CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-116050: krupalshah Employee Recruitment System (Medium, CVSS 5.5)
A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail…
-
CVE-2026-116048: krupalshah EmployeeRecruitmentSystem (Medium, CVSS 5.5)
A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument…
-
CVE-2026-116006: YunaiV ruoyi-vue-pro (Medium, CVSS 5.5)
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument…
-
CVE-2026-116000: Zylon PrivateGPT (Medium, CVSS 5.5)
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument…
-
CVE-2026-115999: mansi-k Restaurant_IMS (Medium, CVSS 6.9)
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the…
-
CVE-2026-115995: Unitree Robotics Unitree Go2 (Critical, CVSS 9.4)
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of…
-
CVE-2026-114820: Oracle Corporation Oracle Java SE (Critical, CVSS 9.1)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32,…
-
CVE-2026-115973: FaveoSuite Faveo Helpdesk (Medium, CVSS 6.9)
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be…
-
CVE-2026-115970: Travisun Opptrix (Medium, CVSS 5.5)
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible…
-
CVE-2026-115969: Travisun Opptrix (Medium, CVSS 5.5)
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to…
-
CVE-2026-116019: getgrav grav (High, CVSS 8.7)
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission…
-
CVE-2026-116011: CrowCpp Crow (High, CVSS 8.7)
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands…
-
CVE-2026-116014: open62541 (Critical, CVSS 9.2)
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(),…
-
CVE-2026-116016: YunaiV yudao-cloud (High, CVSS 7.1)
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to…
-
CVE-2026-116009: owen2345 camaleon-cms (High, CVSS 8.7)
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send…
-
CVE-2026-110018: kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder (High, CVSS 8.8)
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via…
-
CVE-2026-115807: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (High, CVSS 7.1)
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3.…
-
CVE-2026-115806: codexonics Prime Mover – Backup and Migration (Critical, CVSS 9.8)
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration…
-
CVE-2026-112342: Tandoor Recipes (High, CVSS 7.1)
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user…
-
CVE-2026-115810: TandoorRecipes recipes (Medium, CVSS 6.3)
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external…
-
CVE-2026-106074: nodejs node (Medium, CVSS 4.8)
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If…
-
CVE-2026-106072: nodejs node (Medium, CVSS 6.7)
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`,…
-
CVE-2026-105481: nodejs node (Medium, CVSS 6.5)
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete…
-
CVE-2026-105482: nodejs node (High, CVSS 7.4)
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered…
-
CVE-2026-105483: nodejs node (High, CVSS 7.4)
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters,…
-
CVE-2026-106069: nodejs node (High, CVSS 7.4)
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a…
-
CVE-2026-106070: nodejs node (Low, CVSS 3.7)
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is…
-
CVE-2026-57845: huggingface datasets (High, CVSS 8.7)
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers…
-
CVE-2026-115728: hapijs @hapi/content (High, CVSS 8.7)
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long…
-
CVE-2026-115727: Fosowl AgenticSeek (Critical, CVSS 9.2)
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug…
-
CVE-2026-115723: davenardella snap7 (High, CVSS 8.3)
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from…
-
CVE-2026-75779: ASUS Router (High, CVSS 8.6)
Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into…
-
CVE-2026-115497: codepeople Music Store – WordPress eCommerce (High, CVSS 7.5)
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for…
-
CVE-2026-109198: CleanTalk Anti-Spam – Complete Spam Protection (High, CVSS 7.2)
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to…
-
CVE-2026-97785: Microsoft Entra application proxy (Critical, CVSS 10)
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-83938: Microsoft Azure Kubernetes Configuration Service (Critical, CVSS 10)
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
-
CVE-2026-108456: Microsoft Azure AI Foundry (High, CVSS 7.7)
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
-
CVE-2026-114625: Arista VeloCloud Orchestrator (Critical, CVSS 9.4)
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality,…
-
CVE-2026-115505: sahlberg libsmb2 (High, CVSS 7.2)
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send…
-
CVE-2026-115506: libexpat (High, CVSS 8.7)
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a…