{"generated_at":"2026-10-23T13:24:11.131Z","count":57,"incidents":[{"id":"cisco-secure-email-gateway-relative-path-traversal-vulne-cve-2026-76519","url":"https://pwned.coffee/i/cisco-secure-email-gateway-relative-path-traversal-vulne-cve-2026-76519","title":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","summary":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14 (federal deadline 2026-10-17).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Secure Email Gateway","fixed_versions":[],"ids":["CVE-2026-76519"],"stack":["vpn-edge"],"first_seen":"2026-10-14T12:00:00.000Z","updated_at":"2026-10-14T12:00:00.000Z"},{"id":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286","url":"https://pwned.coffee/i/fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286","title":"Fortinet FortiMail Path Traversal Vulnerability","summary":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Added to CISA KEV on 2026-10-01 (federal deadline 2026-10-04).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet FortiMail","fixed_versions":[],"ids":["CVE-2026-104286"],"stack":["vpn-edge"],"first_seen":"2026-10-01T12:00:00.000Z","updated_at":"2026-10-01T12:00:00.000Z"},{"id":"cisco-secure-firewall-management-center-use-of-hard-code-cve-2026-20316","url":"https://pwned.coffee/i/cisco-secure-firewall-management-center-use-of-hard-code-cve-2026-20316","title":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","summary":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. Added to CISA KEV on 2026-07-29 (federal deadline 2026-08-01).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Secure Firewall Management Center (FMC)","fixed_versions":[],"ids":["CVE-2026-20316"],"stack":["vpn-edge"],"first_seen":"2026-07-29T12:00:00.000Z","updated_at":"2026-07-29T12:00:00.000Z"},{"id":"sonicwall-sma1000-appliances-server-side-request-forgery-vulnerability-2","url":"https://pwned.coffee/i/sonicwall-sma1000-appliances-server-side-request-forgery-vulnerability-2","title":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","summary":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. Can be chained with CVE-2026-15410. Added to CISA KEV on 2026-07-14 (federal deadline 2026-07-17).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"SonicWall SMA1000 Appliances","fixed_versions":[],"ids":["CVE-2026-15409","CVE-2026-15410"],"stack":["vpn-edge"],"first_seen":"2026-07-14T12:00:00.000Z","updated_at":"2026-07-14T12:00:00.000Z"},{"id":"check-point-security-gateway-improper-authentication-vul-cve-2026-50751","url":"https://pwned.coffee/i/check-point-security-gateway-improper-authentication-vul-cve-2026-50751","title":"Check Point Security Gateway Improper Authentication Vulnerability","summary":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Added to CISA KEV on 2026-06-08 (federal deadline 2026-06-11).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Check Point Security Gateway","fixed_versions":[],"ids":["CVE-2026-50751"],"stack":["office","vpn-edge"],"first_seen":"2026-06-08T12:00:00.000Z","updated_at":"2026-06-08T12:00:00.000Z"},{"id":"palo-alto-networks-pan-os-authentication-bypass-vulnerab-cve-2026-0257","url":"https://pwned.coffee/i/palo-alto-networks-pan-os-authentication-bypass-vulnerab-cve-2026-0257","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. Added to CISA KEV on 2026-05-29 (federal deadline 2026-06-01).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Palo Alto Networks PAN-OS","fixed_versions":[],"ids":["CVE-2026-0257"],"stack":["vpn-edge"],"first_seen":"2026-05-29T12:00:00.000Z","updated_at":"2026-05-29T12:00:00.000Z"},{"id":"cisco-secure-firewall-management-center-fmc-software-and-cve-2026-20131","url":"https://pwned.coffee/i/cisco-secure-firewall-management-center-fmc-software-and-cve-2026-20131","title":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Added to CISA KEV on 2026-03-19 (federal deadline 2026-03-22).