{"generated_at":"2026-10-23T14:53:35.684Z","count":9,"incidents":[{"id":"friendsofflarum-oauth-unauthenticated-account-takeover-v-cve-2026-92161","url":"https://pwned.coffee/i/friendsofflarum-oauth-unauthenticated-account-takeover-v-cve-2026-92161","title":"FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider","summary":"### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `\"verified\": false`. Affected versions of `fof/oauth`…","severity":"critical","patch_status":"patched","status":"past","exploited":false,"affected":"fof/oauth (composer)","fixed_versions":["fof/oauth 1.7.4","fof/oauth 2.0.0-beta.4"],"ids":["CVE-2026-92161"],"stack":["php","messaging"],"first_seen":"2026-09-25T15:55:07Z","updated_at":"2026-09-25T15:55:07Z"},{"id":"plex-media-server-external-control-of-file-name-or-path-vulnerability","url":"https://pwned.coffee/i/plex-media-server-external-control-of-file-name-or-path-vulnerability","title":"Plex Media Server External Control of File Name or Path Vulnerability","summary":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Can be chained with CVE-2026-96655, CVE-2026-96654, CVE-2026-96652. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23).","severity":"high","patch_status":"unpatched","status":"live","exploited":true,"affected":"Plex Media Server","fixed_versions":[],"ids":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656"],"stack":["self-hosted","php"],"first_seen":"2026-10-20T12:00:00.000Z","updated_at":"2026-10-23T08:41:57.011Z"},{"id":"wordpress-core-remote-file-inclusion-vulnerability-cve-2026-87902","url":"https://pwned.coffee/i/wordpress-core-remote-file-inclusion-vulnerability-cve-2026-87902","title":"WordPress Core Remote File Inclusion Vulnerability","summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"WordPress Core","fixed_versions":[],"ids":["CVE-2026-87902"],"stack":["php","wordpress"],"first_seen":"2026-09-25T12:00:00.000Z","updated_at":"2026-09-25T12:00:00.000Z"},{"id":"icagenda-unrestricted-upload-of-file-with-dangerous-type-cve-2026-48939","url":"https://pwned.coffee/i/icagenda-unrestricted-upload-of-file-with-dangerous-type-cve-2026-48939","title":"iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. Added to CISA KEV on 2026-07-10 (federal deadline 2026-07-13).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"iCagenda iCagenda","fixed_versions":[],"ids":["CVE-2026-48939"],"stack":["php"],"first_seen":"2026-07-10T12:00:00.000Z","updated_at":"2026-07-10T12:00:00.000Z"},{"id":"joomshaper-sp-page-builder-unrestricted-upload-of-file-w-cve-2026-48908","url":"https://pwned.coffee/i/joomshaper-sp-page-builder-unrestricted-upload-of-file-w-cve-2026-48908","title":"JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability","summary":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. Added to CISA KEV on 2026-07-07 (federal deadline 2026-07-10).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"JoomShaper SP Page Builder","fixed_versions":[],"ids":["CVE-2026-48908"],"stack":["php"],"first_seen":"2026-07-07T12:00:00.000Z","updated_at":"2026-07-07T12:00:00.000Z"},{"id":"widget-factory-joomla-content-editor-improper-access-con-cve-2026-48907","url":"https://pwned.coffee/i/widget-factory-joomla-content-editor-improper-access-con-cve-2026-48907","title":"Widget Factory Joomla Content Editor Improper Access Control Vulnerability","summary":"Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. Added to CISA KEV on 2026-06-16 (federal deadline 2026-06-19).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Widget Factory Joomla Content Editor","fixed_versions":[],"ids":["CVE-2026-48907"],"stack":["php","drupal"],"first_seen":"2026-06-16T12:00:00.000Z","updated_at":"2026-06-16T12:00:00.000Z"},{"id":"mirasvit-full-page-cache-warmer-deserialization-of-untru-cve-2026-45247","url":"https://pwned.coffee/i/mirasvit-full-page-cache-warmer-deserialization-of-untru-cve-2026-45247","title":"Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability","summary":"Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Added to CISA KEV on 2026-06-03 (federal deadline 2026-06-06).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Mirasvit Mirasvit Full Page Cache Warmer","fixed_versions":[],"ids":["CVE-2026-45247"],"stack":["php"],"first_seen":"2026-06-03T12:00:00.000Z","updated_at":"2026-06-03T12:00:00.000Z"},{"id":"roundcube-webmail-deserialization-of-untrusted-data-vulnerability","url":"https://pwned.coffee/i/roundcube-webmail-deserialization-of-untrusted-data-vulnerability","title":"RoundCube Webmail Deserialization of Untrusted Data Vulnerability","summary":"RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. Can be chained with CVE-2025-68461. Added to CISA KEV on 2026-02-20 (federal deadline 2026-03-13).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Roundcube Webmail","fixed_versions":[],"ids":["CVE-2025-49113","CVE-2025-68461"],"stack":["php","erp"],"first_seen":"2026-02-20T12:00:00.000Z","updated_at":"2026-02-20T12:00:00.000Z"},{"id":"synacor-zimbra-collaboration-suite-zcs-php-remote-file-i-cve-2025-68645","url":"https://pwned.coffee/i/synacor-zimbra-collaboration-suite-zcs-php-remote-file-i-cve-2025-68645","title":"Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability","summary":"Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Synacor Zimbra Collaboration Suite (ZCS)","fixed_versions":[],"ids":["CVE-2025-68645"],"stack":["php","erp"],"first_seen":"2026-01-22T12:00:00.000Z","updated_at":"2026-01-22T12:00:00.000Z"}]}