pwned.coffeeUpdated 41 min ago

Past orders

Things that were on fire and have since been put out, or at least stopped making the news.

Showing everything. Tell us your usual to see only what can hurt you.

March 2026

  1. Apple watchOS Apple Multiple products Use-After-Free 🔥 On the fly · exploited
    Fixed in watchOS 8.3, iOS and iPadOS 16.6 +4
    Under the heat lamp: 233 days KEV ✓ Record ✓ Vendor ✓
  2. Apple iOS And iPadOS Use-After-Free 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-03-05)
    Fixed in 17, 15.8.7
    Under the heat lamp: 233 days KEV ✓ Record ✓ Vendor ✓
  3. VMware Aria Operations Broadcom VMware Aria Operations Command Injection 🔥 On the fly · exploited
    Fixed in VMware Aria Operations 8.18.6, VMware Cloud Foundation Operations 9.0.2 +3
    Under the heat lamp: 235 days KEV ✓ Record ✓ Vendor ✓
  4. Qualcomm Snapdragon Qualcomm Multiple Chipsets Memory Corruption 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓

February 2026

  1. Cisco Catalyst SD-WAN Cisco SD-WAN Path Traversal 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-25)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  2. Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  3. FileZen Soliton Systems K.K FileZen OS Command Injection 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  4. Roundcube Webmail Deserialization of Untrusted Data 🔥 On the fly · exploited
    Fixed in 1.6.12, 1.5.12
    Under the heat lamp: 246 days KEV ✓ Record ✓ Vendor ✓
  5. GitLab Server-Side Request Forgery (SSRF) 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-18)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  6. Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials 🔥 On the fly · exploited
    Fixed in 6.0.3.1 HF1
    Under the heat lamp: 248 days KEV ✓ Record ✓ Vendor ✓
  7. Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-17)
    Fixed in 8.8.15
    Under the heat lamp: 249 days KEV ✓ Record ✓ Vendor ✓
  8. TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-17)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  9. Windows Microsoft Windows Video ActiveX Control Remote Code Execution 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-17)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  10. Chrome Google Chromium CSS Use-After-Free 🔥 On the fly · exploited
    Fixed in 145.0.7632.75
    Under the heat lamp: 249 days KEV ✓ Record ✓ Vendor ✓
  11. BeyondTrust Remote Support (RS) And Privileged Remote Access (PRA) OS Command Injection 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  12. Apple iOS Apple Multiple Buffer Overflow 🔥 On the fly · exploited
    Fixed in iOS and iPadOS 26.3, macOS 26.3 +3
    Under the heat lamp: 254 days KEV ✓ Record ✓ Vendor ✓
  13. Microsoft Configuration Manager SQL Injection 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-12)
    Fixed in 5.00.9106
    Under the heat lamp: 254 days KEV ✓ Record ✓ Vendor ✓
  15. SolarWinds Web Help Desk Security Control Bypass 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  16. Windows Microsoft MSHTML Framework Protection Mechanism Failure 🔥 On the fly · exploited
    Fixed in Windows 10 Version 1607 10.0.14393.8868, Windows 10 Version 1809 10.0.17763.8389 +19
    Under the heat lamp: 256 days KEV ✓ Record ✓ Vendor ✓
  18. @react-native-community/cli-server React Native Community CLI OS Command Injection 🔥 On the fly · exploited
    Fixed in @react-native-community/cli-server-api 20.0.0npm install @react-native-community/cli-server-api@20.0.0
    Under the heat lamp: 261 days KEV ✓ Record ✓ Vendor ✓
  19. SmarterTools SmarterMail Missing Authentication for Critical Function 🔥 On the fly · exploited
    Fixed in 100.0.9511
    Under the heat lamp: 261 days KEV ✓ Record ✓ Vendor ✓
  20. GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-03)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  21. FreePBX filestore Sangoma FreePBX OS Command Injection 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  22. Sangoma FreePBX Improper Authentication 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-02-03)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  23. SolarWinds Web Help Desk Deserialization of Untrusted Data 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓

January 2026

  1. Ivanti Endpoint Manager Mobile (EPMM) Code Injection 🔥 On the fly · exploited
    Fixed in 12.x.1.x RPM
    Under the heat lamp: 268 days KEV ✓ Record ✓ Vendor ✓
  3. Linux kernel Integer Overflow 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-01-26)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  5. GNU Inetutils Argument Injection 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  6. Microsoft 365 Apps for Enterprise Microsoft Office Security Feature Bypass 🔥 On the fly · exploited
    Fixed in Microsoft Office 2016 16.0.5539.1001, Microsoft Office 2019 16.0.10417.20095
    Under the heat lamp: 271 days KEV ✓ Record ✓ Vendor ✓
  7. VMware vCenter Server Broadcom VMware vCenter Server Out-of-bounds Write 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-01-23)
    Do now Fixed for VMware vCenter Server; still cooking for VMware Cloud Foundation.
    Under the heat lamp: 274 days KEV ✓ Record ✓ Vendor ✓
  9. Versa Concerto Improper Authentication 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-01-22)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  10. vitejs vite Vite Vitejs Improper Access Control 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-01-22)
    Fixed in 4.5.11
    Under the heat lamp: 275 days KEV ✓ Record ✓ Vendor ✓
  11. prettier eslint-config-prettier Embedded Malicious Code 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-01-22)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  12. Cisco Unified Communications Products Code Injection 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  13. Windows Microsoft Windows Information Disclosure 🔥 On the fly · exploited
    Fixed in Windows 10 Version 1607 10.0.14393.8783, Windows 10 Version 1809 10.0.17763.8276 +17
    Under the heat lamp: 284 days KEV ✓ Record ✓ Vendor ✓
  14. Gogs Path Traversal 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  15. Microsoft Office PowerPoint Code Injection 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-01-07)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  16. Hewlett Packard Enterprise (HPE) OneView Code Injection 🔥 On the fly · exploited
    Fixed in 11.00
    Under the heat lamp: 290 days KEV ✓ Record ✓ Vendor ✓

December 2025

  2. Digiever DS-2105 Pro Missing Authorization 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-12-22)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  3. WatchGuard Fireware OS WatchGuard Firebox Out of Bounds Write 🔥 On the fly · exploited
    Fixed in 2025.1.4, 12.11.6 +2
    Under the heat lamp: 309 days KEV ✓ Record ✓ Vendor ✓
  4. ASUS live update Embedded Malicious Code 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  5. SonicWall SMA 1000 SonicWall SMA1000 Missing Authorization 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  6. Cisco Secure Email Cisco Multiple Products Improper Input Validation 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