CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-30612 (Critical, CVSS 9.8)
An issue in Time4 Popcorn for Windows
-
CVE-2026-41709: Broadcom VMware ESX (Low, CVSS 2.7)
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
-
CVE-2026-48356: Adobe Commerce and Magento (Critical, CVSS 9.3)
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access…
-
CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools (Critical, CVSS 9.8)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access…
-
CVE-2026-8467: phenixdigital phoenix_storybook (Critical, CVSS 9.5)
Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation. The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and…
-
CVE-2026-0257: Palo Alto Networks PAN-OS (High, CVSS 7.8)
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW…
-
CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager (Critical, CVSS 10)
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an…
-
CVE-2025-55182: Meta React Server Components (Critical, CVSS 10)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from…
-
CVE-2025-64446: Fortinet FortiWeb (Critical, CVSS 9.8)
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to…
-
CVE-2025-54236: Adobe Commerce and Magento (Critical, CVSS 9.1)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality,…
-
CVE-2024-40711: Veeam Backup & Replication (Critical, CVSS 9.8)
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
-
CVE-2024-40766: SonicWall SonicOS (Critical, CVSS 9.8)
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects…
-
CVE-2023-20269: Cisco Adaptive Security Appliance and Firepower Threat Defense (Critical, CVSS 9.1)
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute…
-
CVE-2022-48503: Apple Multiple Products (High, CVSS 8.8)
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead…
-
CVE-2023-30799: MikroTik RouterOS (High, CVSS 7.2)
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or…
-
CVE-2023-32315: Ignite Realtime Openfire (High, CVSS 7.5)
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment.…
-
CVE-2023-27532: Veeam Backup & Replication (High, CVSS 7.5)
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
-
CVE-2021-44228: Apache Log4j2 (Critical, CVSS 10)
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related…
-
CVE-2021-42287: Microsoft Active Directory (High, CVSS 7.5)
Active Directory Domain Services Elevation of Privilege Vulnerability
-
CVE-2021-42278: Microsoft Active Directory (High, CVSS 7.5)
Active Directory Domain Services Elevation of Privilege Vulnerability
-
CVE-2021-33044: Dahua IP Camera Firmware (Critical, CVSS 9.8)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
-
CVE-2021-33045: Dahua IP Camera Firmware (Critical, CVSS 9.8)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
-
CVE-2020-3259: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (High, CVSS 7.5)
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on…
-
CVE-2019-6693: Fortinet FortiOS (Medium, CVSS 6.5)
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge…