{"generated_at":"2026-10-24T07:57:57.414Z","count":4,"incidents":[{"id":"eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931","url":"https://pwned.coffee/i/eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931","title":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","summary":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23).","severity":"high","brew":{"name":"Hell brew","temp":"540°C"},"patch_status":"patched","bucket":"fix","kitchen":{"name":"Order up","plain":"Fix available"},"status":"live","exploited":true,"exploitation":"kev","exploitation_label":"Exploited: listed in CISA KEV","public_poc":false,"receipt":[{"kind":"kev","quote":"CVE-2026-106931 added to CISA KEV on 2026-10-20, federal deadline 2026-10-23.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"kev_due":"2026-10-23","do":"Apply the available SiteGuard Server Edition fix now, since this OS command injection is being exploited.","affected":"SiteGuard Server Edition","fixed_versions":["SiteGuard Server Edition for Apache httpd Ver8.00 Update 5","SiteGuard Server Edition for Apache httpd on FreeBSD Ver7.00 Update 6"],"fix_lines":[{"product":"SiteGuard Server Edition for Apache httpd","from":"Ver2.20","fixed":"Ver8.00 Update 5","source":"cna"},{"product":"SiteGuard Server Edition for Apache httpd on FreeBSD","from":"Ver2.20","fixed":"Ver7.00 Update 6","source":"cna"}],"fix_note":null,"cvss":8.5,"published":"2026-10-14T04:45:07.678Z","checked_at":"2026-10-24T07:17:18.460Z","unverified_ids":[],"ids":["CVE-2026-106931"],"aliases":[],"stack":["security-tools"],"first_seen":"2026-10-20T12:00:00.000Z","updated_at":"2026-10-20T12:00:00.000Z"},{"id":"critical-fortisiem-flaw-gets-public-exploit-poc-cve-2026-106173","url":"https://pwned.coffee/i/critical-fortisiem-flaw-gets-public-exploit-poc-cve-2026-106173","title":"Critical FortiSIEM Flaw Gets Public Exploit PoC","summary":"Critical FortiSIEM flaw gets public exploit PoC for unauthenticated remote code execution.","severity":"critical","brew":{"name":"Double espresso","temp":"355°C"},"patch_status":"unknown","bucket":"unknown","kitchen":{"name":"On hold","plain":"Status unknown"},"status":"live","exploited":false,"exploitation":"poc_public","exploitation_label":"Public exploit code, no attacks reported","public_poc":true,"receipt":[],"kev_due":null,"do":"Restrict network access to FortiSIEM now and watch for a vendor fix, since a public exploit exists.","affected":"FortiSIEM","fixed_versions":[],"fix_lines":[],"fix_note":null,"cvss":9.4,"published":"2026-10-13T17:37:09.900Z","checked_at":"2026-10-24T07:17:18.460Z","unverified_ids":[],"ids":["CVE-2026-106173"],"aliases":[],"stack":["security-tools"],"first_seen":"2026-10-20T15:38:52.000Z","updated_at":"2026-10-20T15:38:52.000Z"},{"id":"in-splunk-enterprise-versions-below-10-4-3-and-10-2-7-an-cve-2026-76268","url":"https://pwned.coffee/i/in-splunk-enterprise-versions-below-10-4-3-and-10-2-7-an-cve-2026-76268","title":"Splunk Enterprise: critical vulnerability","summary":"In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands.","severity":"critical","brew":{"name":"Double espresso","temp":"355°C"},"patch_status":"patched","bucket":"fix","kitchen":{"name":"Order up","plain":"Fix available"},"status":"live","exploited":false,"exploitation":"poc_public","exploitation_label":"Public exploit code, no attacks reported","public_poc":true,"receipt":[],"kev_due":null,"do":"Upgrade Splunk Enterprise to 10.4.3 or 10.2.7 matching your current release line now.","affected":"Splunk Enterprise","fixed_versions":["10.4.3","10.2.7"],"fix_lines":[{"product":"Splunk Enterprise","from":"10.4","fixed":"10.4.3","source":"cna"},{"product":"Splunk Enterprise","from":"10.2","fixed":"10.2.7","source":"cna"}],"fix_note":null,"cvss":9.8,"published":"2026-10-07T20:46:31.281Z","checked_at":"2026-10-24T07:17:18.460Z","unverified_ids":[],"ids":["CVE-2026-76268"],"aliases":[],"stack":["security-tools"],"first_seen":"2026-10-23T19:39:42.123Z","updated_at":"2026-10-23T19:39:42.123Z"},{"id":"open-source-snort-3-command-execution-cve-2026-76524","url":"https://pwned.coffee/i/open-source-snort-3-command-execution-cve-2026-76524","title":"Open Source Snort 3 Command Execution","summary":"Authenticated local attacker can execute arbitrary commands as the Snort 3 process user.","severity":"high","brew":{"name":"Americano","temp":"183°C"},"patch_status":"patched","bucket":"fix","kitchen":{"name":"Order up","plain":"Fix available"},"status":"live","exploited":false,"exploitation":"none_known","exploitation_label":"No known exploitation","public_poc":false,"receipt":[{"kind":"fix","quote":"Cisco has released software updates that address this vulnerability.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Open%20Source%20Snort%203%20Control%20Channel%20Socket%20Arbitrary%20Command%20Execution%20Vulnerability%26vs_k=1"}],"kev_due":null,"do":"Apply the available Snort 3 fix and restrict local shell access to Snort 3 hosts.","affected":"Snort 3","fixed_versions":[],"fix_lines":[],"fix_note":"Cisco has released software updates that address this vulnerability.","cvss":7.8,"published":"2026-10-21T16:18:12.052Z","checked_at":"2026-10-24T07:17:18.460Z","unverified_ids":[],"ids":["CVE-2026-76524"],"aliases":[],"stack":["security-tools"],"first_seen":"2026-10-21T16:00:00.000Z","updated_at":"2026-10-21T16:00:00.000Z"}]}