ThreatRoundup

CVE Watch

Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.

All High & Critical Critical High Exploited (KEV) Public exploit

  • High CVSS 8.7 Remote Attacker DedeCMS

    CVE-2010-20125: DedeCMS (High, CVSS 8.7)

    DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply…

    Published Oct 30, 2026

  • Critical CVSS 9.3 Remote Attacker DedeCMS

    CVE-2021-48016: DedeCMS (Critical, CVSS 9.3)

    DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to…

    Published Oct 22, 2026