pwned.coffeeUpdated 12 min ago

Past orders

Things that were on fire and have since been put out, or at least stopped making the news.

Showing everything. Tell us your usual to see only what can hurt you.

October 2026

  1. exploitedKEV overdue 4dcriticalpatched BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Added to CISA KEV on 2026-10-16 (federal deadline 2026-10-19). CVE-2026-1027642 sources
  2. exploitedKEV overdue 4dhighpatched Fortinet Multiple Products Path Traversal Vulnerability FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16 (federal deadline 2026-10-19). CVE-2025-616242 sources
  3. criticalpatched TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses @tanstack/start-server-core (npm), @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/vue-start (npm) An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. fixed in @tanstack/start-server-core 1.169.39 +3CVE-2026-1029895 sources
  4. exploitedKEV overdue 5dcriticalpatched Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access… CVE-2026-215892 sources
  5. exploitedKEV overdue 6dcriticalpatched Ahsay AhsayCBS Command Injection Vulnerability Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CVE-2026-105133CVE-2026-1051343 sources
  6. exploitedKEV overdue 6dcriticalpatched Cisco Secure Email Gateway Relative Path Traversal Vulnerability Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14 (federal deadline 2026-10-17). CVE-2026-765192 sources
  7. exploitedKEV overdue 6dhighpatched Palo Alto Networks PAN-OS Code Injection Vulnerability Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14 (federal deadline 2026-10-17). CVE-2026-03222 sources
  8. criticalpatched Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) +7 more Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. fixed in Microsoft.AspNetCore.App.Runtime.linux-arm 8.0.32 +43CVE-2026-880925 sources
  9. criticalpatched Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability Microsoft.AspNetCore.App.Runtime.linux-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) +7 more Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. fixed in Microsoft.AspNetCore.App.Runtime.linux-arm 11.0.0-rc.2 +43CVE-2026-701885 sources
  10. exploitedKEV overdue 7dhighpatched Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Added to CISA KEV on 2026-10-13 (federal deadline 2026-10-16). CVE-2026-1049351 source
  11. exploitedKEV overdue 7dhighpatched Microsoft Windows Command Injection Vulnerability Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Added to CISA KEV on 2026-10-13 (federal deadline 2026-10-16). CVE-2026-969512 sources
  12. criticalpatched Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite github.com/0xJacky/Nginx-UI (go) An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2(523) 6c86e5a5 in the local Docker container uozi/nginx-ui:latest. ##… fixed in github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591CVE-2026-1078065 sources
  13. exploitedKEV overdue 12dhighpatched ISC BIND Data Processing Errors Vulnerability ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2015-54773 sources
  14. exploitedKEV overdue 12dhighpatched Apache Struts Command Injection Vulnerability Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2016-30811 source
  15. exploitedKEV overdue 12dhighpatched Strapi Cleartext Storage of Sensitive Information Vulnerability Strapi Strapi Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). CVE-2023-228942 sources
  16. exploitedKEV overdue 12dcriticalpatched ONLYOFFICE Docs Server Path Traversal Vulnerability ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2021-31992 sources
  17. exploitedKEV overdue 12dcriticalpatched ProFTPD Improper Access Control Vulnerability ProFTPD ProFTPD ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11). CVE-2015-33063 sources
  18. criticalpatched Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration langflow (pip), langflow-base (pip), lfx (pip) Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH… fixed in langflow 1.10.3 +2CVE-2026-1056975 sources
  19. criticalpatched Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass flowise (npm), flowise-components (npm) Flowise <= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (validatePythonCodeForDataFrame()) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an external server, perform SSRF against internal… fixed in flowise 3.1.3 +1CVE-2026-734874 sources
  20. criticalpatched Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium flowise (npm), flowise-components (npm) Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(),… fixed in flowise 3.1.3 +1CVE-2026-734834 sources
  21. criticalpatched Payload: SQL Injection in SQLite and Postgres payload (npm) A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB (@payloadcms/mongodb). Users should upgrade Payload packages to… fixed in payload 3.88.0 +1CVE-2026-1058454 sources
  22. criticalpatched Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation langflow (pip) Langflow's built-in Python interpreter components — PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any… fixed in langflow 1.10.1CVE-2026-105615 sources
  23. criticalpartial fix Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path @capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven) Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path (/_capacitor_http_interceptor_) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the… fixed in @capacitor/android 6.2.2 +15CVE-2026-1039225 sources
  24. criticalpatched Langflow: Weak Fernet Key via random.seed() langflow (pip) Langflow uses Python's random module (Mersenne Twister, a non-cryptographic PRNG) seeded with the SECRET_KEY to derive the Fernet encryption key for all stored user credentials (API keys, LLM provider secrets, database passwords). When the SECRET_KEY is shorter than 32 characters — a common scenario for self-hosted deployments using… fixed in langflow 1.10.1CVE-2026-92055 sources
  25. criticalpatched Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass langflow (pip) A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner,… fixed in langflow 1.9.1CVE-2026-85055 sources
  26. exploitedhighpatched Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Added to CISA KEV on 2026-10-04 (federal deadline 2026-10-07). CVE-2026-887793 sources
  27. criticalpatched gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled gitea.com/gitea/runner (go) act_runner appends workflow-controlled jobs.<job>.container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A… fixed in gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022CVE-2026-738024 sources
  28. criticalpatched Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain vibe-trading-ai (pip) 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with API_AUTH_KEY set (F2), unauthenticated file write of .py/.sh/.yaml to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost… fixed in vibe-trading-ai 0.1.7no CVE4 sources
  29. exploitedcriticalpatched Zammad GmbH Zammad Improper Privilege Management Vulnerability Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. Added to CISA KEV on 2026-10-02 (federal deadline 2026-10-05). CVE-2026-102489CVE-2026-1024904 sources
  30. criticalpatched vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector vm2 (npm) Reporter - Name or handle: [YMsora] - Report date: 2026-08-14 The latest published vm2 release, 3.11.5, and the current main branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can retain an attacker-controlled constructor[Symbol.species] across… fixed in vm2 3.11.7CVE-2026-929445 sources
  31. exploitedcriticalpatched Fortinet FortiMail Path Traversal Vulnerability Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Added to CISA KEV on 2026-10-01 (federal deadline 2026-10-04). CVE-2026-1042862 sources

