.7, 7.4.9; patch: partial fix. https://pwned.coffee/i/fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286
- **Zammad GmbH Zammad Improper Privilege Management Vulnerability** (critical, exploited). Zammad; CVE-2026-102489, CVE-2026-102490; fixed in 7.2.2; patch: partial fix. https://pwned.coffee/i/zammad-gmbh-zammad-improper-privilege-management-vulnerability
- **Cisco Secure Email Gateway Relative Path Traversal Vulnerability** (critical, exploited). Cisco Secure Email; CVE-2026-76519; fixed in 16.5.0-780, 15.5.5-014; patch: partial fix. https://pwned.coffee/i/cisco-secure-email-gateway-relative-path-traversal-vulne-cve-2026-76519
- **JFrog Artifactory Incorrect Authorization Vulnerability** (high, exploited). JFrog Artifactory; CVE-2026-42016, CVE-2026-42018; fixed in 7.146.8, 7.133.28; patch: partial fix. https://pwned.coffee/i/jfrog-artifactory-incorrect-authorization-vulnerability
- **Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability** (critical, exploited). Cisco Catalyst SD-WAN Manager; CVE-2026-76504; patch: fix status unknown. https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-hex-encoding-vulnerability-cve-2026-76504
- **BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability** (critical, exploited). BeyondTrust Remote Support; CVE-2026-102764; patch: fix status unknown. https://pwned.coffee/i/beyondtrust-remote-support-authentication-bypass-by-spoo-cve-2026-102764
- **F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability** (critical, exploited). F5 BIG-IP; CVE-2026-94127; fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. https://pwned.coffee/i/f5-big-ip-apm-heap-based-buffer-overflow-vulnerability-cve-2026-94127
- **WSO2 Multiple Products Path Traversal Vulnerability** (critical, exploited). WSO2 API Manager and Universal Gateway; CVE-2026-5430; fixed in WSO2 Universal Gateway 4.6.0.21, WSO2 Universal Gateway 4.5.0.57, WSO2 Traffic Manager 4.6.0.21, WSO2 Traffic Manager 4.5.0.56, WSO2 API Control Plane 4.6.0.22, WSO2 API Control Plane 4.5.0.58, WSO2 API Manager 4.6.0.21, WSO2 API Manager 4.5.0.57, WSO2 API Manager 4.4.0.72, WSO2 API Manager 4.3.0.108, WSO2 API Manager 4.2.0.197, WSO2 API Manager 4.1.0.257, WSO2 Carbon API Manager Rest API Utility 9.32.147.59, WSO2 Carbon API Manager Rest API Utility 9.31.86.158, WSO2 Carbon API Manager Rest API Utility 9.30.67.167, WSO2 Carbon API Manager Rest API Utility 9.29.120.236, WSO2 Carbon API Manager Rest API Utility 9.28.116.417, WSO2 Carbon API Manager Rest API Utility 9.20.74.401. https://pwned.coffee/i/wso2-multiple-products-path-traversal-vulnerability-cve-2026-5430
- **Adobe Commerce and Magento Incorrect Authorization Vulnerability** (critical, exploited). Adobe Commerce; CVE-2026-71362; fixed in Adobe Commerce 2.4.9-2026-aug, Adobe Commerce 2.4.8-2026-aug, Adobe Commerce 2.4.7-2026-aug, Adobe Commerce 2.4.6-2026-aug, Adobe Commerce 2.4.5-2026-aug, Adobe Commerce 2.4.4-2026-aug, Adobe Commerce B2B 1.5.3-2026-aug, Adobe Commerce B2B 1.5.2-2026-aug, Adobe Commerce B2B 1.4.2-2026-aug, Adobe Commerce B2B 1.3.4-2026-aug, Adobe Commerce B2B 1.3.3-2026-aug, Magento Open Source 2.4.9-2026-aug, Magento Open Source 2.4.8-2026-aug, Magento Open Source 2.4.7-2026-aug, Magento Open Source 2.4.6-2026-aug. https://pwned.coffee/i/adobe-commerce-and-magento-incorrect-authorization-vulne-cve-2026-71362
- **Citrix NetScaler ADC: memory corruption** (critical, exploited). Citrix NetScaler ADC and Gateway; CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778; fixed in ADC 14.1-73.37, ADC 13.1-64.23, ADC 13.1.37.279 FIPS and NDcPP, Gateway 14.1-73.37, Gateway 13.1-64.23. https://pwned.coffee/i/citrix-netscaler-adc-memory-corruption-cve-2026-88777
- **ONLYOFFICE Docs Server Path Traversal Vulnerability** (critical, exploited). ONLYOFFICE Docs; CVE-2021-3199; fixed in 5.6.3. https://pwned.coffee/i/onlyoffice-docs-server-path-traversal-vulnerability-cve-2021-3199
- **ProFTPD Improper Access Control Vulnerability** (critical, exploited). ProFTPD; CVE-2015-3306; fixed in 1.3.5a. https://pwned.coffee/i/proftpd-improper-access-control-vulnerability-cve-2015-3306
