CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to X and Bluesky as they appear.
-
High CVSS 7.1
CVE-2026-115486: Red Hat Enterprise Linux 10 (High, CVSS 7.1)
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP…
-
High CVSS 7.6
CVE-2026-115484: Red Hat Enterprise Linux 10 (High, CVSS 7.6)
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent…
-
Critical CVSS 10
CVE-2026-97785: Microsoft Entra application proxy (Critical, CVSS 10)
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
-
Critical CVSS 10
CVE-2026-83938: Microsoft Azure Kubernetes Configuration Service (Critical, CVSS 10)
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
-
High CVSS 7.7
CVE-2026-108456: Microsoft Azure AI Foundry (High, CVSS 7.7)
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
-
High CVSS 8.7
CVE-2026-115506: libexpat (High, CVSS 8.7)
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a…
-
High CVSS 7.2
CVE-2026-115505: sahlberg libsmb2 (High, CVSS 7.2)
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send…
-
High CVSS 8.5
CVE-2026-115504: HEASARC cfitsio (High, CVSS 8.5)
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a…
-
High CVSS 8.7
CVE-2026-112332: GDATASoftwareAG motornet (High, CVSS 8.7)
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally…
-
High CVSS 8.7
CVE-2026-112331: GDATASoftwareAG motornet (High, CVSS 8.7)
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By…
-
High CVSS 8.7
CVE-2026-112330: GDATASoftwareAG motornet (High, CVSS 8.7)
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted…
-
High CVSS 8.8
CVE-2026-115392: bytecodealliance wasmtime (High, CVSS 8.8)
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and…
-
Critical CVSS 9.4
CVE-2026-115384: bytecodealliance wasmtime (Critical, CVSS 9.4)
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers…
-
Critical CVSS 9.4
CVE-2026-115377: lxc incus (Critical, CVSS 9.4)
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers…
-
High CVSS 8.3
CVE-2026-115376: lxc incus (High, CVSS 8.3)
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom…
-
Critical CVSS 9.4
CVE-2026-115375: lxc incus (Critical, CVSS 9.4)
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent…
-
High CVSS 7.1
CVE-2026-115374: lxc incus (High, CVSS 7.1)
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an…
-
Critical CVSS 9
CVE-2026-115372: lxc incus (Critical, CVSS 9)
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a…
-
High CVSS 7.1
CVE-2026-115371: lxc incus (High, CVSS 7.1)
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can…
-
High CVSS 8.7
CVE-2026-115355: lepture mistune (High, CVSS 8.7)
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through…
-
Critical CVSS 9.2
CVE-2026-115353: lepture mistune (Critical, CVSS 9.2)
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include…
-
High CVSS 8.7
CVE-2026-115352: lepture mistune (High, CVSS 8.7)
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small…
-
High CVSS 8.7
CVE-2026-115349: lepture mistune (High, CVSS 8.7)
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time,…
-
High CVSS 8.7
CVE-2026-115348: lepture mistune (High, CVSS 8.7)
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing…
-
High CVSS 8.7
CVE-2026-115347: lepture mistune (High, CVSS 8.7)
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of…
-
Critical CVSS 9.3
CVE-2022-51026: bytebase (Critical, CVSS 9.3)
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST…
-
Medium CVSS 6.3
CVE-2026-115513: OpenCATS (Medium, CVSS 6.3)
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which…
-
High CVSS 8.6 Public exploit
CVE-2026-104068: JetBackup (High, CVSS 8.6)
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import…
-
Critical CVSS 9.2 Public exploit
CVE-2026-111497: Google Brotli (Critical, CVSS 9.2)
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive…
-
High CVSS 8.7
CVE-2026-115332: uselotus lotus (High, CVSS 8.7)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key,…
-
High CVSS 8.7
CVE-2026-115331: uselotus lotus (High, CVSS 8.7)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values…
-
High CVSS 8.7
CVE-2026-115330: uselotus lotus (High, CVSS 8.7)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST…
-
High CVSS 8.7
CVE-2026-115328: riclolsen json-scada (High, CVSS 8.7)
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime…
-
High CVSS 8.7
CVE-2026-115325: gravitl netmaker (High, CVSS 8.7)
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can…
-
Critical CVSS 9.2
CVE-2026-115324: mem0ai mem0 (Critical, CVSS 9.2)
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names…
-
Medium CVSS 6.9
CVE-2026-115323: evershopcommerce evershop (Medium, CVSS 6.9)
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send…
-
High CVSS 7.4
CVE-2026-111079: Red Hat Enterprise Linux 10 (High, CVSS 7.4)
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider…
-
High CVSS 8.8
CVE-2025-71434: Weaver Network Co., Ltd. E-cology (High, CVSS 8.8)
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields…
-
High CVSS 8.7
CVE-2024-58396: YouDataSum CPAS Audit Management System (High, CVSS 8.7)
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with…
-
High CVSS 8.8
CVE-2024-58393: i-Netsolution Readymade Unilevel Ecommerce MLM (High, CVSS 8.8)
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with…