CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2025-64446: Fortinet FortiWeb (Critical, CVSS 9.8)
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to…
-
CVE-2025-54236: Adobe Commerce and Magento (Critical, CVSS 9.1)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality,…
-
CVE-2024-40711: Veeam Backup & Replication (Critical, CVSS 9.8)
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
-
CVE-2024-40766: SonicWall SonicOS (Critical, CVSS 9.8)
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects…
-
CVE-2023-20269: Cisco Adaptive Security Appliance and Firepower Threat Defense (Critical, CVSS 9.1)
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute…
-
CVE-2023-30799: MikroTik RouterOS (High, CVSS 7.2)
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or…
-
CVE-2023-32315: Ignite Realtime Openfire (High, CVSS 7.5)
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment.…
-
CVE-2023-27532: Veeam Backup & Replication (High, CVSS 7.5)
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
-
CVE-2021-42287: Microsoft Active Directory (High, CVSS 7.5)
Active Directory Domain Services Elevation of Privilege Vulnerability
-
CVE-2021-42278: Microsoft Active Directory (High, CVSS 7.5)
Active Directory Domain Services Elevation of Privilege Vulnerability
-
CVE-2021-33044: Dahua IP Camera Firmware (Critical, CVSS 9.8)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
-
CVE-2021-33045: Dahua IP Camera Firmware (Critical, CVSS 9.8)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
-
CVE-2020-3259: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (High, CVSS 7.5)
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on…
-
CVE-2019-6693: Fortinet FortiOS (Medium, CVSS 6.5)
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge…