{"generated_at":"2026-10-23T14:53:00.187Z","count":13,"incidents":[{"id":"pillow-argument-injection-in-ghostscript-call-potentiall-cve-2026-112900","url":"https://pwned.coffee/i/pillow-argument-injection-in-ghostscript-call-potentiall-cve-2026-112900","title":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","summary":"### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"Pillow (pip)","fixed_versions":["Pillow 13.0.0"],"ids":["CVE-2026-112900"],"stack":["pypi","python"],"first_seen":"2026-10-21T19:58:44Z","updated_at":"2026-10-23T11:17:10.261Z"},{"id":"next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ret","url":"https://pwned.coffee/i/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ret","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","summary":"## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"next (npm)","fixed_versions":["next 16.4.1"],"ids":[],"stack":["npm","nextjs"],"first_seen":"2026-10-22T16:42:31Z","updated_at":"2026-10-22T16:42:31Z"},{"id":"pillow-multi-frame-loaders-can-reuse-stale-native-image-cve-2026-96639","url":"https://pwned.coffee/i/pillow-multi-frame-loaders-can-reuse-stale-native-image-cve-2026-96639","title":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","summary":"### Summary Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"Pillow (pip)","fixed_versions":["Pillow 13.0.0"],"ids":["CVE-2026-96639"],"stack":["pypi","python"],"first_seen":"2026-10-22T16:00:15Z","updated_at":"2026-10-22T16:00:15Z"},{"id":"sentry-javascript-middleware-bypass-when-using-tunnel-ro-cve-2026-114139","url":"https://pwned.coffee/i/sentry-javascript-middleware-bypass-when-using-tunnel-ro-cve-2026-114139","title":"Sentry-Javascript: Middleware Bypass when using Tunnel route","summary":"### Impact The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them. The middleware skip was wider…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"@sentry/nextjs (npm)","fixed_versions":["@sentry/nextjs 9.47.2","@sentry/nextjs 10.75.2","@sentry/nextjs 11.0.0-rc.1"],"ids":["CVE-2026-114139"],"stack":["npm","nextjs"],"first_seen":"2026-10-22T15:55:07Z","updated_at":"2026-10-22T15:55:07Z"},{"id":"next-js-unauthenticated-remote-code-execution-in-image-optimization-api","url":"https://pwned.coffee/i/next-js-unauthenticated-remote-code-execution-in-image-optimization-api","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","summary":"## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"next (npm)","fixed_versions":["next 15.5.28","next 16.4.1"],"ids":[],"stack":["npm","nextjs"],"first_seen":"2026-10-22T15:52:53Z","updated_at":"2026-10-22T15:52:53Z"},{"id":"pillow-heap-buffer-overflow-in-tiffwriteproc-when-saving-cve-2026-112393","url":"https://pwned.coffee/i/pillow-heap-buffer-overflow-in-tiffwriteproc-when-saving-cve-2026-112393","title":"Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","summary":"``` ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ ``` Pillow can write…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"Pillow (pip)","fixed_versions":["Pillow 13.0.0"],"ids":["CVE-2026-112393"],"stack":["pypi","python"],"first_seen":"2026-10-21T21:28:09Z","updated_at":"2026-10-21T21:28:09Z"},{"id":"pillow-heap-buffer-overflow-in-imagingjpegdecode-cve-2026-112403","url":"https://pwned.coffee/i/pillow-heap-buffer-overflow-in-imagingjpegdecode-cve-2026-112403","title":"Pillow: Heap buffer overflow in ImagingJpegDecode","summary":"## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`,…","severity":"critical","patch_status":"patched","status":"live","exploited":false,"affected":"Pillow (pip)","fixed_versions":["Pillow 13.0.0"],"ids":["CVE-2026-112403"],"stack":["pypi","python"],"first_seen":"2026-10-20T20:40:07Z","updated_at":"2026-10-20T20:40:07Z"},{"id":"argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459","url":"https://pwned.coffee/i/argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459","title":"Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks","summary":"### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD…","severity":"critical","patch_status":"partial","status":"live","exploited":false,"affected":"github.com/argoproj/argo-cd/v2 (go), github.com/argoproj/argo-cd/v3 (go)","fixed_versions":["github.com/argoproj/argo-cd/v3 3.3.15","github.com/argoproj/argo-cd/v3 3.4.10","github.com/argoproj/argo-cd/v3 3.5.4","github.com/argoproj/argo-cd/v3 3.6.0-rc2"],"ids":["CVE-2026-77459"],"stack":["go","kubernetes"],"first_seen":"2026-10-15T20:19:31Z","updated_at":"2026-10-15T20:19:31Z"},{"id":"capacitor-android-and-ios-remote-content-can-be-loaded-a-cve-2026-103922","url":"https://pwned.coffee/i/capacitor-android-and-ios-remote-content-can-be-loaded-a-cve-2026-103922","title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","summary":"### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the…","severity":"critical","patch_status":"partial","status":"live","exploited":false,"affected":"@capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven)","fixed_versions":["@capacitor/android 6.2.2","@capacitor/android 7.6.9","@capacitor/ios 6.2.2","@capacitor/ios 7.6.9","github.com/ionic-team/capacitor-swift-pm 6.2.2","github.com/ionic-team/capacitor-swift-pm 7.6.9","com.capacitorjs:core 6.2.2","com.capacitorjs:core 7.6.9","@capacitor/android 8.5.1","@capacitor/ios 8.5.1","github.com/ionic-team/capacitor-swift-pm 8.5.1","com.capacitorjs:core 8.5.1","com.capacitorjs:core 8.4.3","@capacitor/android 8.4.3","@capacitor/ios 8.4.3","github.com/ionic-team/capacitor-swift-pm 8.4.3"],"ids":["CVE-2026-103922"],"stack":["npm","java","apple","android"],"first_seen":"2026-10-05T22:53:10Z","updated_at":"2026-10-05T22:53:10Z"},{"id":"ixo-blockchain-x-bonds-did-resolved-payer-drain-x-entity-cve-2026-61604","url":"https://pwned.coffee/i/ixo-blockchain-x-bonds-did-resolved-payer-drain-x-entity-cve-2026-61604","title":"ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass","summary":"Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and…","severity":"critical","patch_status":"partial","status":"live","exploited":false,"affected":"github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more","fixed_versions":["github.com/ixofoundation/ixo-blockchain/v8 8.0.0"],"ids":["CVE-2026-61604"],"stack":["go","chrome"],"first_seen":"2026-09-24T19:22:53Z","updated_at":"2026-09-24T19:22:53Z"},{"id":"plex-media-server-external-control-of-file-name-or-path-vulnerability","url":"https://pwned.coffee/i/plex-media-server-external-control-of-file-name-or-path-vulnerability","title":"Plex Media Server External Control of File Name or Path Vulnerability","summary":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Can be chained with CVE-2026-96655, CVE-2026-96654, CVE-2026-96652. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23).","severity":"high","patch_status":"unpatched","status":"live","exploited":true,"affected":"Plex Media Server","fixed_versions":[],"ids":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656"],"stack":["self-hosted","php"],"first_seen":"2026-10-20T12:00:00.000Z","updated_at":"2026-10-23T08:41:57.011Z"},{"id":"eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931","url":"https://pwned.coffee/i/eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931","title":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","summary":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23).","severity":"high","patch_status":"patched","status":"live","exploited":true,"affected":"EG Secure Solutions SiteGuard Server Edition","fixed_versions":[],"ids":["CVE-2026-106931"],"stack":[],"first_seen":"2026-10-20T12:00:00.000Z","updated_at":"2026-10-20T12:00:00.000Z"},{"id":"siemens-software-center-uncontrolled-search-path-element-cve-2026-110936","url":"https://pwned.coffee/i/siemens-software-center-uncontrolled-search-path-element-cve-2026-110936","title":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","summary":"Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20 (federal deadline 2026-11-03).","severity":"high","patch_status":"patched","status":"live","exploited":true,"affected":"Siemens Software Center","fixed_versions":[],"ids":["CVE-2026-110936"],"stack":[],"first_seen":"2026-10-20T12:00:00.000Z","updated_at":"2026-10-20T12:00:00.000Z"}]}