- **Ahsay AhsayCBS Command Injection Vulnerability** (critical, exploited). AhsayCBS; CVE-2026-105133, CVE-2026-105134; fixed in 10.3.4. https://pwned.coffee/i/ahsay-ahsaycbs-command-injection-vulnerability
- **Collabora Online – Built-in CODE Server OS Command Injection Vulnerability** (critical, exploited). Collabora Online; CVE-2026-110447; fixed in 26.4.303. https://pwned.coffee/i/collabora-online-built-in-code-server-os-command-injecti-cve-2026-110447
- **Arista VeloCloud Orchestrator SQL Injection Vulnerability** (critical, exploited). Arista VeloCloud Orchestrator; CVE-2026-114625; fixed in 6.4.2.12, 6.1.3.10, 5.2.3.18. https://pwned.coffee/i/arista-velocloud-orchestrator-sql-injection-vulnerabilit-cve-2026-114625
- **Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability** (high, exploited). Zyxel GS1900 switches; CVE-2026-7273; fixed in 2.90\(aahh.2\)c0. https://pwned.coffee/i/zyxel-gs1900-series-switches-stack-based-buffer-overflow-cve-2026-7273
- **Microsoft SharePoint Code Injection Vulnerability** (high, exploited). Microsoft SharePoint Enterprise Server 2016; CVE-2026-65660; fixed in Microsoft SharePoint Enterprise Server 2016 16.0.5565.1001, Microsoft SharePoint Server 2019 16.0.10417.20198, Microsoft SharePoint Server Subscription Edition 16.0.19725.20522. https://pwned.coffee/i/microsoft-sharepoint-code-injection-vulnerability-cve-2026-65660
- **WordPress Core Remote File Inclusion Vulnerability** (high, exploited). WordPress; CVE-2026-87902; fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37. https://pwned.coffee/i/wordpress-core-remote-file-inclusion-vulnerability-cve-2026-87902
- **Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability** (high, exploited). Citrix NetScaler ADC and Gateway; CVE-2026-88779; fixed in ADC 14.1-73.41, ADC 13.1-64.28, ADC 13.1-37.282, Gateway 14.1-73.41, Gateway 13.1-64.28. https://pwned.coffee/i/citrix-netscaler-improper-restriction-of-operations-with-cve-2026-88779
- **ISC BIND Data Processing Errors Vulnerability** (high, exploited). ISC BIND; CVE-2015-5477; fixed in 9.10.2-P3, 9.9.7-P2. https://pwned.coffee/i/isc-bind-data-processing-errors-vulnerability-cve-2015-5477
- **Apache Struts Command Injection Vulnerability** (high, exploited). Apache Struts; CVE-2016-3081; fixed in org.apache.struts:struts2-core 2.3.28.1, org.apache.struts:struts2-core 2.3.24.3, org.apache.struts:struts2-core 2.3.20.3. https://pwned.coffee/i/apache-struts-command-injection-vulnerability-cve-2016-3081
- **Apple Multiple Products Out-of-Bounds Write Vulnerability** (high, exploited). Apple iOS and iPadOS; CVE-2026-86950; fixed in iOS and iPadOS 26.7.1, macOS 26.7.1, macOS 15.8.1. https://pwned.coffee/i/apple-multiple-products-out-of-bounds-write-vulnerabilit-cve-2026-86950
- **Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability** (high, exploited). Ivanti Connect Secure; CVE-2026-104935; fixed in 25.1.3.0, 22.8R2.5, 22.7R2.14. https://pwned.coffee/i/ivanti-connect-secure-authentication-bypass-by-spoofing-cve-2026-104935
- **Microsoft Windows Command Injection Vulnerability** (high, exploited). Windows; CVE-2026-96951; fixed in Outlook.com 20260925.100, Windows 10 Version 1607 10.0.14393.9612, Windows 10 Version 1809 10.0.17763.9376, Windows 10 Version 21H2 10.0.19044.7807, Windows 10 Version 22H2 10.0.19045.7807, Windows 11 version 23H2 10.0.22631.7652, Windows 11 Version 24H2 10.0.26100.9711, Windows 11 Version 25H2 10.0.26200.9711, Windows 11 version 26H1 10.0.28000.3231, Windows 11 Version 26H2 10.0.26300.9711, Windows Server 2012 R2 6.3.9600.23470, Windows Server 2012 R2 (Server Core installation) 6.3.9600.23470, Windows Server 2016 10.0.14393.9612, Windows Server 2016 (Server Core installation) 10.0.14393.9612, Windows Server 2019 10.0.17763.9376, Windows Server 2019 (Server Core installation) 10.0.17763.9376, Windows Server 2022 10.0.20348.5761, Windows Server 2025 10.0.26100.33650, Windows Server 2025 (Server Core installation) 10.0.26100.33650. https://pwned.coffee/i/microsoft-windows-command-injection-vulnerability-cve-2026-96951