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Secure Firewall Management Center (FMC)","fixed_versions":[],"ids":["CVE-2026-20131"],"stack":["java","vpn-edge"],"first_seen":"2026-03-19T12:00:00.000Z","updated_at":"2026-03-19T12:00:00.000Z"},{"id":"fortinet-multiple-products-path-traversal-vulnerability-cve-2025-61624","url":"https://pwned.coffee/i/fortinet-multiple-products-path-traversal-vulnerability-cve-2025-61624","title":"Fortinet Multiple Products Path Traversal Vulnerability","summary":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16 (federal deadline 2026-10-19).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet Multiple Products","fixed_versions":[],"ids":["CVE-2025-61624"],"stack":["vpn-edge"],"first_seen":"2026-10-16T12:00:00.000Z","updated_at":"2026-10-16T12:00:00.000Z"},{"id":"palo-alto-networks-pan-os-code-injection-vulnerability-cve-2026-0322","url":"https://pwned.coffee/i/palo-alto-networks-pan-os-code-injection-vulnerability-cve-2026-0322","title":"Palo Alto Networks PAN-OS Code Injection Vulnerability","summary":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14 (federal deadline 2026-10-17).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Palo Alto Networks PAN-OS","fixed_versions":[],"ids":["CVE-2026-0322"],"stack":["vpn-edge"],"first_seen":"2026-10-14T12:00:00.000Z","updated_at":"2026-10-14T12:00:00.000Z"},{"id":"ivanti-connect-secure-authentication-bypass-by-spoofing-cve-2026-104935","url":"https://pwned.coffee/i/ivanti-connect-secure-authentication-bypass-by-spoofing-cve-2026-104935","title":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","summary":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Added to CISA KEV on 2026-10-13 (federal deadline 2026-10-16).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Ivanti Connect Secure","fixed_versions":[],"ids":["CVE-2026-104935"],"stack":["vpn-edge"],"first_seen":"2026-10-13T12:00:00.000Z","updated_at":"2026-10-13T12:00:00.000Z"},{"id":"citrix-netscaler-improper-restriction-of-operations-with-cve-2026-88779","url":"https://pwned.coffee/i/citrix-netscaler-improper-restriction-of-operations-with-cve-2026-88779","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Added to CISA KEV on 2026-10-04 (federal deadline 2026-10-07).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Citrix NetScaler","fixed_versions":[],"ids":["CVE-2026-88779"],"stack":["vpn-edge"],"first_seen":"2026-10-04T12:00:00.000Z","updated_at":"2026-10-04T12:00:00.000Z"},{"id":"cisco-catalyst-sd-wan-manager-hex-encoding-vulnerability-cve-2026-76504","url":"https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-hex-encoding-vulnerability-cve-2026-76504","title":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30 (federal deadline 2026-10-03).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Catalyst SD-WAN Manager","fixed_versions":[],"ids":["CVE-2026-76504"],"stack":["vpn-edge"],"first_seen":"2026-09-30T12:00:00.000Z","updated_at":"2026-09-30T12:00:00.000Z"},{"id":"citrix-netscaler-improper-restriction-of-operations-within-the-bounds-of","url":"https://pwned.coffee/i/citrix-netscaler-improper-restriction-of-operations-within-the-bounds-of","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service Can be chained with CVE-2026-88771. Added to CISA KEV on 2026-09-27 (federal deadline 2026-09-30).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Citrix NetScaler","fixed_versions":[],"ids":["CVE-2026-88771","CVE-2026-88772"],"stack":["vpn-edge"],"first_seen":"2026-09-27T12:00:00.000Z","updated_at":"2026-09-27T12:00:00.000Z"},{"id":"mikrotik-routeros-improper-enforcement-of-behavioral-wor-cve-2026-67279","url":"https://pwned.coffee/i/mikrotik-routeros-improper-enforcement-of-behavioral-wor-cve-2026-67279","title":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","summary":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"MikroTik RouterOS","fixed_versions":[],"ids":["CVE-2026-67279"],"stack":["vpn-edge"],"first_seen":"2026-09-25T12:00:00.000Z","updated_at":"2026-09-25T12:00:00.000Z"},{"id":"arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952","url":"https://pwned.coffee/i/arista-velocloud-orchestrator-improper-input-validation-cve-2026-93952","title":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","summary":"Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Added to CISA KEV on 2026-09-22 (federal deadline 2026-09-25).