CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-106071: nodejs node (Low, CVSS 3.6)
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix…
-
CVE-2026-106073: nodejs node (Low, CVSS 3.3)
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running…
-
CVE-2026-111357: Ivanti Connect Secure (High, CVSS 7)
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
-
CVE-2026-80097: Microsoft Authenticator for Android (High, CVSS 8.6)
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
-
CVE-2021-4034: Red Hat Polkit (High, CVSS 7.8)
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies.…
-
CVE-2022-21894: Microsoft Windows 10 Version 1809 (Medium, CVSS 4.4)
Secure Boot Security Feature Bypass Vulnerability