pwned.coffeeUpdated 11 min ago

Past orders

Things that were on fire and have since been put out, or at least stopped making the news.

Showing everything. Tell us your usual to see only what can hurt you.

May 2026

  1. exploitedhighpatched Microsoft Windows Buffer Overflow Vulnerability Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. Added to CISA KEV on 2026-05-20 (federal deadline 2026-06-03). CVE-2008-42502 sources
  2. exploitedhighpatched Microsoft DirectX NULL Byte Overwrite Vulnerability Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. Added to CISA KEV on 2026-05-20 (federal deadline 2026-06-03). CVE-2009-15372 sources
  3. exploitedhighpatched Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. Added to CISA KEV on 2026-05-20 (federal deadline 2026-06-03). CVE-2009-34593 sources
  4. exploitedhighpatched Microsoft Internet Explorer Use-After-Free Vulnerability Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0249CVE-2010-08064 sources
  5. exploitedhighpatched Microsoft Defender Link Following Vulnerability Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. Can be chained with CVE-2026-45498. Added to CISA KEV on 2026-05-20 (federal deadline 2026-06-03). CVE-2026-41091CVE-2026-454984 sources
  6. exploitedhighpatched Microsoft Exchange Server Cross-Site Scripting Vulnerability Microsoft Microsoft Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. Added to CISA KEV on 2026-05-15 (federal deadline 2026-05-29). CVE-2026-428973 sources
  7. exploitedhighpatched Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14 (federal deadline 2026-05-17). CVE-2026-201823 sources
  8. exploitedhighpatched BerriAI LiteLLM SQL Injection Vulnerability BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08 (federal deadline 2026-05-11). CVE-2026-422082 sources
  9. exploitedhighpatched Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Added to CISA KEV on 2026-05-07 (federal deadline 2026-05-10). CVE-2026-69732 sources
  10. exploitedhighpatched Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. CVE-2026-03002 sources
  11. exploitedhighpatched Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. Added to CISA KEV on 2026-05-01 (federal deadline 2026-05-15). CVE-2026-314314 sources

April 2026

  1. exploitedcriticalpatched WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30 (federal deadline 2026-05-03). CVE-2026-419404 sources
  2. exploitedcriticalpatched ConnectWise ScreenConnect Path Traversal Vulnerability ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems. Added to CISA KEV on 2026-04-28 (federal deadline 2026-05-12). CVE-2024-17082 sources
  3. exploitedhighpatched Microsoft Windows Protection Mechanism Failure Vulnerability Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-28 (federal deadline 2026-05-12). CVE-2026-322022 sources
  4. exploitedhighpatched D-Link DIR-823X Command Injection Vulnerability D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). CVE-2025-296352 sources
  5. exploitedhighpatched Samsung MagicINFO 9 Server Path Traversal Vulnerability Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority. Added to CISA KEV on 2026-04-24 (federal deadline 2026-05-08). CVE-2024-73992 sources
  6. exploitedcriticalpatched SimpleHelp Path Traversal Vulnerability SimpleHelp SimpleHelp SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. Can be chained with CVE-2024-57726. CVE-2024-57726CVE-2024-577283 sources
  7. exploitedhighpatched Marimo Remote Code Execution Vulnerability Marimo Marimo Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands. Added to CISA KEV on 2026-04-23 (federal deadline 2026-05-07). CVE-2026-399872 sources
  8. exploitedcriticalpatched Microsoft Defender Insufficient Granularity of Access Control Vulnerability Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. Added to CISA KEV on 2026-04-22 (federal deadline 2026-05-06). CVE-2026-338252 sources
  9. exploitedhighpatched Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability Cisco Catalyst SD-WAN Manger Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. CVE-2026-201223 sources
  10. exploitedhighpatched Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. Can be chained with CVE-2026-20128. Added to CISA KEV on 2026-04-20 (federal deadline 2026-04-23). CVE-2026-20128CVE-2026-201334 sources
  11. exploitedhighpatched Kentico Xperience Path Traversal Vulnerability Kentico Kentico Xperience Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations. Added to CISA KEV on 2026-04-20 (federal deadline 2026-05-04). CVE-2025-27492 sources
  12. exploitedcriticalpatched PaperCut NG/MF Improper Authentication Vulnerability PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class. Added to CISA KEV on 2026-04-20 (federal deadline 2026-05-04). CVE-2023-273512 sources
  13. exploitedhighpatched Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. Added to CISA KEV on 2026-04-20 (federal deadline 2026-04-23). CVE-2025-487002 sources
  14. exploitedhighpatched Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials. Added to CISA KEV on 2026-04-20 (federal deadline 2026-05-04). CVE-2025-329752 sources
  15. exploitedcriticalpatched JetBrains TeamCity Relative Path Traversal Vulnerability JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. Added to CISA KEV on 2026-04-20 (federal deadline 2026-05-04). CVE-2024-271993 sources
  16. exploitedhighpatched Apache ActiveMQ Improper Input Validation Vulnerability Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16 (federal deadline 2026-04-30). CVE-2026-341972 sources
  17. exploitedhighpatched Microsoft Office Remote Code Execution Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object. Added to CISA KEV on 2026-04-14 (federal deadline 2026-04-28). CVE-2009-02382 sources
  18. exploitedhighpatched Microsoft SharePoint Server Improper Input Validation Vulnerability Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-14 (federal deadline 2026-04-28). CVE-2026-322012 sources
  19. exploitedhighpatched Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability Microsoft Visual Basic for Applications (VBA) Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-27). CVE-2012-18542 sources
  20. exploitedcriticalpatched Microsoft Windows Link Following Vulnerability Microsoft Windows contains a link following vulnerability that allows for privilege escalation Can be chained with CVE-2023-36424. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-27). CVE-2023-36424CVE-2025-607104 sources
  21. exploitedcriticalpatched Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-27). CVE-2023-215292 sources
  22. exploitedhighpatched Adobe Acrobat Use-After-Free Vulnerability Adobe Acrobat contains a use-after-free vulnerability that allows for code execution Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-27). CVE-2020-97152 sources
  23. exploitedhighpatched Fortinet FortiClient EMS SQL Injection Vulnerability Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-16). CVE-2026-216432 sources
  24. exploitedhighpatched Adobe Acrobat and Reader Prototype Pollution Vulnerability Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-27). CVE-2026-346212 sources
  25. exploitedhighpatched Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Added to CISA KEV on 2026-04-08 (federal deadline 2026-04-11). CVE-2026-13403 sources
  26. exploitedhighpatched Fortinet FortiClient EMS Improper Access Control Vulnerability Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Added to CISA KEV on 2026-04-06 (federal deadline 2026-04-09). CVE-2026-356161 source
  27. exploitedhighpatched TrueConf Client Download of Code Without Integrity Check Vulnerability TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user. CVE-2026-35023 sources
  28. exploitedhighpatched Google Dawn Use-After-Free Vulnerability Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-52811 source

