pwned.coffeeUpdated 17 min ago

Past orders

Things that were on fire and have since been put out, or at least stopped making the news.

Showing everything. Tell us your usual to see only what can hurt you.

December 2025

  1. Gladinet CentreStack And Triofox Hard Coded Cryptographic 🔥 On the fly · exploited
    Fixed in 16.12.10420.56791
    Under the heat lamp: 313 days KEV ✓ Record ✓ Vendor ✓
  2. Apple Safari Apple Multiple Products Use-After-Free WebKit 🔥 On the fly · exploited
    Fixed in Safari 26.2, iOS and iPadOS 26.2 +5
    Under the heat lamp: 313 days KEV ✓ Record ✓ Vendor ✓
  3. Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-12-12)
    Do now Sierra Wireless recommends users upgrade to the latest version of ALEOS for the products and versions below.
    Under the heat lamp: 316 days KEV ✓ Record ✓ Vendor –
  6. RARLAB WinRAR Path Traversal 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-12-09)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  7. Windows Microsoft Windows Use After Free 🔥 On the fly · exploited
    Fixed in Windows 10 Version 1809 10.0.17763.8146, Windows 10 Version 21H2 10.0.19044.6691 +11
    Under the heat lamp: 319 days KEV ✓ Record ✓ Vendor ✓
  8. D-Link Routers Buffer Overflow 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-12-08)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  9. Array Networks ArrayOS AG OS Command Injection 🔥 On the fly · exploited
    Fixed in 9.4.5.9
    Under the heat lamp: 320 days KEV ✓ Record ✓ Vendor ✓
  10. Meta react-server-dom-webpack Meta React Server Components Remote Code Execution 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  11. OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-12-03)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  12. Google Android Android Framework Information Disclosure 🔥 On the fly · exploited
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓

November 2025

  1. OpenPLC ScadaBR Cross-site Scripting 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-11-28)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  2. Oracle Identity Manager Oracle Fusion Middleware Missing Authentication for Critical Function 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-11-21)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  3. Chrome Google Chromium V8 Type Confusion 🔥 On the fly · exploited
    Fixed in 142.0.7444.175
    Under the heat lamp: 339 days KEV ✓ Record ✓ Vendor ✓
  4. Fortinet FortiWeb OS Command Injection 🔥 On the fly · exploited
    Fixed in 8.0.2, 7.6.6 +3
    Under the heat lamp: 340 days KEV ✓ Record ✓ Vendor ✓
  5. Fortinet FortiWeb Path Traversal 🔥 On the fly · exploited
    Fixed in 8.0.2, 7.6.5 +3
    Under the heat lamp: 344 days KEV ✓ Record ✓ Vendor ✓
  6. TrioFox Gladinet Triofox Improper Access Control 🔥 On the fly · exploited
    Fixed in 16.7.10368.56560
    Under the heat lamp: 346 days KEV ✓ Record ✓ Vendor ✓
  7. Windows Microsoft Windows Race Condition 🔥 On the fly · exploited
    Fixed in Windows 10 Version 1809 10.0.17763.8027, Windows 10 Version 21H2 10.0.19044.6575 +11
    Under the heat lamp: 346 days KEV ✓ Record ✓ Vendor ✓
  8. WatchGuard Fireware OS WatchGuard Firebox Out-of-Bounds Write 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-11-12)
    Fixed in 2025.1.1, 12.11.4 +2
    Under the heat lamp: 346 days KEV ✓ Record ✓ Vendor ✓
  9. Samsung Mobile Devices Out-of-Bounds Write 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-11-10)
    Fixed in SMR Apr-2025 Release in Android 13, 15 +1
    Under the heat lamp: 348 days KEV ✓ Record ✓ Vendor ✓
  10. centos-webpanel CentOS Web Panel CWP Control Web Panel OS Command Injection 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-11-04)
    Fixed in 0.9.8.1205
    Under the heat lamp: 354 days KEV ✓ Record ✓ Vendor ✓
  11. Gladinet CentreStack And Triofox Files or Directories Accessible to External Parties 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-11-04)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓

October 2025

  2. xwiki-platform XWiki Platform Eval Injection 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-10-30)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor –
  3. Dassault Systèmes DELMIA Apriso Code Injection 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-10-28)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓
  4. Adobe Commerce And Magento Improper Input Validation 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2025-10-24)
    Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 14:38 UTC.
    KEV ✓ Record ✓ Vendor ✓