pwned.coffeeUpdated 28 min ago

Past orders

Things that were on fire and have since been put out, or at least stopped making the news.

Showing everything. Tell us your usual to see only what can hurt you.

October 2026

  1. criticalpatchedexploited BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Added to CISA KEV on 2026-10-16 (federal deadline 2026-10-19). CVE-2026-1027642 sources
  2. highpatchedexploited Fortinet Multiple Products Path Traversal Vulnerability FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16 (federal deadline 2026-10-19). CVE-2025-616242 sources
  3. criticalpatched TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses @tanstack/start-server-core (npm), @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/vue-start (npm) ## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. ## Cause… fixed in @tanstack/start-server-core 1.169.39 +3CVE-2026-1029895 sources
  4. criticalpatchedexploited Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15 (federal deadline 2026-10-18). CVE-2026-215892 sources
  5. criticalpatchedexploited Ahsay AhsayCBS Command Injection Vulnerability Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Can be chained with CVE-2026-105133. Added to CISA KEV on 2026-10-14 (federal deadline 2026-10-17). CVE-2026-105133CVE-2026-1051343 sources
  6. criticalpatchedexploited Cisco Secure Email Gateway Relative Path Traversal Vulnerability Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14 (federal deadline 2026-10-17). CVE-2026-765192 sources
  7. highpatchedexploited Palo Alto Networks PAN-OS Code Injection Vulnerability Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14 (federal deadline 2026-10-17). CVE-2026-03222 sources
  8. criticalpatched Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) +7 more ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An aborted Kestrel HTTP/1 connection can reparse unread request-body bytes as… fixed in Microsoft.AspNetCore.App.Runtime.linux-arm 8.0.32 +43CVE-2026-880925 sources
  9. criticalpatched Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) +7 more ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Kestrel accepts newline characters in HTTP/2 request trailers and values… fixed in Microsoft.AspNetCore.App.Runtime.linux-arm 11.0.0-rc.2 +43CVE-2026-701885 sources
  10. highpatchedexploited Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Added to CISA KEV on 2026-10-13 (federal deadline 2026-10-16). CVE-2026-1049351 source
  11. highpatchedexploited Microsoft Windows Command Injection Vulnerability Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Added to CISA KEV on 2026-10-13 (federal deadline 2026-10-16). CVE-2026-969512 sources
  12. criticalpatched Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite github.com/0xJacky/Nginx-UI (go) ## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ##… fixed in github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591CVE-2026-1078065 sources
  13. highpatchedexploited ISC BIND Data Processing Errors Vulnerability ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2015-54773 sources
  14. highpatchedexploited Apache Struts Command Injection Vulnerability Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2016-30811 source
  15. highpatchedexploited Strapi Cleartext Storage of Sensitive Information Vulnerability Strapi Strapi Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2023-228942 sources
  16. criticalpatchedexploited ONLYOFFICE Docs Server Path Traversal Vulnerability ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2021-31992 sources
  17. criticalpatchedexploited ProFTPD Improper Access Control Vulnerability ProFTPD ProFTPD ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2015-33063 sources
  18. criticalpatched Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration langflow (pip), langflow-base (pip), lfx (pip) ### Summary Before **Langflow 1.10.3**, the MCP stdio transport launched whatever `command` / `args` a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in `bash -c "exec {command} ..."`. Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", `POST/PATCH… fixed in langflow 1.10.3 +2CVE-2026-1056975 sources
  19. criticalpatched Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass flowise (npm), flowise-components (npm) ## Summary Flowise <= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (`validatePythonCodeForDataFrame()`) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an external server, perform SSRF against internal… fixed in flowise 3.1.3 +1CVE-2026-734874 sources
  20. criticalpatched Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium flowise (npm), flowise-components (npm) Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which… fixed in flowise 3.1.3 +1CVE-2026-734834 sources
  21. criticalpatched Payload: SQL Injection in SQLite and Postgres payload (npm) ### Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB (`@payloadcms/mongodb`). ### Patches Users should upgrade Payload packages to… fixed in payload 3.88.0 +1CVE-2026-1058454 sources
  22. criticalpatched Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation langflow (pip) ### Summary Langflow's built-in Python interpreter components — `PythonREPLComponent` (Python Interpreter) and the legacy `PythonREPLToolComponent` (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any… fixed in langflow 1.10.1CVE-2026-105615 sources
  23. criticalpatched Langflow: Weak Fernet Key via random.seed() langflow (pip) ### Summary Langflow uses Python's `random` module (Mersenne Twister, a non-cryptographic PRNG) seeded with the `SECRET_KEY` to derive the Fernet encryption key for all stored user credentials (API keys, LLM provider secrets, database passwords). When the `SECRET_KEY` is shorter than 32 characters — a common scenario for self-hosted deployments using… fixed in langflow 1.10.1CVE-2026-92055 sources
  24. criticalpatched Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass langflow (pip) ### Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the `WEBHOOK_AUTH_ENABLE` configuration is set to `False`. This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner,… fixed in langflow 1.9.1CVE-2026-85055 sources
  25. highpatchedexploited Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Added to CISA KEV on 2026-10-04 (federal deadline 2026-10-07). CVE-2026-887793 sources
  26. criticalpatched gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled gitea.com/gitea/runner (go) ### Summary act_runner appends workflow-controlled `jobs.<job>.container.options` directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only `Privileged` is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A… fixed in gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022CVE-2026-738024 sources
  27. criticalpatched Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain vibe-trading-ai (pip) ### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with `API_AUTH_KEY` set (F2), unauthenticated file write of `.py`/`.sh`/`.yaml` to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost… fixed in vibe-trading-ai 0.1.7no CVE4 sources
  28. highpatchedexploited Zammad GmbH Zammad Improper Privilege Management Vulnerability Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. Can be chained with CVE-2026-102489. Added to CISA KEV on 2026-10-02 (federal deadline 2026-10-05). CVE-2026-102489CVE-2026-1024904 sources
  29. criticalpatched vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector vm2 (npm) ## Reporter - Name or handle: `[YMsora]` - Report date: 2026-08-14 ## Summary The latest published vm2 release, **3.11.5**, and the current `main` branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can retain an attacker-controlled `constructor[Symbol.species]` across… fixed in vm2 3.11.7CVE-2026-929445 sources
  30. highpatchedexploited Fortinet FortiMail Path Traversal Vulnerability Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Added to CISA KEV on 2026-10-01 (federal deadline 2026-10-04). CVE-2026-1042862 sources

