CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-116724: fltk (High, CVSS 8.5)
FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large…
-
CVE-2026-116723: fltk (High, CVSS 8.5)
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files…
-
CVE-2026-116116: Yoosee GM8135S Camera (High, CVSS 8.4)
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs…
-
CVE-2026-106071: nodejs node (Low, CVSS 3.6)
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix…
-
CVE-2026-106073: nodejs node (Low, CVSS 3.3)
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running…
-
CVE-2026-115726: Aider-AI aider (High, CVSS 8.5)
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or…
-
CVE-2026-115504: HEASARC cfitsio (High, CVSS 8.5)
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a…
-
CVE-2026-114663: vyperlang vyper (High, CVSS 8.6)
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter,…
-
CVE-2026-111357: Ivanti Connect Secure (High, CVSS 7)
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
-
CVE-2026-110936: Siemens Software Center (High, CVSS 8.4)
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker…
-
CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition (High, CVSS 8.5)
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
-
CVE-2026-80097: Microsoft Authenticator for Android (High, CVSS 8.6)
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
-
CVE-2026-46300: Linux Kernel (High, CVSS 7.8)
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the…
-
CVE-2021-4034: Red Hat Polkit (High, CVSS 7.8)
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies.…
-
CVE-2022-21894: Microsoft Windows 10 Version 1809 (Medium, CVSS 4.4)
Secure Boot Security Feature Bypass Vulnerability