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Arista VeloCloud Orchestrator","fixed_versions":[],"ids":["CVE-2026-93952"],"stack":["vpn-edge"],"first_seen":"2026-09-22T12:00:00.000Z","updated_at":"2026-09-22T12:00:00.000Z"},{"id":"f5-big-ip-apm-heap-based-buffer-overflow-vulnerability-cve-2026-94127","url":"https://pwned.coffee/i/f5-big-ip-apm-heap-based-buffer-overflow-vulnerability-cve-2026-94127","title":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","summary":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. Added to CISA KEV on 2026-09-22 (federal deadline 2026-09-25).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"F5 BIG-IP APM","fixed_versions":[],"ids":["CVE-2026-94127"],"stack":["vpn-edge"],"first_seen":"2026-09-22T12:00:00.000Z","updated_at":"2026-09-22T12:00:00.000Z"},{"id":"check-point-multiple-products-path-traversal-vulnerability","url":"https://pwned.coffee/i/check-point-multiple-products-path-traversal-vulnerability","title":"Check Point Multiple Products Path Traversal Vulnerability","summary":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. Can be chained with CVE-2026-85102. Added to CISA KEV on 2026-09-22 (federal deadline 2026-09-25).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Check Point Multiple Products","fixed_versions":[],"ids":["CVE-2026-85102","CVE-2026-93616"],"stack":["vpn-edge"],"first_seen":"2026-09-22T12:00:00.000Z","updated_at":"2026-09-22T12:00:00.000Z"},{"id":"cisco-identity-services-engine-incorrect-use-of-privileg-cve-2026-76460","url":"https://pwned.coffee/i/cisco-identity-services-engine-incorrect-use-of-privileg-cve-2026-76460","title":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","summary":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Identity Services Engine","fixed_versions":[],"ids":["CVE-2026-76460"],"stack":["vpn-edge"],"first_seen":"2026-09-16T12:00:00.000Z","updated_at":"2026-09-16T12:00:00.000Z"},{"id":"cisco-secure-email-gateway-sql-injection-vulnerability-cve-2026-76461","url":"https://pwned.coffee/i/cisco-secure-email-gateway-sql-injection-vulnerability-cve-2026-76461","title":"Cisco Secure Email Gateway SQL Injection Vulnerability","summary":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14 (federal deadline 2026-09-17).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Secure Email Gateway","fixed_versions":[],"ids":["CVE-2026-76461"],"stack":["vpn-edge"],"first_seen":"2026-09-14T12:00:00.000Z","updated_at":"2026-09-14T12:00:00.000Z"},{"id":"mikrotik-routeros-improper-neutralization-of-argument-delimiters-in-a-co","url":"https://pwned.coffee/i/mikrotik-routeros-improper-neutralization-of-argument-delimiters-in-a-co","title":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","summary":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. Can be chained with CVE-2026-67277. Added to CISA KEV on 2026-09-10 (federal deadline 2026-09-13).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"MikroTik RouterOS","fixed_versions":[],"ids":["CVE-2026-67277","CVE-2026-86060"],"stack":["vpn-edge"],"first_seen":"2026-09-10T12:00:00.000Z","updated_at":"2026-09-10T12:00:00.000Z"},{"id":"citrix-netscaler-authentication-bypass-using-an-alternat-cve-2026-19490","url":"https://pwned.coffee/i/citrix-netscaler-authentication-bypass-using-an-alternat-cve-2026-19490","title":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Added to CISA KEV on 2026-09-09 (federal deadline 2026-09-12).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Citrix NetScaler","fixed_versions":[],"ids":["CVE-2026-19490"],"stack":["vpn-edge"],"first_seen":"2026-09-09T12:00:00.000Z","updated_at":"2026-09-09T12:00:00.000Z"},{"id":"fortinet-multiple-products-heap-based-buffer-overflow-vu-cve-2025-25249","url":"https://pwned.coffee/i/fortinet-multiple-products-heap-based-buffer-overflow-vu-cve-2025-25249","title":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","summary":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Added to CISA KEV on 2026-09-09 (federal deadline 2026-09-12).