{"generated_at":"2026-10-24T12:33:23.730Z","count":3,"incidents":[{"id":"proftpd-improper-access-control-vulnerability-cve-2015-3306","url":"https://pwned.coffee/i/proftpd-improper-access-control-vulnerability-cve-2015-3306","title":"ProFTPD Improper Access Control Vulnerability","summary":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11).","severity":"critical","brew":{"name":"Hell brew","temp":"540°C"},"patch_status":"unknown","bucket":"unknown","kitchen":{"name":"On hold","plain":"Status unknown"},"status":"live","exploited":true,"exploitation":"kev","exploitation_label":"Exploited: listed in CISA KEV","public_poc":false,"receipt":[{"kind":"poc","quote":"Exploit database entry: https://www.exploit-db.com/exploits/36803/","url":"https://www.exploit-db.com/exploits/36803/"},{"kind":"poc","quote":"Exploit database entry: http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html","url":"http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html"},{"kind":"poc","quote":"Exploit database entry: http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html","url":"http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html"},{"kind":"poc","quote":"Exploit database entry: http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html","url":"http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html"},{"kind":"poc","quote":"Exploit database entry: https://www.exploit-db.com/exploits/36742/","url":"https://www.exploit-db.com/exploits/36742/"},{"kind":"poc","quote":"Exploit database entry: http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html","url":"http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html"},{"kind":"poc","quote":"Exploit database entry: http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html","url":"http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html"},{"kind":"kev","quote":"CVE-2015-3306 added to CISA KEV on 2026-10-08, federal deadline 2026-10-11.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"kind":"score","quote":"CVSS 3.1 10 (CISA ADP) for CVE-2015-3306","url":"https://www.cve.org/CVERecord?id=CVE-2015-3306"}],"kev_due":"2026-10-11","do":"Restrict access to the ProFTPD SITE CPFR and SITE CPTO commands and watch for a vendor fix.","affected":"ProFTPD","fixed_versions":[],"fix_lines":[],"fix_note":null,"cvss":10,"severity_source":{"label":"CVSS 3.1 10 (CISA ADP) for CVE-2015-3306","url":"https://www.cve.org/CVERecord?id=CVE-2015-3306"},"spreading_until":null,"still_cooking":[],"published":"2015-05-18T15:00:00.000Z","checked_at":"2026-10-24T12:17:42.873Z","unverified_ids":[],"ids":["CVE-2015-3306"],"aliases":[],"stack":["linux-services"],"first_seen":"2026-10-08T12:00:00.000Z","updated_at":"2026-10-08T12:00:00.000Z"},{"id":"isc-bind-data-processing-errors-vulnerability-cve-2015-5477","url":"https://pwned.coffee/i/isc-bind-data-processing-errors-vulnerability-cve-2015-5477","title":"ISC BIND Data Processing Errors Vulnerability","summary":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11).","severity":"high","brew":{"name":"Hell brew","temp":"540°C"},"patch_status":"patched","bucket":"fix","kitchen":{"name":"Order up","plain":"Fix available"},"status":"live","exploited":true,"exploitation":"kev","exploitation_label":"Exploited: listed in CISA KEV","public_poc":false,"receipt":[{"kind":"poc","quote":"Exploit database entry: http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html","url":"http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html"},{"kind":"kev","quote":"CVE-2015-5477 added to CISA KEV on 2026-10-08, federal deadline 2026-10-11.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"kind":"score","quote":"CVSS 3.1 7.5 (CISA ADP) for CVE-2015-5477","url":"https://www.cve.org/CVERecord?id=CVE-2015-5477"}],"kev_due":"2026-10-11","do":"Apply the available ISC BIND fix now, as TKEY-query denial-of-service attacks are being exploited.","affected":"ISC BIND","fixed_versions":["juniper junos 12.1","juniper junos 13.2","hpe vcx 9.8.18","isc bind 9.9.7","isc bind 9.10.2"],"fix_lines":[{"product":"juniper junos","fixed":"12.1","source":"nvd"},{"product":"juniper junos","from":"13.1","fixed":"13.2","source":"nvd"},{"product":"hpe vcx","fixed":"9.8.18","source":"nvd"},{"product":"isc bind","from":"9.1.0","fixed":"9.9.7","source":"nvd"},{"product":"isc bind","from":"9.10.0","fixed":"9.10.2","source":"nvd"}],"fix_note":null,"cvss":7.5,"severity_source":{"label":"CVSS 3.1 7.5 (CISA ADP) for CVE-2015-5477","url":"https://www.cve.org/CVERecord?id=CVE-2015-5477"},"spreading_until":null,"still_cooking":[],"published":"2015-07-29T14:00:00.000Z","checked_at":"2026-10-24T12:17:42.873Z","unverified_ids":[],"ids":["CVE-2015-5477"],"aliases":[],"stack":["linux-services"],"first_seen":"2026-10-08T12:00:00.000Z","updated_at":"2026-10-08T12:00:00.000Z"},{"id":"jxrlib-heap-buffer-overflow","url":"https://pwned.coffee/i/jxrlib-heap-buffer-overflow","title":"jxrlib: heap buffer overflow","summary":"jxrlib has memory bugs, including a heap buffer overflow, triggered by damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4","severity":"unknown","brew":{"name":"House blend","temp":"?"},"patch_status":"partial","bucket":"fix","kitchen":{"name":"Order up","plain":"Fix available"},"status":"live","exploited":false,"exploitation":"none_known","exploitation_label":"No known exploitation","public_poc":false,"receipt":[],"kev_due":null,"do":"Upgrade jxrlib to mircomir/jxrlib 1.4.4 and avoid opening untrusted JPEG XR files until then.","affected":"jxrlib","fixed_versions":["mircomir/jxrlib 1.4.4"],"fix_lines":[{"product":"mircomir/jxrlib","fixed":"1.4.4","source":"news"}],"fix_note":null,"cvss":null,"severity_source":null,"spreading_until":null,"still_cooking":[],"published":null,"checked_at":"2026-10-24T12:17:42.873Z","unverified_ids":[],"ids":[],"aliases":[],"stack":["linux-services"],"first_seen":"2026-10-24T09:22:02.000Z","updated_at":"2026-10-24T09:22:02.000Z"}]}