Live security incidents, brewed hourly

Decaf: just the things that can hurt you. Breaches, news and anything below high are off the menu.

0 of 82 specials. Clear

Nothing on the board matches those filters.

Browse past orders

Your usual

Choose

Pick what you run and the board and the fire shrink to just that.

Hottest on the menu

Patched since yesterday

Under the heat lamp

Past the KEV deadline, or on the rail for over a week.

Sent back to the kitchen

All

Spreading Next.js: Unauthenticated Remote Code Execution…Now hitting npm (Next.js) too
Spreading Next.js: Unauthenticated Remote Code Execution…Now hitting npm (Next.js) too
Spreading Gitea's Org-mode markup renderer processes…Now hitting Go (Gitea) too
Spreading Gitea's Org-mode markup renderer processes…Now hitting Go (gitea.dev) too

Ask your agent

Cursor, Codex, Claude Code, Gemini CLI, Windsurf or Zed reads your lockfiles and hands back the exact upgrades.

pwned.coffee/mcp Setup and prompts

Check this project and its deployment for exposure to the live security incidents below (from pwned.coffee).

For each one: search lockfiles, manifests, Dockerfiles, CI workflows and infra config for the affected product or package. If it's present, report the version in use, whether it's in the affected range, and the exact upgrade or mitigation. If an incident involves leaked secrets at a provider we use, list which of our secrets live there so they can be rotated. Don't change anything yet; report first.