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet Multiple Products","fixed_versions":[],"ids":["CVE-2025-25249"],"stack":["vpn-edge"],"first_seen":"2026-09-09T12:00:00.000Z","updated_at":"2026-09-09T12:00:00.000Z"},{"id":"cisco-firewall-management-center-authentication-bypass-u-cve-2026-20079","url":"https://pwned.coffee/i/cisco-firewall-management-center-authentication-bypass-u-cve-2026-20079","title":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09 (federal deadline 2026-09-12).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","fixed_versions":[],"ids":["CVE-2026-20079"],"stack":["vpn-edge"],"first_seen":"2026-09-09T12:00:00.000Z","updated_at":"2026-09-09T12:00:00.000Z"},{"id":"sonicwall-sma1000-appliances-server-side-request-forgery-vulnerability","url":"https://pwned.coffee/i/sonicwall-sma1000-appliances-server-side-request-forgery-vulnerability","title":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","summary":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. Can be chained with CVE-2026-83549. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-05).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"SonicWall SMA1000 Appliances","fixed_versions":[],"ids":["CVE-2026-83548","CVE-2026-83549"],"stack":["vpn-edge"],"first_seen":"2026-09-02T12:00:00.000Z","updated_at":"2026-09-02T12:00:00.000Z"},{"id":"citrix-netscaler-adc-and-netscaler-gateway-improper-rest-cve-2026-8452","url":"https://pwned.coffee/i/citrix-netscaler-adc-and-netscaler-gateway-improper-rest-cve-2026-8452","title":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. Added to CISA KEV on 2026-08-26 (federal deadline 2026-08-29).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Citrix NetScaler ADC and NetScaler Gateway","fixed_versions":[],"ids":["CVE-2026-8452"],"stack":["vpn-edge"],"first_seen":"2026-08-26T12:00:00.000Z","updated_at":"2026-08-26T12:00:00.000Z"},{"id":"cisco-secure-firewall-adaptive-security-appliance-asa-an-cve-2026-20349","url":"https://pwned.coffee/i/cisco-secure-firewall-adaptive-security-appliance-asa-an-cve-2026-20349","title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability","summary":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Added to CISA KEV on 2026-08-11 (federal deadline 2026-08-14).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)","fixed_versions":[],"ids":["CVE-2026-20349"],"stack":["vpn-edge"],"first_seen":"2026-08-11T12:00:00.000Z","updated_at":"2026-08-11T12:00:00.000Z"},{"id":"fortinet-fortios-exposure-of-sensitive-information-to-an-cve-2025-68686","url":"https://pwned.coffee/i/fortinet-fortios-exposure-of-sensitive-information-to-an-cve-2025-68686","title":"Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","summary":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. Added to CISA KEV on 2026-07-27 (federal deadline 2026-08-10).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet FortiOS","fixed_versions":[],"ids":["CVE-2025-68686"],"stack":["vpn-edge"],"first_seen":"2026-07-27T12:00:00.000Z","updated_at":"2026-07-27T12:00:00.000Z"},{"id":"arista-velocloud-orchestrator-on-prem-os-command-injecti-cve-2026-16812","url":"https://pwned.coffee/i/arista-velocloud-orchestrator-on-prem-os-command-injecti-cve-2026-16812","title":"Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability","summary":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Added to CISA KEV on 2026-07-27 (federal deadline 2026-07-30).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Arista VeloCloud Orchestrator","fixed_versions":[],"ids":["CVE-2026-16812"],"stack":["vpn-edge"],"first_seen":"2026-07-27T12:00:00.000Z","updated_at":"2026-07-27T12:00:00.000Z"},{"id":"check-point-smartconsole-improper-authentication-vulnera-cve-2026-16232","url":"https://pwned.coffee/i/check-point-smartconsole-improper-authentication-vulnera-cve-2026-16232","title":"Check Point SmartConsole Improper Authentication Vulnerability","summary":"Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Added to CISA KEV on 2026-07-22 (federal deadline 2026-07-25).