CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-119409: opnsense core (High, CVSS 8.6)
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit…
-
CVE-2026-97645: Gravity Forms (High, CVSS 7.2)
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This…
-
CVE-2026-90437: Gravity Forms (High, CVSS 7.2)
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1…
-
CVE-2026-89435: strategy11team Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder (High, CVSS 8.8)
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via…
-
CVE-2026-116622: wpscripts Food Store – Online Food Delivery & Pickup (High, CVSS 7.2)
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to…
-
CVE-2026-110732: tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (High, CVSS 7.5)
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to…
-
CVE-2026-103039: Gravity Forms (Critical, CVSS 9.8)
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is…
-
CVE-2026-103963: Red Hat Enterprise Linux 10 (High, CVSS 7.5)
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single…
-
CVE-2026-104368: webtoffee Export and Import Users and Customers (High, CVSS 8.8)
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The…
-
CVE-2026-118539: Drupal Commerce Core (Medium, CVSS 6.5)
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
-
CVE-2026-119325: Bricks Theme (High, CVSS 7.5)
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying…
-
CVE-2026-92092: Red Hat OpenShift Container Platform 4 (High, CVSS 7.4)
A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or…
-
CVE-2026-9536: vtk (High, CVSS 7.5)
A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file…
-
CVE-2026-9535: vtk (High, CVSS 8.2)
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to…
-
CVE-2026-8822: vtk (High, CVSS 7.5)
A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file…
-
CVE-2026-8824: vtk (High, CVSS 7.5)
A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file…
-
CVE-2026-41216: vtk (High, CVSS 7.5)
An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file…
-
CVE-2026-42057: vtk (High, CVSS 7.5)
An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file…
-
CVE-2026-96203: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-96196: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
-
CVE-2026-96198: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-96199: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-96187: Microsoft Edge (Chromium-based) (High, CVSS 7.4)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-96192: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
-
CVE-2026-93680: IBM Langflow OSS (Critical, CVSS 9.8)
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
-
CVE-2026-88077: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-85890: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-85897: Microsoft Edge (Chromium-based) (High, CVSS 8.8)
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
CVE-2026-85899: Microsoft Edge (Chromium-based) (High, CVSS 8.1)
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
-
CVE-2026-119144: frappe (High, CVSS 8.7)
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role…
-
CVE-2026-119145: frappe (Critical, CVSS 9.4)
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files…
-
CVE-2026-18894: IBM Langflow OSS (Critical, CVSS 9.8)
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the…
-
CVE-2026-119127: zitadel (High, CVSS 8.6)
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or…
-
CVE-2026-119128: zitadel (Critical, CVSS 9.1)
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute…
-
CVE-2026-119129: zitadel (High, CVSS 8.6)
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent.…
-
CVE-2026-119119: unclecode crawl4ai (High, CVSS 8.7)
Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can…
-
CVE-2026-119120: unclecode crawl4ai (High, CVSS 7.7)
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference…
-
CVE-2026-110309: IBM Langflow OSS (High, CVSS 8.8)
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.
-
CVE-2026-110193: IBM Langflow OSS (High, CVSS 8.8)
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting…
-
CVE-2026-110196: IBM Langflow OSS (High, CVSS 8.8)
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in…