CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to X and Bluesky as they appear.
-
High CVSS 8.7
CVE-2022-51024: Kareadita Kavita (High, CVSS 8.7)
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload…
-
High CVSS 8.8
CVE-2022-51023: PHPOK (High, CVSS 8.8)
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads…
-
High CVSS 8.8
CVE-2022-51022: liukuo362573 YiShaAdmin (High, CVSS 8.8)
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers…
-
High CVSS 8.8
CVE-2022-51021: WPDeveloper NotificationX (High, CVSS 8.8)
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass…
-
High CVSS 8.7
CVE-2021-48017: OrbiTeam BSCW Server (High, CVSS 8.7)
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/?op=theme with…
-
Critical CVSS 9.3
CVE-2021-48016: DedeCMS (Critical, CVSS 9.3)
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to…
-
High CVSS 8.7
CVE-2021-48015: erzhongxmu JeeWMS (High, CVSS 8.7)
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences…
-
Critical CVSS 9.3
CVE-2021-48014: FanRuan FineReport (Critical, CVSS 9.3)
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory…
-
High CVSS 8.7
CVE-2021-48013: Weaver Network Co., Ltd. E-cology (High, CVSS 8.7)
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory…
-
High CVSS 8.7
CVE-2019-25779: WooThemes Diarise (High, CVSS 8.7)
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths…
-
High CVSS 8.8
CVE-2019-25778: SeaCMS (High, CVSS 8.8)
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php…
-
High CVSS 8.7
CVE-2018-25439: MetInfo (High, CVSS 8.7)
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences…
-
High CVSS 8.7
CVE-2018-25438: Intermesh Group-Office (High, CVSS 8.7)
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to…
-
High CVSS 7.7
CVE-2017-20289: Broadstreet Ad Widget (High, CVSS 7.7)
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php.…
-
High CVSS 8.7
CVE-2017-20287: Javo Themes Javo Spot (High, CVSS 8.7)
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send…
-
Medium CVSS 5.9 EPSS 0.3%
CVE-2026-114221: NewType Infortech NT OneAPP (Medium, CVSS 5.9)
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby…
-
High CVSS 7.1 EPSS 0.2%
CVE-2026-114664: frappe (High, CVSS 7.1)
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted…
-
High CVSS 8.6 EPSS 0.1%
CVE-2026-114663: vyperlang vyper (High, CVSS 8.6)
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter,…
-
High CVSS 8.6 EPSS 0.2%
CVE-2026-114662: obot-platform obot (High, CVSS 8.6)
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request…
-
Critical CVSS 9 EPSS 0.2%
CVE-2026-114661: openremote (Critical, CVSS 9)
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or…
-
High CVSS 8.7 EPSS 0.3%
CVE-2026-114658: getgrav grav-plugin-login (High, CVSS 8.7)
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting…
-
Medium CVSS 6.9 EPSS 0.2%
CVE-2026-114656: traefik (Medium, CVSS 6.9)
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected…
-
High CVSS 7 EPSS 0.2%
CVE-2026-114642: traefik (High, CVSS 7)
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another…
-
High CVSS 7 EPSS 0.2%
CVE-2026-114640: traefik (High, CVSS 7)
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated…
-
High CVSS 7 EPSS 0.3%
CVE-2026-114639: traefik (High, CVSS 7)
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool,…
-
High CVSS 7 EPSS 0.2%
CVE-2026-114638: traefik (High, CVSS 7)
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's…
-
High CVSS 7 EPSS 0.3%
CVE-2026-114637: traefik (High, CVSS 7)
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed…
-
High CVSS 7 EPSS 0.3%
CVE-2026-114636: traefik (High, CVSS 7)
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations.…
-
High CVSS 7 EPSS 0.2%
CVE-2026-114635: traefik (High, CVSS 7)
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme…
-
Medium CVSS 5.5 EPSS 0.3%
CVE-2026-114577: oretnom23 php-travel-agency-system (Medium, CVSS 5.5)
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The…
-
High CVSS 8.2 EPSS 0.3%
CVE-2026-15723: GitLab (High, CVSS 8.2)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled,…
-
Critical CVSS 9.3 EPSS 2.2%
CVE-2026-114575: TOTOLINK A950RG (Critical, CVSS 9.3)
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command…
-
High CVSS 7.5 EPSS 0.2%
CVE-2026-112212: GitLab (High, CVSS 7.5)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned…
-
Critical CVSS 10 Public exploit EPSS 0.5%
CVE-2026-110264: GitLab (Critical, CVSS 10)
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5…
-
Medium CVSS 4.3 EPSS 0.3%
CVE-2026-105777: GitLab (Medium, CVSS 4.3)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved…
-
Critical CVSS 9.2 Public exploit EPSS 5.8%
CVE-2026-109619: PHP Group PHP (Critical, CVSS 9.2)
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may…
-
Critical CVSS 9.2 Public exploit EPSS 5.3%
CVE-2026-109618: PHP Group PHP (Critical, CVSS 9.2)
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in…
-
Critical CVSS 9.3 KEV Public exploit EPSS 1.2%
CVE-2026-102764: BeyondTrust Remote Support (Critical, CVSS 9.3)
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an…
-
High CVSS 8.4 KEV Public exploit EPSS 0.2%
CVE-2026-110936: Siemens Software Center (High, CVSS 8.4)
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker…
-
High CVSS 8.5 KEV EPSS 1.2%
CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition (High, CVSS 8.5)
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.