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Check Point SmartConsole","fixed_versions":[],"ids":["CVE-2026-16232"],"stack":["vpn-edge"],"first_seen":"2026-07-22T12:00:00.000Z","updated_at":"2026-07-22T12:00:00.000Z"},{"id":"fortinet-fortisandbox-os-command-injection-vulnerability","url":"https://pwned.coffee/i/fortinet-fortisandbox-os-command-injection-vulnerability","title":"Fortinet FortiSandbox OS Command Injection Vulnerability","summary":"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Can be chained with CVE-2026-39808. Added to CISA KEV on 2026-07-16 (federal deadline 2026-07-19).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet FortiSandbox","fixed_versions":[],"ids":["CVE-2026-25089","CVE-2026-39808"],"stack":["vpn-edge"],"first_seen":"2026-07-16T12:00:00.000Z","updated_at":"2026-07-16T12:00:00.000Z"},{"id":"cisco-ios-cross-site-request-forgery-vulnerability-cve-2008-4128","url":"https://pwned.coffee/i/cisco-ios-cross-site-request-forgery-vulnerability-cve-2008-4128","title":"Cisco IOS Cross-Site Request Forgery Vulnerability","summary":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI. Added to CISA KEV on 2026-07-13 (federal deadline 2026-07-16).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco IOS","fixed_versions":[],"ids":["CVE-2008-4128"],"stack":["apple","vpn-edge"],"first_seen":"2026-07-13T12:00:00.000Z","updated_at":"2026-07-13T12:00:00.000Z"},{"id":"cisco-unified-communications-manager-server-side-request-cve-2026-20230","url":"https://pwned.coffee/i/cisco-unified-communications-manager-server-side-request-cve-2026-20230","title":"Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability","summary":"Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. Added to CISA KEV on 2026-06-25 (federal deadline 2026-06-28).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Unified Communications Manager","fixed_versions":[],"ids":["CVE-2026-20230"],"stack":["vpn-edge"],"first_seen":"2026-06-25T12:00:00.000Z","updated_at":"2026-06-25T12:00:00.000Z"},{"id":"cisco-catalyst-sd-wan-manager-directory-or-path-traversa-cve-2026-20262","url":"https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-directory-or-path-traversa-cve-2026-20262","title":"Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. Added to CISA KEV on 2026-06-15 (federal deadline 2026-06-29).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Catalyst SD-WAN Manager","fixed_versions":[],"ids":["CVE-2026-20262"],"stack":["vpn-edge"],"first_seen":"2026-06-15T12:00:00.000Z","updated_at":"2026-06-15T12:00:00.000Z"},{"id":"ivanti-sentry-os-command-injection-vulnerability-cve-2026-10520","url":"https://pwned.coffee/i/ivanti-sentry-os-command-injection-vulnerability-cve-2026-10520","title":"Ivanti Sentry OS Command Injection Vulnerability","summary":"Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. Added to CISA KEV on 2026-06-11 (federal deadline 2026-06-14).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Ivanti Sentry","fixed_versions":[],"ids":["CVE-2026-10520"],"stack":["vpn-edge"],"first_seen":"2026-06-11T12:00:00.000Z","updated_at":"2026-06-11T12:00:00.000Z"},{"id":"arista-extensible-operating-system-incomplete-comparison-cve-2026-7473","url":"https://pwned.coffee/i/arista-extensible-operating-system-incomplete-comparison-cve-2026-7473","title":"Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability","summary":"Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. Added to CISA KEV on 2026-06-09 (federal deadline 2026-06-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Arista Extensible Operating System","fixed_versions":[],"ids":["CVE-2026-7473"],"stack":["vpn-edge"],"first_seen":"2026-06-09T12:00:00.000Z","updated_at":"2026-06-09T12:00:00.000Z"},{"id":"cisco-catalyst-sd-wan-manager-improper-encoding-or-escap-cve-2026-20245","url":"https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-improper-encoding-or-escap-cve-2026-20245","title":"Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability","summary":"Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. Added to CISA KEV on 2026-06-09 (federal deadline 2026-06-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Catalyst SD-WAN Manager","fixed_versions":[],"ids":["CVE-2026-20245"],"stack":["vpn-edge"],"first_seen":"2026-06-09T12:00:00.000Z","updated_at":"2026-06-09T12:00:00.000Z"},{"id":"cisco-catalyst-sd-wan-controller-authentication-bypass-v-cve-2026-20182","url":"https://pwned.coffee/i/cisco-catalyst-sd-wan-controller-authentication-bypass-v-cve-2026-20182","title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","summary":"Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14 (federal deadline 2026-05-17).