- **Palo Alto Networks PAN-OS Code Injection Vulnerability** (high, exploited). Palo Alto Networks Cloud NGFW; CVE-2026-0322; fixed in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12. https://pwned.coffee/i/palo-alto-networks-pan-os-code-injection-vulnerability-cve-2026-0322
- **Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability** (high, exploited). Atlassian Bamboo Data Center; CVE-2026-21589; fixed in Bamboo Data Center 12.1.12, Bamboo Data Center 10.2.24, Bitbucket Data Center 10.5.1, Bitbucket Data Center 10.2.8, Bitbucket Data Center 9.4.26, Confluence Data Center 10.2.19, Confluence Data Center 9.2.26, Crowd Data Center 7.2.4, Crowd Data Center 7.1.7, Crowd Data Center 7.0.3, Crowd Data Center 6.3.7, Crucible Data Center 4.9.15, Fisheye Data Center 4.9.15, Jira Service Management Data Center 11.3.12, Jira Service Management Data Center 10.3.26, Jira Service Management Data Center 5.12.40, Jira Software Data Center 11.3.12, Jira Software Data Center 10.3.26, Jira Software Data Center 9.12.40. https://pwned.coffee/i/atlassian-multiple-products-files-or-directories-accessi-cve-2026-21589
- **Plex Media Server External Control of File Name or Path Vulnerability** (high, exploited). Plex Media Server; CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; fixed in 1.43.3.10861. https://pwned.coffee/i/plex-media-server-external-control-of-file-name-or-path-vulnerability
- **EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability** (high, exploited). SiteGuard Server Edition; CVE-2026-106931; fixed in SiteGuard Server Edition for Apache httpd Ver8.00 Update 5, SiteGuard Server Edition for Nginx Ver8.00 Update 5, SiteGuard Server Edition for IIS Ver8.00 Update 5, SiteGuard Server Edition for Apache httpd on FreeBSD Ver7.00 Update 6, SiteGuard Server Edition for Nginx on FreeBSD Ver7.00 Update 6. https://pwned.coffee/i/eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931
- **Murrelektronik AAS Edge Client: critical vulnerability** (critical). Murrelektronik AAS Edge Client; CVE-2026-94293; patch: no fix yet. https://pwned.coffee/i/an-unauthenticated-remote-attacker-can-modify-asset-admi-cve-2026-94293
- **Openapi-typescript-codegen: code injection** (critical). openapi-typescript-codegen; CVE-2026-108551; patch: no fix yet. https://pwned.coffee/i/openapi-typescript-codegen-code-injection-cve-2026-108551
- **Siemens SIMATIC S7 PLCs Web Server Vulnerabilities** (critical). Siemens SIMATIC S7; CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357; patch: no fix yet. https://pwned.coffee/i/siemens-simatic-s7-plcs-web-server-vulnerabilities
- **InterSystems IRIS for Health Cleartext Transmission of Sensitive Information** (high). InterSystems IRIS for Health; CVE-2026-111594; patch: no fix yet. https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594
- **Critical FortiSIEM Flaw Gets Public Exploit PoC** (critical). FortiSIEM; CVE-2026-106173; fixed in 7.5.1; patch: partial fix. https://pwned.coffee/i/critical-fortisiem-flaw-gets-public-exploit-poc-cve-2026-106173
- **Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks** (critical). Argo CD; CVE-2026-77459; fixed in Argo CD 3.6.0-rc2, Argo CD 3.5.4, Argo CD 3.4.10, Argo CD 3.3.15; patch: partial fix. https://pwned.coffee/i/argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459
- **nginx RCE** (high). NGINX Plus; CVE-2026-15176, CVE-2026-93479; fixed in NGINX Plus 37.1.0.1, NGINX Plus 37.0.5.1, NGINX Open Source 1.31.7, NGINX Open Source 1.30.6; patch: partial fix. https://pwned.coffee/i/nginx-rce
- **YOOtheme Pro for Joomla: remote code execution** (critical). YOOtheme Pro for Joomla; CVE-2026-102785; patch: fix status unknown. https://pwned.coffee/i/joomla-extension-yootheme-com-unauthenticated-remote-cod-cve-2026-102785
- **SMA1000 Appliance Work Place: server-side request forgery** (critical). SonicWall SMA 1000; CVE-2026-102255; patch: fix status unknown. https://pwned.coffee/i/sma1000-appliance-work-place-server-side-request-forgery-cve-2026-102255
- **HTTP2Shell** (critical). Brotli; CVE-2026-111497; fixed in Node.js 26.12.1, Node.js 24.22.1, Node.js 22.23.4, Brotli 1.2.1, Brotli 1.1.1, Brotli 1.0.10. https://pwned.coffee/i/node2shell-rce-exploit-cve-2026-111497

