CVE Watch

Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.

All High & Critical Critical High Exploited (KEV) Public exploit

  • High CVSS 7.7 EPSS 0.3% Remote Attacker KaringX

    CVE-2026-118682: KaringX clashmi (High, CVSS 7.7)

    KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve…

    Published Oct 28, 2026