- **Arista VeloCloud Orchestrator Improper Input Validation Vulnerability** (critical, exploited). Arista VeloCloud Orchestrator; CVE-2026-93952; fixed in 6.4.2.8, 5.2.3.16; patch: partial fix. https://pwned.coffee/i/arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952
- **Check Point Multiple Products Path Traversal Vulnerability** (critical, exploited). Check Point Quantum Security Gateway; CVE-2026-85102, CVE-2026-93616; fixed in Quantum Security Gateway R82.10 Jumbo Hotfix above Take 43, Quantum Security Gateway R82 Jumbo Hotfix above Take 125, Quantum Security Gateway R81.20 Jumbo Hotfix above Take 165, Quantum Security Management R82.20 with any Jumbo Hotfix, Quantum Security Management R82.10 Jumbo Hotfix above Take 44, Quantum Security Management R82 Jumbo Hotfix above Take 126, Quantum Security Management R81.20 Jumbo Hotfix above Take 166; patch: partial fix. https://pwned.coffee/i/check-point-multiple-products-path-traversal-vulnerability
- **Fortinet FortiMail Path Traversal Vulnerability** (critical, exploited). Fortinet FortiMail; CVE-2026-104286; fixed in 8.0.2, 7.6.7, 7.4.9; patch: partial fix. https://pwned.coffee/i/fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286
- **Zammad GmbH Zammad Improper Privilege Management Vulnerability** (critical, exploited). Zammad; CVE-2026-102489, CVE-2026-102490; fixed in 7.2.2; patch: partial fix. https://pwned.coffee/i/zammad-gmbh-zammad-improper-privilege-management-vulnerability
- **Cisco Secure Email Gateway Relative Path Traversal Vulnerability** (critical, exploited). Cisco Secure Email; CVE-2026-76519; fixed in 16.5.0-780, 15.5.5-014; patch: partial fix. https://pwned.coffee/i/cisco-secure-email-gateway-relative-path-traversal-vulne-cve-2026-76519
- **JFrog Artifactory Incorrect Authorization Vulnerability** (high, exploited). JFrog Artifactory; CVE-2026-42016, CVE-2026-42018; fixed in 7.146.8, 7.133.28; patch: partial fix. https://pwned.coffee/i/jfrog-artifactory-incorrect-authorization-vulnerability
- **Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability** (critical, exploited). Cisco Catalyst SD-WAN Manager; CVE-2026-76504; patch: fix status unknown. https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-hex-encoding-vulnerability-cve-2026-76504
- **BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability** (critical, exploited). BeyondTrust Remote Support; CVE-2026-102764; patch: fix status unknown. https://pwned.coffee/i/beyondtrust-remote-support-authentication-bypass-by-spoo-cve-2026-102764
- **F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability** (critical, exploited). F5 BIG-IP; CVE-2026-94127; fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. https://pwned.coffee/i/f5-big-ip-apm-heap-based-buffer-overflow-vulnerability-cve-2026-94127
- **WSO2 Multiple Products Path Traversal Vulnerability** (critical, exploited). WSO2 API Manager and Universal Gateway; CVE-2026-5430; fixed in WSO2 Universal Gateway 4.6.0.21, WSO2 Universal Gateway 4.5.0.57, WSO2 Traffic Manager 4.6.0.21, WSO2 Traffic Manager 4.5.0.56, WSO2 API Control Plane 4.6.0.22, WSO2 API Control Plane 4.5.0.58, WSO2 API Manager 4.6.0.21, WSO2 API Manager 4.5.0.57, WSO2 API Manager 4.4.0.72, WSO2 API Manager 4.3.0.108, WSO2 API Manager 4.2.0.197, WSO2 API Manager 4.1.0.257, WSO2 Carbon API Manager Rest API Utility 9.32.147.59, WSO2 Carbon API Manager Rest API Utility 9.31.86.158, WSO2 Carbon API Manager Rest API Utility 9.30.67.167, WSO2 Carbon API Manager Rest API Utility 9.29.120.236, WSO2 Carbon API Manager Rest API Utility 9.28.116.417, WSO2 Carbon API Manager Rest API Utility 9.20.74.401. https://pwned.coffee/i/wso2-multiple-products-path-traversal-vulnerability-cve-2026-5430
- **Adobe Commerce and Magento Incorrect Authorization Vulnerability** (critical, exploited). Adobe Commerce; CVE-2026-71362; fixed in Adobe Commerce 2.4.9-2026-aug, Adobe Commerce 2.4.8-2026-aug, Adobe Commerce 2.4.7-2026-aug, Adobe Commerce 2.4.6-2026-aug, Adobe Commerce 2.4.5-2026-aug, Adobe Commerce 2.4.4-2026-aug, Adobe Commerce B2B 1.5.3-2026-aug, Adobe Commerce B2B 1.5.2-2026-aug, Adobe Commerce B2B 1.4.2-2026-aug, Adobe Commerce B2B 1.3.4-2026-aug, Adobe Commerce B2B 1.3.3-2026-aug, Magento Open Source 2.4.9-2026-aug, Magento Open Source 2.4.8-2026-aug, Magento Open Source 2.4.7-2026-aug, Magento Open Source 2.4.6-2026-aug. https://pwned.coffee/i/adobe-commerce-and-magento-incorrect-authorization-vulne-cve-2026-71362
