CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-118686: espocrm (High, CVSS 8.7)
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated…
-
CVE-2026-118688: bytecodealliance wasmtime (High, CVSS 8.8)
wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A…
-
CVE-2026-118679: n8n-io n8n (Medium, CVSS 6.9)
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing…
-
CVE-2026-118675: n8n-io n8n (Medium, CVSS 5.1)
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can…
-
CVE-2026-118676: n8n-io n8n (Medium, CVSS 5.1)
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows…
-
CVE-2026-118678: n8n-io n8n (High, CVSS 7.1)
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add…
-
CVE-2026-118648: n8n-io n8n (High, CVSS 8.4)
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox…
-
CVE-2026-118649: n8n-io n8n (High, CVSS 8.7)
n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the…
-
CVE-2026-118642: n8n-io n8n (Medium, CVSS 5.1)
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id…
-
CVE-2026-118643: n8n-io n8n (Medium, CVSS 5.3)
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes.…
-
CVE-2026-118644: n8n-io n8n (Medium, CVSS 5.1)
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor…
-
CVE-2026-118645: n8n-io n8n (High, CVSS 7)
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw…
-
CVE-2026-118647: n8n-io n8n (Medium, CVSS 5.3)
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can…
-
CVE-2026-118641: n8n-io n8n (Medium, CVSS 6.9)
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter…
-
CVE-2026-84725: Red Hat JBoss Enterprise Application Platform 7 (High, CVSS 8.1)
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL…
-
CVE-2026-106079: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write…
-
CVE-2026-103410: Juniper Networks Session Smart Router (High, CVSS 7.5)
An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server…
-
CVE-2026-103409: Juniper Networks Session Smart Router (Critical, CVSS 9.8)
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running…
-
CVE-2026-103407: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or…
-
CVE-2026-103406: Juniper Networks Session Smart Conductor (Critical, CVSS 9.8)
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via…
-
CVE-2026-103402: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute…
-
CVE-2026-103403: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform…
-
CVE-2026-103401: Juniper Networks Session Smart Router (High, CVSS 8.8)
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to…
-
CVE-2026-67187: Saturday Drive Ninja Forms (Medium, CVSS 5.1)
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields…
-
CVE-2026-92797: Memberpress (High, CVSS 8.8)
The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that…
-
CVE-2026-111111: bdthemes Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons (High, CVSS 7.2)
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and…
-
CVE-2026-111120: e4jvikwp VikRentCar Car Rental Management System (High, CVSS 8.8)
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation…
-
CVE-2026-110662: MxChat – AI Chatbot & Content Generation for WordPress (High, CVSS 7.2)
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25…
-
CVE-2026-109218: kleor Contact Manager (Critical, CVSS 9.8)
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist…
-
CVE-2026-109381: magepeopleteam Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (High, CVSS 7.2)
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever…
-
CVE-2026-109384: melograno The Innovative Form Builder – IvyForms (High, CVSS 8.8)
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to…
-
CVE-2026-15323: King-Theme Product Designer for WooCommerce WordPress | Lumise (High, CVSS 7.5)
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible…
-
CVE-2026-1928: rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (High, CVSS 8.8)
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of…
-
CVE-2026-116613: bplugins Animated Text Block – Add Typing and Looping Text Effects (High, CVSS 7.5)
The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching…
-
CVE-2026-111255: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (High, CVSS 7.5)
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is…
-
CVE-2026-84999: Pie Register Premium (Critical, CVSS 9.8)
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin…
-
CVE-2026-97019: mohammed_kaludi AMP for WP – Accelerated Mobile Pages (High, CVSS 7.2)
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient…
-
CVE-2026-118375: ggml-org llama.cpp (Critical, CVSS 9.2)
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO…
-
CVE-2026-118377: mewebstudio pos (High, CVSS 8.7)
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host…
-
CVE-2026-117607: thexerteproject xerteonlinetoolkits (High, CVSS 8.6)
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP…