ThreatRoundup

CVE Watch

Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.

All High & Critical Critical High Exploited (KEV) Public exploit

  • High CVSS 8.6 EPSS 2.1% Remote Attacker Dolibarr

    CVE-2026-116219: dolibarr (High, CVSS 8.6)

    Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters…

    Published Oct 26, 2026

  • High CVSS 7.2 EPSS 0.3% Remote Attacker Dolibarr

    CVE-2026-116218: dolibarr (High, CVSS 7.2)

    Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only…

    Published Oct 26, 2026