{"generated_at":"2026-10-26T10:52:28.766Z","count":3,"incidents":[{"id":"rocq-soundness-bug-cve-2026-72703","url":"https://pwned.coffee/i/rocq-soundness-bug-cve-2026-72703","title":"Rocq: soundness bug","summary":"Rocq kernel's guard checker allows construction of a checked proof of False, enabling arbitrary propositions.","severity":"medium","brew":{"name":"Decaf","temp":"70°C"},"patch_status":"unpatched","bucket":"nofix","kitchen":{"name":"86'd","plain":"No fix yet"},"order_reason":"the rest, by urgency","status":"live","exploited":false,"exploitation":"poc_public","exploitation_label":"Public exploit code, no attacks reported","public_poc":true,"receipt":[{"kind":"ssvc","quote":"CISA ADP rates exploitation of CVE-2020-37268 \"poc\" (SSVC).","url":"https://www.cve.org/CVERecord?id=CVE-2020-37268"},{"kind":"score","quote":"CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2020-37268","url":"https://www.cve.org/CVERecord?id=CVE-2020-37268"}],"kev_due":null,"do":"Take Rocq proof checking offline or restrict who can submit proof files until the vendor's advisory names a fix, since no fix exists yet.","affected":"Rocq Prover","fixed_versions":[],"fix_lines":[{"product":"Rocq Prover","range":"<= 9.2.0","note":"9.2.0 closes CVE-2026-72703, CVE-2026-72705 only; CVE-2020-37268 needs a fix its CVE record doesn’t name; CVE-2026-72714 needs a fix its CVE record doesn’t name","state":"unknown","unknown_reason":"cna_affected_only","source":"cna","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72703","verified_at":"2026-10-26T01:17:52.793Z","quote":"rocq 8.11 through 9.2.0 affected / rocq 8.20 affected, before 9.2.0 / rocq 0 affected, before 9.2.0 / rocq 0 through 9.2.0 affected"}],"downstream":[],"fix_note":null,"not_affected_products":[],"vendor_notes":[],"related":[],"cvss":6.3,"severity_source":{"label":"CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2020-37268","url":"https://www.cve.org/CVERecord?id=CVE-2020-37268"},"spreading_until":null,"still_cooking":[],"published":"2026-08-24T20:08:33.917Z","checked_at":"2026-10-26T10:17:44.701Z","unverified_ids":[],"ids":["CVE-2020-37268","CVE-2026-72703","CVE-2026-72705","CVE-2026-72714"],"aliases":[],"stack":["proof-tools"],"first_seen":"2026-10-26T00:16:35.000Z","updated_at":"2026-10-26T01:17:24.998Z"},{"id":"rocq-soundness-bug-cve-2026-72704","url":"https://pwned.coffee/i/rocq-soundness-bug-cve-2026-72704","title":"Rocq: soundness bug","summary":"Rocq kernel's guard checker trusts corrupted recursive tree after transport, allowing arbitrary propositions.","severity":"medium","brew":{"name":"Decaf","temp":"70°C"},"patch_status":"unpatched","bucket":"nofix","kitchen":{"name":"86'd","plain":"No fix yet"},"order_reason":"the rest, by urgency","status":"live","exploited":false,"exploitation":"poc_public","exploitation_label":"Public exploit code, no attacks reported","public_poc":true,"receipt":[{"kind":"ssvc","quote":"CISA ADP rates exploitation of CVE-2026-72704 \"poc\" (SSVC).","url":"https://www.cve.org/CVERecord?id=CVE-2026-72704"},{"kind":"score","quote":"CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2026-72704","url":"https://www.cve.org/CVERecord?id=CVE-2026-72704"}],"kev_due":null,"do":"Take Rocq proof checking offline or restrict who can submit proof files until the vendor's advisory names a fix, since no fix exists yet.","affected":"Rocq Prover","fixed_versions":[],"fix_lines":[{"product":"Rocq Prover","range":"<= 9.2.0","note":"fix not named in the CVE record: see vendor advisory","state":"unknown","unknown_reason":"cna_affected_only","source":"cna","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72704","verified_at":"2026-10-26T01:17:52.793Z","quote":"rocq 0 through 9.2.0 affected"}],"downstream":[],"fix_note":null,"not_affected_products":[],"vendor_notes":[],"related":[],"cvss":6.3,"severity_source":{"label":"CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2026-72704","url":"https://www.cve.org/CVERecord?id=CVE-2026-72704"},"spreading_until":null,"still_cooking":[],"published":"2026-08-24T20:08:31.787Z","checked_at":"2026-10-26T10:17:44.701Z","unverified_ids":[],"ids":["CVE-2026-72704"],"aliases":[],"stack":["proof-tools"],"first_seen":"2026-10-26T00:18:21.000Z","updated_at":"2026-10-26T00:18:21.000Z"},{"id":"lean-4-kernel-soundness-bug-cve-2026-72844","url":"https://pwned.coffee/i/lean-4-kernel-soundness-bug-cve-2026-72844","title":"leanprover lean4: vulnerability (public PoC)","summary":"Lean 4 kernel soundness bug allows construction of a checked proof of False without axioms or modified files","severity":"medium","brew":{"name":"Decaf","temp":"70°C"},"patch_status":"partial","bucket":"fix","kitchen":{"name":"Half-poured","plain":"Some lines fixed"},"order_reason":"the rest, by urgency","status":"live","exploited":false,"exploitation":"poc_public","exploitation_label":"Public exploit code, no attacks reported","public_poc":true,"receipt":[{"kind":"ssvc","quote":"CISA ADP rates exploitation of CVE-2026-72711 \"poc\" (SSVC).","url":"https://www.cve.org/CVERecord?id=CVE-2026-72711"},{"kind":"score","quote":"CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2026-72711","url":"https://www.cve.org/CVERecord?id=CVE-2026-72711"}],"kev_due":null,"do":"Upgrade lean4 to 4.32.2 or later, since the kernel soundness bug lets a bogus proof of False pass checking.","affected":"Lean 4","fixed_versions":["4.32.2"],"fix_lines":[{"product":"Lean 4","from":"4.33.0-rc1","range":"= 4.33.0-rc1","note":"fix not named in the CVE record: see vendor advisory","state":"unknown","unknown_reason":"cna_affected_only","source":"cna","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72844","verified_at":"2026-10-26T00:17:32.956Z","quote":"lean4 4.33.0-rc1 affected"},{"product":"Lean 4","fixed":"4.32.2","source":"cna","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72711","verified_at":"2026-10-26T00:17:32.956Z","quote":"lean4 0 affected, before 4.32.2"}],"downstream":[],"fix_note":null,"not_affected_products":[],"vendor_notes":[],"related":[],"cvss":6.3,"severity_source":{"label":"CVSS 3.1 6.3 (CNA VulnCheck) for CVE-2026-72711","url":"https://www.cve.org/CVERecord?id=CVE-2026-72711"},"spreading_until":null,"still_cooking":[],"published":"2026-08-24T20:08:33.219Z","checked_at":"2026-10-26T10:17:44.701Z","unverified_ids":[],"ids":["CVE-2026-72711","CVE-2026-72844"],"aliases":[],"stack":["proof-tools"],"first_seen":"2026-10-26T00:12:48.000Z","updated_at":"2026-10-26T00:17:22.017Z"}]}