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Catalyst SD-WAN","fixed_versions":[],"ids":["CVE-2026-20182"],"stack":["vpn-edge"],"first_seen":"2026-05-14T12:00:00.000Z","updated_at":"2026-05-14T12:00:00.000Z"},{"id":"ivanti-endpoint-manager-mobile-epmm-improper-input-valid-cve-2026-6973","url":"https://pwned.coffee/i/ivanti-endpoint-manager-mobile-epmm-improper-input-valid-cve-2026-6973","title":"Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Added to CISA KEV on 2026-05-07 (federal deadline 2026-05-10).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Ivanti Endpoint Manager Mobile (EPMM)","fixed_versions":[],"ids":["CVE-2026-6973"],"stack":["vpn-edge"],"first_seen":"2026-05-07T12:00:00.000Z","updated_at":"2026-05-07T12:00:00.000Z"},{"id":"palo-alto-networks-pan-os-out-of-bounds-write-vulnerabil-cve-2026-0300","url":"https://pwned.coffee/i/palo-alto-networks-pan-os-out-of-bounds-write-vulnerabil-cve-2026-0300","title":"Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability","summary":"Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. Added to CISA KEV on 2026-05-06 (federal deadline 2026-05-09).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Palo Alto Networks PAN-OS","fixed_versions":[],"ids":["CVE-2026-0300"],"stack":["vpn-edge"],"first_seen":"2026-05-06T12:00:00.000Z","updated_at":"2026-05-06T12:00:00.000Z"},{"id":"cisco-catalyst-sd-wan-manager-incorrect-use-of-privilege-cve-2026-20122","url":"https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-incorrect-use-of-privilege-cve-2026-20122","title":"Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. Added to CISA KEV on 2026-04-20 (federal deadline 2026-04-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Catalyst SD-WAN Manger","fixed_versions":[],"ids":["CVE-2026-20122"],"stack":["vpn-edge"],"first_seen":"2026-04-20T12:00:00.000Z","updated_at":"2026-04-20T12:00:00.000Z"},{"id":"cisco-catalyst-sd-wan-manager-exposure-of-sensitive-information-to-an-un","url":"https://pwned.coffee/i/cisco-catalyst-sd-wan-manager-exposure-of-sensitive-information-to-an-un","title":"Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","summary":"Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. Can be chained with CVE-2026-20128. Added to CISA KEV on 2026-04-20 (federal deadline 2026-04-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Catalyst SD-WAN Manager","fixed_versions":[],"ids":["CVE-2026-20128","CVE-2026-20133"],"stack":["vpn-edge"],"first_seen":"2026-04-20T12:00:00.000Z","updated_at":"2026-04-20T12:00:00.000Z"},{"id":"fortinet-forticlient-ems-sql-injection-vulnerability-cve-2026-21643","url":"https://pwned.coffee/i/fortinet-forticlient-ems-sql-injection-vulnerability-cve-2026-21643","title":"Fortinet FortiClient EMS SQL Injection Vulnerability","summary":"Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-16).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet FortiClient EMS","fixed_versions":[],"ids":["CVE-2026-21643"],"stack":["vpn-edge"],"first_seen":"2026-04-13T12:00:00.000Z","updated_at":"2026-04-13T12:00:00.000Z"},{"id":"ivanti-endpoint-manager-mobile-epmm-code-injection-vulne-cve-2026-1340","url":"https://pwned.coffee/i/ivanti-endpoint-manager-mobile-epmm-code-injection-vulne-cve-2026-1340","title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Added to CISA KEV on 2026-04-08 (federal deadline 2026-04-11).