CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-96894: wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce (High, CVSS 7.2)
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10…
-
CVE-2026-97638: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder (High, CVSS 7.5)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the…
-
CVE-2026-76012: smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (High, CVSS 7.5)
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This…
-
CVE-2026-119978: FlowiseAI Flowise (Critical, CVSS 9)
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that…
-
CVE-2026-119979: Element Labs LM Studio (High, CVSS 8.7)
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users…
-
CVE-2026-119619: 37954679 cak-filemanagement-system (Medium, CVSS 5.5)
A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack…
-
CVE-2026-119620: 37954679 cak-filemanagement-system (Medium, CVSS 5.5)
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload.…
-
CVE-2026-119760: dlundquist sniproxy (High, CVSS 8.7)
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character…
-
CVE-2026-119762: Axigen Mail Server (High, CVSS 8.7)
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before…
-
CVE-2026-118205: wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets (High, CVSS 7.4)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of…
-
CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce (High, CVSS 8.1)
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due…
-
CVE-2026-112365: wpdevteam easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution (High, CVSS 7.2)
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up…
-
CVE-2026-110305: hwk-fr Advanced Custom Fields: Extended (High, CVSS 7.5)
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers…
-
CVE-2026-107630: saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce (High, CVSS 7.5)
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin…
-
CVE-2026-105894: akbilisim Ak Framework (High, CVSS 8.8)
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is…
-
CVE-2026-104744: Independent Analytics Pro (High, CVSS 7.2)
The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output…
-
CVE-2025-8574: tigroumeow Database Cleaner: Cleanup, Optimization & Repair (High, CVSS 8.7)
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that…
-
CVE-2026-119716: wbond pybars3 (Critical, CVSS 9.2)
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in…
-
CVE-2026-119717: up9inc pybars4 (Critical, CVSS 9.2)
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a…
-
CVE-2026-119710: pipeshub-ai (High, CVSS 7.1)
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send…
-
CVE-2026-119713: paperclipai @paperclipai/server (High, CVSS 8.7)
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these…
-
CVE-2026-119706: InternLM lmdeploy (Critical, CVSS 9.3)
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a…
-
CVE-2026-119707: SonicJs-Org sonicjs (High, CVSS 7.1)
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API…
-
CVE-2026-119660: yincongcyincong MuseBot (Critical, CVSS 9.3)
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id…
-
CVE-2026-119654: devlive-community DataCap (High, CVSS 8.7)
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests…
-
CVE-2026-119655: CoreUnion CoreShop (High, CVSS 8.7)
CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and…
-
CVE-2026-119656: CoreUnion CoreShop (High, CVSS 8.7)
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass…
-
CVE-2026-119649: OrchardCMS Orchard (High, CVSS 7.1)
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media…
-
CVE-2010-20125: DedeCMS (High, CVSS 8.7)
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply…
-
CVE-2026-119597: AIDotNet OpenDeepWiki (Critical, CVSS 9.3)
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with…
-
CVE-2026-119572: traefik (High, CVSS 7)
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on…
-
CVE-2026-112347: Themeum Kirki (High, CVSS 7.2)
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php…
-
CVE-2026-119568: vsftpd (Critical, CVSS 9.1)
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP…
-
CVE-2026-119549: jellyfin (High, CVSS 7.1)
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST…
-
CVE-2026-119426: phpMyAdmin (High, CVSS 7.7)
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into…
-
CVE-2026-119418: cakephp (Critical, CVSS 9.2)
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications…
-
CVE-2026-119419: cakephp (Critical, CVSS 9.2)
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor…
-
CVE-2026-119420: getlago lago (High, CVSS 8.7)
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's…
-
CVE-2026-119407: element-hq element-web (High, CVSS 7.1)
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in…
-
CVE-2026-119408: n8n-io n8n (High, CVSS 8.7)
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users…