CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-118539: Drupal Commerce Core (Medium, CVSS 6.5)
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
-
CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software (High, CVSS 8.6)
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker…
-
CVE-2026-114820: Oracle Corporation Oracle Java SE (Critical, CVSS 9.1)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32,…
-
CVE-2026-106071: nodejs node (Low, CVSS 3.6)
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix…
-
CVE-2026-106073: nodejs node (Low, CVSS 3.3)
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running…
-
CVE-2026-106074: nodejs node (Medium, CVSS 4.8)
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If…
-
CVE-2026-106072: nodejs node (Medium, CVSS 6.7)
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`,…
-
CVE-2026-106070: nodejs node (Low, CVSS 3.7)
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is…
-
CVE-2026-106069: nodejs node (High, CVSS 7.4)
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a…
-
CVE-2026-105483: nodejs node (High, CVSS 7.4)
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters,…
-
CVE-2026-105482: nodejs node (High, CVSS 7.4)
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered…
-
CVE-2026-105481: nodejs node (Medium, CVSS 6.5)
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete…
-
CVE-2026-93489: ASUS Router (High, CVSS 8.7)
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the…
-
CVE-2026-75775: ASUS Router (High, CVSS 7.7)
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while…
-
CVE-2026-75779: ASUS Router (High, CVSS 8.6)
Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into…
-
CVE-2026-97631: TianoCore EDK2 (Critical, CVSS 9.5)
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead…
-
CVE-2026-111497: Google Brotli (Critical, CVSS 9.2)
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive…
-
CVE-2026-15723: GitLab (High, CVSS 8.2)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled,…
-
CVE-2026-110264: GitLab (Critical, CVSS 10)
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5…
-
CVE-2026-105777: GitLab (Medium, CVSS 4.3)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved…
-
CVE-2026-112212: GitLab (High, CVSS 7.5)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned…
-
CVE-2026-91403: Oracle Corporation Oracle Java SE (Critical, CVSS 9.1)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf,…
-
CVE-2026-109618: PHP Group PHP (Critical, CVSS 9.2)
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in…
-
CVE-2026-109619: PHP Group PHP (Critical, CVSS 9.2)
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may…
-
CVE-2026-111357: Ivanti Connect Secure (High, CVSS 7)
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
-
CVE-2026-102764: BeyondTrust Remote Support (Critical, CVSS 9.3)
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an…
-
CVE-2026-98432: Linux (Critical, CVSS 9.8)
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying…
-
CVE-2026-104935: Ivanti Connect Secure (High, CVSS 8.6)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
-
CVE-2026-97229: GitLab Community Edition and Enterprise Edition (Critical, CVSS 10)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user…
-
CVE-2026-88779: Citrix NetScaler (High, CVSS 8.7)
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
-
CVE-2026-86950: Apple Multiple Products (High, CVSS 8.8)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing…
-
CVE-2026-88771: Citrix NetScaler (Critical, CVSS 9.5)
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37…
-
CVE-2026-96654: Plex Media Server (Medium, CVSS 6.9)
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
-
CVE-2026-96655: Plex Media Server (Medium, CVSS 5.3)
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
-
CVE-2026-96652: Plex Media Server (Medium, CVSS 5.3)
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to…
-
CVE-2026-96656: Plex Media Server (High, CVSS 8.6)
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode.…
-
CVE-2026-80097: Microsoft Authenticator for Android (High, CVSS 8.6)
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
-
CVE-2026-82078: PaperCut NG/MF (Critical, CVSS 9.4)
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against…
-
CVE-2026-81578: PaperCut NG/MF (High, CVSS 8.8)
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to…
-
CVE-2026-30612 (Critical, CVSS 9.8)
An issue in Time4 Popcorn for Windows