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Ivanti Endpoint Manager Mobile (EPMM)","fixed_versions":[],"ids":["CVE-2026-1340"],"stack":["vpn-edge"],"first_seen":"2026-04-08T12:00:00.000Z","updated_at":"2026-04-08T12:00:00.000Z"},{"id":"fortinet-forticlient-ems-improper-access-control-vulnera-cve-2026-35616","url":"https://pwned.coffee/i/fortinet-forticlient-ems-improper-access-control-vulnera-cve-2026-35616","title":"Fortinet FortiClient EMS Improper Access Control Vulnerability","summary":"Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Added to CISA KEV on 2026-04-06 (federal deadline 2026-04-09).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet FortiClient EMS","fixed_versions":[],"ids":["CVE-2026-35616"],"stack":["vpn-edge"],"first_seen":"2026-04-06T12:00:00.000Z","updated_at":"2026-04-06T12:00:00.000Z"},{"id":"citrix-netscaler-out-of-bounds-read-vulnerability-cve-2026-3055","url":"https://pwned.coffee/i/citrix-netscaler-out-of-bounds-read-vulnerability-cve-2026-3055","title":"Citrix NetScaler Out-of-Bounds Read Vulnerability","summary":"Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread. Added to CISA KEV on 2026-03-30 (federal deadline 2026-04-02).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Citrix NetScaler","fixed_versions":[],"ids":["CVE-2026-3055"],"stack":["vpn-edge"],"first_seen":"2026-03-30T12:00:00.000Z","updated_at":"2026-03-30T12:00:00.000Z"},{"id":"f5-big-ip-stack-based-buffer-overflow-vulnerability-cve-2025-53521","url":"https://pwned.coffee/i/f5-big-ip-stack-based-buffer-overflow-vulnerability-cve-2025-53521","title":"F5 BIG-IP Stack-Based Buffer Overflow Vulnerability","summary":"F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. Added to CISA KEV on 2026-03-27 (federal deadline 2026-03-30).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"F5 BIG-IP","fixed_versions":[],"ids":["CVE-2025-53521"],"stack":["vpn-edge"],"first_seen":"2026-03-27T12:00:00.000Z","updated_at":"2026-03-27T12:00:00.000Z"},{"id":"ivanti-endpoint-manager-epm-authentication-bypass-vulner-cve-2026-1603","url":"https://pwned.coffee/i/ivanti-endpoint-manager-epm-authentication-bypass-vulner-cve-2026-1603","title":"Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability","summary":"Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. Added to CISA KEV on 2026-03-09 (federal deadline 2026-03-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Ivanti Endpoint Manager (EPM)","fixed_versions":[],"ids":["CVE-2026-1603"],"stack":["vpn-edge"],"first_seen":"2026-03-09T12:00:00.000Z","updated_at":"2026-03-09T12:00:00.000Z"},{"id":"cisco-sd-wan-path-traversal-vulnerability-cve-2022-20775","url":"https://pwned.coffee/i/cisco-sd-wan-path-traversal-vulnerability-cve-2022-20775","title":"Cisco SD-WAN Path Traversal Vulnerability","summary":"Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Added to CISA KEV on 2026-02-25 (federal deadline 2026-02-27).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco SD-WAN","fixed_versions":[],"ids":["CVE-2022-20775"],"stack":["vpn-edge"],"first_seen":"2026-02-25T12:00:00.000Z","updated_at":"2026-02-25T12:00:00.000Z"},{"id":"cisco-catalyst-sd-wan-controller-and-manager-authenticat-cve-2026-20127","url":"https://pwned.coffee/i/cisco-catalyst-sd-wan-controller-and-manager-authenticat-cve-2026-20127","title":"Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability","summary":"Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. Added to CISA KEV on 2026-02-25 (federal deadline 2026-02-27).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Catalyst SD-WAN Controller and Manager","fixed_versions":[],"ids":["CVE-2026-20127"],"stack":["vpn-edge"],"first_seen":"2026-02-25T12:00:00.000Z","updated_at":"2026-02-25T12:00:00.000Z"},{"id":"ivanti-endpoint-manager-mobile-epmm-code-injection-vulne-cve-2026-1281","url":"https://pwned.coffee/i/ivanti-endpoint-manager-mobile-epmm-code-injection-vulne-cve-2026-1281","title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","summary":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Added to CISA KEV on 2026-01-29 (federal deadline 2026-02-01).