September 2026

  1. criticalpatched Next.js: Remote Code Execution in next/og ImageResponse next (npm) ## Impact The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: ```tsx import { ImageResponse } from 'next/og' export async function GET(request:… fixed in next 16.3.6no CVE5 sources
  2. highpatchedexploited Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30 (federal deadline 2026-10-03). CVE-2026-765042 sources
  3. highpatchedexploited Apple Multiple Products Out-of-Bounds Write Vulnerability Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. Added to CISA KEV on 2026-09-29 (federal deadline 2026-10-13). CVE-2026-869504 sources
  4. highpatchedexploited Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service Can be chained with CVE-2026-88771. Added to CISA KEV on 2026-09-27 (federal deadline 2026-09-30). CVE-2026-88771CVE-2026-887724 sources
  5. criticalpatched FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider fof/oauth (composer) ### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `"verified": false`. Affected versions of `fof/oauth`… fixed in fof/oauth 1.7.4 +1CVE-2026-921615 sources
  6. highpatchedexploited Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-672792 sources
  7. highpatchedexploited Microsoft SharePoint Code Injection Vulnerability Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-656602 sources
  8. highpatchedexploited WordPress Core Remote File Inclusion Vulnerability WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-879022 sources
  9. highpatchedexploited WSO2 Multiple Products Path Traversal Vulnerability WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. Added to CISA KEV on 2026-09-24 (federal deadline 2026-09-27). CVE-2026-54302 sources
  10. highpatchedexploited Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24 (federal deadline 2026-09-27). CVE-2026-713622 sources
  11. highpatchedexploited Arista VeloCloud Orchestrator Improper Input Validation Vulnerability Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Added to CISA KEV on 2026-09-22 (federal deadline 2026-09-25). CVE-2026-939522 sources
  12. highpatchedexploited F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. Added to CISA KEV on 2026-09-22 (federal deadline 2026-09-25). CVE-2026-941271 source
  13. highpatchedexploited Check Point Multiple Products Path Traversal Vulnerability Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. Can be chained with CVE-2026-85102. Added to CISA KEV on 2026-09-22 (federal deadline 2026-09-25). CVE-2026-85102CVE-2026-936164 sources
  14. highpatchedexploited Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. Added to CISA KEV on 2026-09-21 (federal deadline 2026-09-24). CVE-2026-72732 sources
  15. highpatchedexploited Linux Kernel Race Condition Vulnerability Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Can be chained with CVE-2026-53266, CVE-2025-39682. Added to CISA KEV on 2026-09-18 (federal deadline 2026-09-21). CVE-2025-39682CVE-2025-39964+123 sources
  16. highpatchedexploited Google Pixel Improper Authorization Vulnerability Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19). CVE-2026-587042 sources
  17. highpatchedexploited Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19). CVE-2026-764602 sources
  18. highpatchedexploited Acronis Backup Incorrect Default Permissions Vulnerability Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19). CVE-2026-878862 sources
  19. highpatchedexploited Cisco Secure Email Gateway SQL Injection Vulnerability Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14 (federal deadline 2026-09-17). CVE-2026-764612 sources
  20. highpatchedexploited ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11 (federal deadline 2026-09-14). CVE-2026-848692 sources