March 2026

  1. exploitedhighpatched Citrix NetScaler Out-of-Bounds Read Vulnerability Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread. Added to CISA KEV on 2026-03-30 (federal deadline 2026-04-02). CVE-2026-30552 sources
  2. exploitedhighpatched F5 BIG-IP Stack-Based Buffer Overflow Vulnerability F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. Added to CISA KEV on 2026-03-27 (federal deadline 2026-03-30). CVE-2025-535213 sources
  3. exploitedhighpatched Aquasecurity Trivy Embedded Malicious Code Vulnerability Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory. Added to CISA KEV on 2026-03-26 (federal deadline 2026-04-09). CVE-2026-336341 source
  4. exploitedhighpatched Langflow Code Injection Vulnerability Langflow Langflow Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25 (federal deadline 2026-04-08). CVE-2026-330172 sources
  5. exploitedhighpatched Craft CMS Code Injection Vulnerability Craft CMS Craft CMS Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code. Added to CISA KEV on 2026-03-20 (federal deadline 2026-04-03). CVE-2025-324323 sources
  6. exploitedhighpatched Laravel Livewire Code Injection Vulnerability Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. Added to CISA KEV on 2026-03-20 (federal deadline 2026-04-03). CVE-2025-540683 sources
  7. exploitedhighpatched Apple Multiple Products Improper Locking Vulnerability Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. Can be chained with CVE-2025-43520, CVE-2025-31277. Added to CISA KEV on 2026-03-20 (federal deadline 2026-04-03). CVE-2025-31277CVE-2025-43510 +116 sources
  8. exploitedcriticalpatched Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. CVE-2026-201312 sources
  9. exploitedhighpatched Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. Added to CISA KEV on 2026-03-18 (federal deadline 2026-04-01). CVE-2025-663762 sources
  10. exploitedhighpatched Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-03-18 (federal deadline 2026-03-21). CVE-2026-209632 sources
  11. exploitedhighpatched Wing FTP Server Information Disclosure Vulnerability Wing FTP Server Wing FTP Server Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie. Added to CISA KEV on 2026-03-16 (federal deadline 2026-03-30). CVE-2025-478132 sources