{"generated_at":"2026-10-23T14:48:49.197Z","count":7,"incidents":[{"id":"capacitor-android-and-ios-remote-content-can-be-loaded-a-cve-2026-103922","url":"https://pwned.coffee/i/capacitor-android-and-ios-remote-content-can-be-loaded-a-cve-2026-103922","title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","summary":"### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the…","severity":"critical","patch_status":"partial","status":"live","exploited":false,"affected":"@capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven)","fixed_versions":["@capacitor/android 6.2.2","@capacitor/android 7.6.9","@capacitor/ios 6.2.2","@capacitor/ios 7.6.9","github.com/ionic-team/capacitor-swift-pm 6.2.2","github.com/ionic-team/capacitor-swift-pm 7.6.9","com.capacitorjs:core 6.2.2","com.capacitorjs:core 7.6.9","@capacitor/android 8.5.1","@capacitor/ios 8.5.1","github.com/ionic-team/capacitor-swift-pm 8.5.1","com.capacitorjs:core 8.5.1","com.capacitorjs:core 8.4.3","@capacitor/android 8.4.3","@capacitor/ios 8.4.3","github.com/ionic-team/capacitor-swift-pm 8.4.3"],"ids":["CVE-2026-103922"],"stack":["npm","java","apple","android"],"first_seen":"2026-10-05T22:53:10Z","updated_at":"2026-10-05T22:53:10Z"},{"id":"cisco-secure-firewall-management-center-fmc-software-and-cve-2026-20131","url":"https://pwned.coffee/i/cisco-secure-firewall-management-center-fmc-software-and-cve-2026-20131","title":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Added to CISA KEV on 2026-03-19 (federal deadline 2026-03-22).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Secure Firewall Management Center (FMC)","fixed_versions":[],"ids":["CVE-2026-20131"],"stack":["java","vpn-edge"],"first_seen":"2026-03-19T12:00:00.000Z","updated_at":"2026-03-19T12:00:00.000Z"},{"id":"papercut-ng-mf-unsafe-reflection-vulnerability","url":"https://pwned.coffee/i/papercut-ng-mf-unsafe-reflection-vulnerability","title":"PaperCut NG/MF Unsafe Reflection Vulnerability","summary":"PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. Can be chained with CVE-2026-81578. Added to CISA KEV on 2026-08-31 (federal deadline 2026-09-14).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"PaperCut NG/MF","fixed_versions":[],"ids":["CVE-2026-81578","CVE-2026-82078"],"stack":["java"],"first_seen":"2026-08-31T12:00:00.000Z","updated_at":"2026-08-31T12:00:00.000Z"},{"id":"oracle-http-server-and-oracle-weblogic-server-proxy-plug-cve-2026-21962","url":"https://pwned.coffee/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-cve-2026-21962","title":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability","summary":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24 (federal deadline 2026-08-27).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in","fixed_versions":[],"ids":["CVE-2026-21962"],"stack":["java"],"first_seen":"2026-08-24T12:00:00.000Z","updated_at":"2026-08-24T12:00:00.000Z"},{"id":"apache-tomcat-missing-encryption-of-sensitive-data-vulne-cve-2026-34486","url":"https://pwned.coffee/i/apache-tomcat-missing-encryption-of-sensitive-data-vulne-cve-2026-34486","title":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","summary":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04 (federal deadline 2026-08-07).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Apache Tomcat","fixed_versions":[],"ids":["CVE-2026-34486"],"stack":["java"],"first_seen":"2026-08-04T12:00:00.000Z","updated_at":"2026-08-04T12:00:00.000Z"},{"id":"oracle-weblogic-server-unspecified-vulnerability-cve-2024-21182","url":"https://pwned.coffee/i/oracle-weblogic-server-unspecified-vulnerability-cve-2024-21182","title":"Oracle WebLogic Server Unspecified Vulnerability","summary":"Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. Added to CISA KEV on 2026-06-01 (federal deadline 2026-06-04).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Oracle WebLogic Server","fixed_versions":[],"ids":["CVE-2024-21182"],"stack":["java"],"first_seen":"2026-06-01T12:00:00.000Z","updated_at":"2026-06-01T12:00:00.000Z"},{"id":"apache-activemq-improper-input-validation-vulnerability-cve-2026-34197","url":"https://pwned.coffee/i/apache-activemq-improper-input-validation-vulnerability-cve-2026-34197","title":"Apache ActiveMQ Improper Input Validation Vulnerability","summary":"Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16 (federal deadline 2026-04-30).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Apache ActiveMQ","fixed_versions":[],"ids":["CVE-2026-34197"],"stack":["java"],"first_seen":"2026-04-16T12:00:00.000Z","updated_at":"2026-04-16T12:00:00.000Z"}]}