- **Citrix NetScaler ADC: memory corruption** (critical, exploited). Citrix NetScaler ADC and Gateway; CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778; fixed in ADC 14.1-73.37, ADC 13.1-64.23, ADC 13.1.37.279 FIPS and NDcPP, Gateway 14.1-73.37, Gateway 13.1-64.23. https://pwned.coffee/i/citrix-netscaler-adc-memory-corruption-cve-2026-88777
- **ONLYOFFICE Docs Server Path Traversal Vulnerability** (critical, exploited). ONLYOFFICE Docs; CVE-2021-3199; fixed in 5.6.3. https://pwned.coffee/i/onlyoffice-docs-server-path-traversal-vulnerability-cve-2021-3199
- **ProFTPD Improper Access Control Vulnerability** (critical, exploited). ProFTPD; CVE-2015-3306; fixed in 1.3.5a. https://pwned.coffee/i/proftpd-improper-access-control-vulnerability-cve-2015-3306
- **Ahsay AhsayCBS Command Injection Vulnerability** (critical, exploited). AhsayCBS; CVE-2026-105133, CVE-2026-105134; fixed in 10.3.4. https://pwned.coffee/i/ahsay-ahsaycbs-command-injection-vulnerability
- **Collabora Online – Built-in CODE Server OS Command Injection Vulnerability** (critical, exploited). Collabora Online; CVE-2026-110447; fixed in 26.4.303. https://pwned.coffee/i/collabora-online-built-in-code-server-os-command-injecti-cve-2026-110447
- **Arista VeloCloud Orchestrator SQL Injection Vulnerability** (critical, exploited). Arista VeloCloud Orchestrator; CVE-2026-114625; fixed in 6.4.2.12, 6.1.3.10, 5.2.3.18. https://pwned.coffee/i/arista-velocloud-orchestrator-sql-injection-vulnerabilit-cve-2026-114625
- **Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability** (high, exploited). Zyxel GS1900 switches; CVE-2026-7273; fixed in 2.90\(aahh.2\)c0. https://pwned.coffee/i/zyxel-gs1900-series-switches-stack-based-buffer-overflow-cve-2026-7273
- **Microsoft SharePoint Code Injection Vulnerability** (high, exploited). Microsoft SharePoint Enterprise Server 2016; CVE-2026-65660; fixed in Microsoft SharePoint Enterprise Server 2016 16.0.5565.1001, Microsoft SharePoint Server 2019 16.0.10417.20198, Microsoft SharePoint Server Subscription Edition 16.0.19725.20522. https://pwned.coffee/i/microsoft-sharepoint-code-injection-vulnerability-cve-2026-65660
- **WordPress Core Remote File Inclusion Vulnerability** (high, exploited). WordPress; CVE-2026-87902; fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37. https://pwned.coffee/i/wordpress-core-remote-file-inclusion-vulnerability-cve-2026-87902
- **Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability** (high, exploited). Citrix NetScaler ADC and Gateway; CVE-2026-88779; fixed in ADC 14.1-73.41, ADC 13.1-64.28, ADC 13.1-37.282, Gateway 14.1-73.41, Gateway 13.1-64.28. https://pwned.coffee/i/citrix-netscaler-improper-restriction-of-operations-with-cve-2026-88779
- **ISC BIND Data Processing Errors Vulnerability** (high, exploited). ISC BIND; CVE-2015-5477; fixed in 9.10.2-P3, 9.9.7-P2. https://pwned.coffee/i/isc-bind-data-processing-errors-vulnerability-cve-2015-5477
- **Apache Struts Command Injection Vulnerability** (high, exploited). Apache Struts; CVE-2016-3081; fixed in org.apache.struts:struts2-core 2.3.28.1, org.apache.struts:struts2-core 2.3.24.3, org.apache.struts:struts2-core 2.3.20.3. https://pwned.coffee/i/apache-struts-command-injection-vulnerability-cve-2016-3081
- **Apple Multiple Products Out-of-Bounds Write Vulnerability** (high, exploited). Apple iOS and iPadOS; CVE-2026-86950; fixed in iOS and iPadOS 26.7.1, macOS 26.7.1, macOS 15.8.1. https://pwned.coffee/i/apple-multiple-products-out-of-bounds-write-vulnerabilit-cve-2026-86950
- **Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability** (high, exploited). Ivanti Connect Secure; CVE-2026-104935; fixed in 25.1.3.0, 22.8R2.5, 22.7R2.14. https://pwned.coffee/i/ivanti-connect-secure-authentication-bypass-by-spoofing-cve-2026-104935
- **Microsoft Windows Command Injection Vulnerability** (high, exploited). Windows; CVE-2026-96951; fixed in Outlook.com 20260925.100, Windows 10 Version 1607 10.0.14393.9612, Windows 10 Version 1809 10.0.17763.9376, Windows 10 Version 21H2 10.0.19044.7807, Windows 10 Version 22H2 10.0.19045.7807, Windows 11 version 23H2 10.0.22631.7652, Windows 11 Version 24H2 10.0.26100.9711, Windows 11 Version 25H2 10.0.26200.9711, Windows 11 version 26H1 10.0.28000.3231, Windows 11 Version 26H2 10.0.26300.9711, Windows Server 2012 R2 6.3.9600.23470, Windows Server 2012 R2 (Server Core installation) 6.3.9600.23470, Windows Server 2016 10.0.14393.9612, Windows Server 2016 (Server Core installation) 10.0.14393.9612, Windows Server 2019 10.0.17763.9376, Windows Server 2019 (Server Core installation) 10.0.17763.9376, Windows Server 2022 10.0.20348.5761, Windows Server 2025 10.0.26100.33650, Windows Server 2025 (Server Core installation) 10.0.26100.33650. https://pwned.coffee/i/microsoft-windows-command-injection-vulnerability-cve-2026-96951
