pwned.coffeeUpdated 29 min ago

The menu

Self-hosted apps

Partial outage Health inspection grade

2 live incidents affecting Self-hosted apps, 1 critical, 1 not fully patched.

Today's specials

Order upFix available1

The fix exists. Somebody has to carry it.

  1. Kiloview E3 NDI Encoder Vulnerabilities 🔥 On the fly · exploited
    Fixed in 1.30 Advisory

On holdStatus unknown1

Nobody has said yet. Read the advisory.

  1. GPAC/MP4Box Heap Use-After-Free
    Do now Restrict use of GPAC/MP4Box on untrusted files and watch for a vendor fix. Advisory

7 spills in 2026 for Self-hosted apps

Week of 12 Jan 2026: 1 newWeek of 9 Mar 2026: 1 newWeek of 10 Aug 2026: 1 newWeek of 28 Sept 2026: 1 newWeek of 12 Oct 2026: 1 newWeek of 19 Oct 2026: 2 new
Worst week: 19 Oct 2026, 2 new spills.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. Ahsay AhsayCBS Command Injection 🔥 On the fly · exploitedKEV overdue 6d
    Fix available. Upgrade to the vendor's patched release.
  2. Zammad GmbH Zammad Improper Privilege Management 🔥 On the fly · exploited
    Fix available. Upgrade to the vendor's patched release.
  3. Metabase Metabase Metabase SQL Injection 🔥 On the fly · exploited
    Fix available. Upgrade to the vendor's patched release.
  5. Gogs Gogs Gogs Path Traversal 🔥 On the fly · exploited
    Fix available. Upgrade to the vendor's patched release.

More in Servers

Follow Self-hosted apps

RSS: /feed.xml?stack=selfhost-apps. JSON: /incidents.json?stack=selfhost-apps. Or add it to your usual for delivery.