Full machine-readable list: https://pwned.coffee/incidents.json. MCP server: https://pwned.coffee/mcp (check_repo does all of this in one call).

🔔 Today's pass from pwned.coffee. 34 exploited, 12 with no fix.

86'd, no fix yet (12):
• Arista VeloCloud Orchestrator: Improper Input Validation (exploited). Do now: Upgrade VeloCloud Orchestrator to 6.4.2.8 or 5.2.3.16 now, since this flaw is being exploited. https://pwned.coffee/i/arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952
• Murrelektronik AAS Edge Client: Critical vulnerability. Do now: Block untrusted network access to Murrelektronik AAS Edge Client's PATCH and GET endpoints until a vendor fix. https://pwned.coffee/i/an-unauthenticated-remote-attacker-can-modify-asset-admi-cve-2026-94293
• openapi-typescript-codegen: Code injection. Do now: Avoid generating code from untrusted OpenAPI documents with openapi-typescript-codegen, and watch for a vendor fix. https://pwned.coffee/i/openapi-typescript-codegen-code-injection-cve-2026-108551
• Siemens SIMATIC S7: PLCs Web Server. Do now: Restrict access to the S7-1500 web server and disable it if unused until a vendor fix is available. https://pwned.coffee/i/siemens-simatic-s7-plcs-web-server-vulnerabilities
• InterSystems IRIS for Health: Cleartext Transmission of Sensitive Information. Do now: Enable TLS on InterSystems IRIS for Health and restrict network access until a vendor fix is available. https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594

Order up, fix available (57):
• Check Point Quantum Security: Check Point Multiple Products Path Traversal (exploited). Fixed in Quantum Security Gateway R81.20 Jumbo Hotfix above Take 165 / R82 Jumbo Hotfix above Take 125 / R82.10 Jumbo Hotfix above Take 43; Quantum Security Management R81.20 Jumbo Hotfix above Take 166 / R82 Jumbo Hotfix above Take 126 / R82.10 Jumbo Hotfix above Take 44 / R82.20 with any Jumbo Hotfix. https://pwned.coffee/i/check-point-multiple-products-path-traversal-vulnerability
• Fortinet FortiMail: Path Traversal (exploited). Fixed in FortiMail 7.4.9 / 7.6.7 / 8.0.2. https://pwned.coffee/i/fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286
• Zammad: GmbH Zammad Improper Privilege Management (exploited). Fixed in Zammad 7.2.2. https://pwned.coffee/i/zammad-gmbh-zammad-improper-privilege-management-vulnerability
• Cisco Secure Email: Gateway Relative Path Traversal (exploited). Fixed in Cisco Secure Email 15.5.5-014 / 16.5.0-780. https://pwned.coffee/i/cisco-secure-email-gateway-relative-path-traversal-vulne-cve-2026-76519
• JFrog Artifactory: Incorrect Authorization (exploited). Fixed in JFrog Artifactory 7.133.28 / 7.146.8. https://pwned.coffee/i/jfrog-artifactory-incorrect-authorization-vulnerability

Full board: https://pwned.coffee/

359 spills in 12 months

Worst days: 23 Oct 2026 (33 new), 22 Oct 2026 (19 new), 24 Oct 2026 (5 new), 21 Oct 2026 (9 new), 2 Sept 2026 (6 new)

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Today's specials: 82 live security incidents, brew temperature 666°C

Order upFix available30

359 spills in 12 months