- **Palo Alto Networks PAN-OS Code Injection Vulnerability** (high, exploited). Palo Alto Networks Cloud NGFW; CVE-2026-0322; fixed in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12. https://pwned.coffee/i/palo-alto-networks-pan-os-code-injection-vulnerability-cve-2026-0322
- **Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability** (high, exploited). Atlassian Bamboo Data Center; CVE-2026-21589; fixed in Bamboo Data Center 12.1.12, Bamboo Data Center 10.2.24, Bitbucket Data Center 10.5.1, Bitbucket Data Center 10.2.8, Bitbucket Data Center 9.4.26, Confluence Data Center 10.2.19, Confluence Data Center 9.2.26, Crowd Data Center 7.2.4, Crowd Data Center 7.1.7, Crowd Data Center 7.0.3, Crowd Data Center 6.3.7, Crucible Data Center 4.9.15, Fisheye Data Center 4.9.15, Jira Service Management Data Center 11.3.12, Jira Service Management Data Center 10.3.26, Jira Service Management Data Center 5.12.40, Jira Software Data Center 11.3.12, Jira Software Data Center 10.3.26, Jira Software Data Center 9.12.40. https://pwned.coffee/i/atlassian-multiple-products-files-or-directories-accessi-cve-2026-21589
- **Plex Media Server External Control of File Name or Path Vulnerability** (high, exploited). Plex Media Server; CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; fixed in 1.43.3.10861. https://pwned.coffee/i/plex-media-server-external-control-of-file-name-or-path-vulnerability
- **EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability** (high, exploited). SiteGuard Server Edition; CVE-2026-106931; fixed in SiteGuard Server Edition for Apache httpd Ver8.00 Update 5, SiteGuard Server Edition for Nginx Ver8.00 Update 5, SiteGuard Server Edition for IIS Ver8.00 Update 5, SiteGuard Server Edition for Apache httpd on FreeBSD Ver7.00 Update 6, SiteGuard Server Edition for Nginx on FreeBSD Ver7.00 Update 6. https://pwned.coffee/i/eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931
- **Murrelektronik AAS Edge Client: critical vulnerability** (critical). Murrelektronik AAS Edge Client; CVE-2026-94293; patch: no fix yet. https://pwned.coffee/i/an-unauthenticated-remote-attacker-can-modify-asset-admi-cve-2026-94293
- **Openapi-typescript-codegen: code injection** (critical). openapi-typescript-codegen; CVE-2026-108551; patch: no fix yet. https://pwned.coffee/i/openapi-typescript-codegen-code-injection-cve-2026-108551
- **Siemens SIMATIC S7 PLCs Web Server Vulnerabilities** (critical). Siemens SIMATIC S7; CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357; patch: no fix yet. https://pwned.coffee/i/siemens-simatic-s7-plcs-web-server-vulnerabilities
- **InterSystems IRIS for Health Cleartext Transmission of Sensitive Information** (high). InterSystems IRIS for Health; CVE-2026-111594; patch: no fix yet. https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594
- **Critical FortiSIEM Flaw Gets Public Exploit PoC** (critical). FortiSIEM; CVE-2026-106173; fixed in 7.5.1; patch: partial fix. https://pwned.coffee/i/critical-fortisiem-flaw-gets-public-exploit-poc-cve-2026-106173
- **Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks** (critical). Argo CD; CVE-2026-77459; fixed in Argo CD 3.6.0-rc2, Argo CD 3.5.4, Argo CD 3.4.10, Argo CD 3.3.15; patch: partial fix. https://pwned.coffee/i/argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459
- **nginx RCE** (high). NGINX Plus; CVE-2026-15176, CVE-2026-93479; fixed in NGINX Plus 37.1.0.1, NGINX Plus 37.0.5.1, NGINX Open Source 1.31.7, NGINX Open Source 1.30.6; patch: partial fix. https://pwned.coffee/i/nginx-rce
- **YOOtheme Pro for Joomla: remote code execution** (critical). YOOtheme Pro for Joomla; CVE-2026-102785; patch: fix status unknown. https://pwned.coffee/i/joomla-extension-yootheme-com-unauthenticated-remote-cod-cve-2026-102785
- **SMA1000 Appliance Work Place: server-side request forgery** (critical). SonicWall SMA 1000; CVE-2026-102255; patch: fix status unknown. https://pwned.coffee/i/sma1000-appliance-work-place-server-side-request-forgery-cve-2026-102255
- **HTTP2Shell** (critical). Brotli; CVE-2026-111497; fixed in Node.js 26.12.1, Node.js 24.22.1, Node.js 22.23.4, Brotli 1.2.1, Brotli 1.1.1, Brotli 1.0.10. https://pwned.coffee/i/node2shell-rce-exploit-cve-2026-111497