September 2026

  1. criticalpatched Next.js: Remote Code Execution in next/og ImageResponse next (npm) The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: fixed in next 16.3.6no CVE5 sources
  2. exploitedcriticalpatched Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30 (federal deadline 2026-10-03). CVE-2026-765042 sources
  3. exploitedKEV overdue 10dhighpatched Apple Multiple Products Out-of-Bounds Write Vulnerability Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. Added to CISA KEV on 2026-09-29 (federal deadline 2026-10-13). CVE-2026-869504 sources
  4. exploitedcriticalpatched Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service Can be chained with CVE-2026-88771. Added to CISA KEV on 2026-09-27 (federal deadline 2026-09-30). CVE-2026-88771CVE-2026-887724 sources
  5. criticalpatched FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider fof/oauth (composer) An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with "verified": false. Affected versions of fof/oauth… fixed in fof/oauth 1.7.4 +1CVE-2026-921615 sources
  6. exploitedhighpatched Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-672792 sources
  7. exploitedhighpatched Microsoft SharePoint Code Injection Vulnerability Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-656602 sources
  8. exploitedhighpatched WordPress Core Remote File Inclusion Vulnerability WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-879022 sources
  9. criticalpartial fix ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. fixed in github.com/ixofoundation/ixo-blockchain/v8 8.0.0CVE-2026-616045 sources
  10. exploitedcriticalpatched WSO2 Multiple Products Path Traversal Vulnerability WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. Added to CISA KEV on 2026-09-24 (federal deadline 2026-09-27). CVE-2026-54302 sources
  11. exploitedhighpatched Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24 (federal deadline 2026-09-27). CVE-2026-713622 sources
  12. exploitedhighpatched Arista VeloCloud Orchestrator Improper Input Validation Vulnerability Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. CVE-2026-939522 sources
  13. exploitedhighpatched F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. Added to CISA KEV on 2026-09-22 (federal deadline 2026-09-25). CVE-2026-941271 source
  14. exploitedhighpatched Check Point Multiple Products Path Traversal Vulnerability Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. Can be chained with CVE-2026-85102. CVE-2026-85102CVE-2026-936164 sources
  15. exploitedhighpatched Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. Added to CISA KEV on 2026-09-21 (federal deadline 2026-09-24). CVE-2026-72732 sources
  16. exploitedhighpatched Linux Kernel Race Condition Vulnerability Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Can be chained with CVE-2026-53266, CVE-2025-39682. Added to CISA KEV on 2026-09-18 (federal deadline 2026-09-21). CVE-2025-39682CVE-2025-39964 +123 sources
  17. exploitedhighpatched Google Pixel Improper Authorization Vulnerability Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19). CVE-2026-587042 sources
  18. exploitedhighpatched Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. CVE-2026-764602 sources
  19. exploitedhighpatched Acronis Backup Incorrect Default Permissions Vulnerability Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19). CVE-2026-878862 sources