{"generated_at":"2026-10-23T14:58:41.118Z","count":11,"incidents":[{"id":"flowise-nodevm-sandbox-escape-via-puppeteer-allowlist-au-cve-2026-73483","url":"https://pwned.coffee/i/flowise-nodevm-sandbox-escape-via-puppeteer-allowlist-au-cve-2026-73483","title":"Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium","summary":"Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which…","severity":"critical","patch_status":"patched","status":"past","exploited":false,"affected":"flowise (npm), flowise-components (npm)","fixed_versions":["flowise 3.1.3","flowise-components 3.1.3"],"ids":["CVE-2026-73483"],"stack":["npm","chrome"],"first_seen":"2026-10-07T16:17:02Z","updated_at":"2026-10-07T16:17:02Z"},{"id":"ixo-blockchain-x-bonds-did-resolved-payer-drain-x-entity-cve-2026-61604","url":"https://pwned.coffee/i/ixo-blockchain-x-bonds-did-resolved-payer-drain-x-entity-cve-2026-61604","title":"ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass","summary":"Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and…","severity":"critical","patch_status":"partial","status":"live","exploited":false,"affected":"github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more","fixed_versions":["github.com/ixofoundation/ixo-blockchain/v8 8.0.0"],"ids":["CVE-2026-61604"],"stack":["go","chrome"],"first_seen":"2026-09-24T19:22:53Z","updated_at":"2026-09-24T19:22:53Z"},{"id":"google-chromium-v8-out-of-bounds-write-vulnerability-cve-2026-87491","url":"https://pwned.coffee/i/google-chromium-v8-out-of-bounds-write-vulnerability-cve-2026-87491","title":"Google Chromium V8 Out of Bounds Write Vulnerability","summary":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-09-09 (federal deadline 2026-09-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Chromium V8","fixed_versions":[],"ids":["CVE-2026-87491"],"stack":["chrome"],"first_seen":"2026-09-09T12:00:00.000Z","updated_at":"2026-09-09T12:00:00.000Z"},{"id":"google-chromium-v8-type-confusion-vulnerability-cve-2026-85046","url":"https://pwned.coffee/i/google-chromium-v8-type-confusion-vulnerability-cve-2026-85046","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-09-04 (federal deadline 2026-09-18).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Chromium V8","fixed_versions":[],"ids":["CVE-2026-85046"],"stack":["chrome"],"first_seen":"2026-09-04T12:00:00.000Z","updated_at":"2026-09-04T12:00:00.000Z"},{"id":"google-chromium-v8-out-of-bounds-read-and-write-vulnerab-cve-2026-11645","url":"https://pwned.coffee/i/google-chromium-v8-out-of-bounds-read-and-write-vulnerab-cve-2026-11645","title":"Google Chromium V8 Out-of-Bounds Read and Write Vulnerability","summary":"Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-06-09 (federal deadline 2026-06-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Chromium V8","fixed_versions":[],"ids":["CVE-2026-11645"],"stack":["chrome"],"first_seen":"2026-06-09T12:00:00.000Z","updated_at":"2026-06-09T12:00:00.000Z"},{"id":"google-dawn-use-after-free-vulnerability-cve-2026-5281","url":"https://pwned.coffee/i/google-dawn-use-after-free-vulnerability-cve-2026-5281","title":"Google Dawn Use-After-Free Vulnerability","summary":"Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-04-01 (federal deadline 2026-04-15).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Dawn","fixed_versions":[],"ids":["CVE-2026-5281"],"stack":["chrome"],"first_seen":"2026-04-01T12:00:00.000Z","updated_at":"2026-04-01T12:00:00.000Z"},{"id":"google-chromium-v8-improper-restriction-of-operations-wi-cve-2026-3910","url":"https://pwned.coffee/i/google-chromium-v8-improper-restriction-of-operations-wi-cve-2026-3910","title":"Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability","summary":"Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-03-13 (federal deadline 2026-03-27).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Chromium V8","fixed_versions":[],"ids":["CVE-2026-3910"],"stack":["chrome"],"first_seen":"2026-03-13T12:00:00.000Z","updated_at":"2026-03-13T12:00:00.000Z"},{"id":"google-skia-out-of-bounds-write-vulnerability-cve-2026-3909","url":"https://pwned.coffee/i/google-skia-out-of-bounds-write-vulnerability-cve-2026-3909","title":"Google Skia Out-of-Bounds Write Vulnerability","summary":"Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2026-03-13 (federal deadline 2026-03-27).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Skia","fixed_versions":[],"ids":["CVE-2026-3909"],"stack":["chrome","android"],"first_seen":"2026-03-13T12:00:00.000Z","updated_at":"2026-03-13T12:00:00.000Z"},{"id":"google-chromium-css-use-after-free-vulnerability-cve-2026-2441","url":"https://pwned.coffee/i/google-chromium-css-use-after-free-vulnerability-cve-2026-2441","title":"Google Chromium CSS Use-After-Free Vulnerability","summary":"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-02-17 (federal deadline 2026-03-10).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Chromium","fixed_versions":[],"ids":["CVE-2026-2441"],"stack":["chrome"],"first_seen":"2026-02-17T12:00:00.000Z","updated_at":"2026-02-17T12:00:00.000Z"},{"id":"google-chromium-out-of-bounds-memory-access-vulnerabilit-cve-2025-14174","url":"https://pwned.coffee/i/google-chromium-out-of-bounds-memory-access-vulnerabilit-cve-2025-14174","title":"Google Chromium Out of Bounds Memory Access Vulnerability","summary":"Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-12-12 (federal deadline 2026-01-02).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Chromium","fixed_versions":[],"ids":["CVE-2025-14174"],"stack":["chrome"],"first_seen":"2025-12-12T12:00:00.000Z","updated_at":"2025-12-12T12:00:00.000Z"},{"id":"google-chromium-v8-type-confusion-vulnerability-cve-2025-13223","url":"https://pwned.coffee/i/google-chromium-v8-type-confusion-vulnerability-cve-2025-13223","title":"Google Chromium V8 Type Confusion Vulnerability","summary":"Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. Added to CISA KEV on 2025-11-19 (federal deadline 2025-12-10).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Google Chromium V8","fixed_versions":[],"ids":["CVE-2025-13223"],"stack":["chrome"],"first_seen":"2025-11-19T12:00:00.000Z","updated_at":"2025-11-19T12:00:00.000Z"}]}