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Ivanti Endpoint Manager Mobile (EPMM)","fixed_versions":[],"ids":["CVE-2026-1281"],"stack":["vpn-edge"],"first_seen":"2026-01-29T12:00:00.000Z","updated_at":"2026-01-29T12:00:00.000Z"},{"id":"fortinet-multiple-products-authentication-bypass-using-a-cve-2026-24858","url":"https://pwned.coffee/i/fortinet-multiple-products-authentication-bypass-using-a-cve-2026-24858","title":"Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability","summary":"Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. Added to CISA KEV on 2026-01-27 (federal deadline 2026-01-30).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet Multiple Products","fixed_versions":[],"ids":["CVE-2026-24858"],"stack":["vpn-edge"],"first_seen":"2026-01-27T12:00:00.000Z","updated_at":"2026-01-27T12:00:00.000Z"},{"id":"cisco-unified-communications-products-code-injection-vul-cve-2026-20045","url":"https://pwned.coffee/i/cisco-unified-communications-products-code-injection-vul-cve-2026-20045","title":"Cisco Unified Communications Products Code Injection Vulnerability","summary":"Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Added to CISA KEV on 2026-01-21 (federal deadline 2026-02-11).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Unified Communications Manager","fixed_versions":[],"ids":["CVE-2026-20045"],"stack":["vpn-edge"],"first_seen":"2026-01-21T12:00:00.000Z","updated_at":"2026-01-21T12:00:00.000Z"},{"id":"sonicwall-sma1000-missing-authorization-vulnerability-cve-2025-40602","url":"https://pwned.coffee/i/sonicwall-sma1000-missing-authorization-vulnerability-cve-2025-40602","title":"SonicWall SMA1000 Missing Authorization Vulnerability","summary":"SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. Added to CISA KEV on 2025-12-17 (federal deadline 2025-12-24).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"SonicWall SMA1000 appliance","fixed_versions":[],"ids":["CVE-2025-40602"],"stack":["vpn-edge"],"first_seen":"2025-12-17T12:00:00.000Z","updated_at":"2025-12-17T12:00:00.000Z"},{"id":"cisco-multiple-products-improper-input-validation-vulner-cve-2025-20393","url":"https://pwned.coffee/i/cisco-multiple-products-improper-input-validation-vulner-cve-2025-20393","title":"Cisco Multiple Products Improper Input Validation Vulnerability","summary":"Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. Added to CISA KEV on 2025-12-17 (federal deadline 2025-12-24).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Cisco Multiple Products","fixed_versions":[],"ids":["CVE-2025-20393"],"stack":["vpn-edge"],"first_seen":"2025-12-17T12:00:00.000Z","updated_at":"2025-12-17T12:00:00.000Z"},{"id":"fortinet-multiple-products-improper-verification-of-cryp-cve-2025-59718","url":"https://pwned.coffee/i/fortinet-multiple-products-improper-verification-of-cryp-cve-2025-59718","title":"Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability","summary":"Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory. Added to CISA KEV on 2025-12-16 (federal deadline 2025-12-23).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet Multiple Products","fixed_versions":[],"ids":["CVE-2025-59718"],"stack":["vpn-edge"],"first_seen":"2025-12-16T12:00:00.000Z","updated_at":"2025-12-16T12:00:00.000Z"},{"id":"fortinet-fortiweb-os-command-injection-vulnerability-cve-2025-58034","url":"https://pwned.coffee/i/fortinet-fortiweb-os-command-injection-vulnerability-cve-2025-58034","title":"Fortinet FortiWeb OS Command Injection Vulnerability","summary":"Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Added to CISA KEV on 2025-11-18 (federal deadline 2025-11-25).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet FortiWeb","fixed_versions":[],"ids":["CVE-2025-58034"],"stack":["vpn-edge"],"first_seen":"2025-11-18T12:00:00.000Z","updated_at":"2025-11-18T12:00:00.000Z"},{"id":"fortinet-fortiweb-path-traversal-vulnerability-cve-2025-64446","url":"https://pwned.coffee/i/fortinet-fortiweb-path-traversal-vulnerability-cve-2025-64446","title":"Fortinet FortiWeb Path Traversal Vulnerability","summary":"Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. Added to CISA KEV on 2025-11-14 (federal deadline 2025-11-21).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"Fortinet FortiWeb","fixed_versions":[],"ids":["CVE-2025-64446"],"stack":["vpn-edge"],"first_seen":"2025-11-14T12:00:00.000Z","updated_at":"2025-11-14T12:00:00.000Z"}]}