Full machine-readable list: https://pwned.coffee/incidents.json. MCP server: https://pwned.coffee/mcp (check_repo does all of this in one call).

🔔 Today's pass from pwned.coffee. 34 exploited, 12 with no fix.

86'd, no fix yet (12):
• Arista VeloCloud Orchestrator: Improper Input Validation (exploited). Do now: Upgrade VeloCloud Orchestrator to 6.4.2.8 or 5.2.3.16 now, since this flaw is being exploited. https://pwned.coffee/i/arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952
• Murrelektronik AAS Edge Client: Critical vulnerability. Do now: Block untrusted network access to Murrelektronik AAS Edge Client's PATCH and GET endpoints until a vendor fix. https://pwned.coffee/i/an-unauthenticated-remote-attacker-can-modify-asset-admi-cve-2026-94293
• openapi-typescript-codegen: Code injection. Do now: Avoid generating code from untrusted OpenAPI documents with openapi-typescript-codegen, and watch for a vendor fix. https://pwned.coffee/i/openapi-typescript-codegen-code-injection-cve-2026-108551
• Siemens SIMATIC S7: PLCs Web Server. Do now: Restrict access to the S7-1500 web server and disable it if unused until a vendor fix is available. https://pwned.coffee/i/siemens-simatic-s7-plcs-web-server-vulnerabilities
• InterSystems IRIS for Health: Cleartext Transmission of Sensitive Information. Do now: Enable TLS on InterSystems IRIS for Health and restrict network access until a vendor fix is available. https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594

Order up, fix available (57):
• Check Point Quantum Security: Check Point Multiple Products Path Traversal (exploited). Fixed in Quantum Security Gateway R81.20 Jumbo Hotfix above Take 165 / R82 Jumbo Hotfix above Take 125 / R82.10 Jumbo Hotfix above Take 43; Quantum Security Management R81.20 Jumbo Hotfix above Take 166 / R82 Jumbo Hotfix above Take 126 / R82.10 Jumbo Hotfix above Take 44 / R82.20 with any Jumbo Hotfix. https://pwned.coffee/i/check-point-multiple-products-path-traversal-vulnerability
• Fortinet FortiMail: Path Traversal (exploited). Fixed in FortiMail 7.4.9 / 7.6.7 / 8.0.2. https://pwned.coffee/i/fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286
• Zammad: GmbH Zammad Improper Privilege Management (exploited). Fixed in Zammad 7.2.2. https://pwned.coffee/i/zammad-gmbh-zammad-improper-privilege-management-vulnerability
• Cisco Secure Email: Gateway Relative Path Traversal (exploited). Fixed in Cisco Secure Email 15.5.5-014 / 16.5.0-780. https://pwned.coffee/i/cisco-secure-email-gateway-relative-path-traversal-vulne-cve-2026-76519
• JFrog Artifactory: Incorrect Authorization (exploited). Fixed in JFrog Artifactory 7.133.28 / 7.146.8. https://pwned.coffee/i/jfrog-artifactory-incorrect-authorization-vulnerability

Full board: https://pwned.coffee/

359 spills in 12 months

Worst days: 23 Oct 2026 (33 new), 22 Oct 2026 (19 new), 24 Oct 2026 (5 new), 21 Oct 2026 (9 new), 2 Sept 2026 (6 new)

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Today's specials: 82 live security incidents, brew temperature 666°C

359 spills in 12 months