CVE Watch
Every new High and Critical vulnerability, updated automatically from NVD, FIRST EPSS and CISA’s Known Exploited Vulnerabilities list, with whether public exploit code exists. Critical CVEs and exploited Highs are also posted to Bluesky as they appear.
All High & Critical Critical High Exploited (KEV) Public exploit
-
CVE-2026-112330: GDATASoftwareAG motornet (High, CVSS 8.7)
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted…
-
CVE-2026-112331: GDATASoftwareAG motornet (High, CVSS 8.7)
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By…
-
CVE-2026-112332: GDATASoftwareAG motornet (High, CVSS 8.7)
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally…
-
CVE-2026-115392: bytecodealliance wasmtime (High, CVSS 8.8)
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and…
-
CVE-2026-115384: bytecodealliance wasmtime (Critical, CVSS 9.4)
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers…
-
CVE-2026-115375: lxc incus (Critical, CVSS 9.4)
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent…
-
CVE-2026-115376: lxc incus (High, CVSS 8.3)
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom…
-
CVE-2026-115377: lxc incus (Critical, CVSS 9.4)
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers…
-
CVE-2026-115371: lxc incus (High, CVSS 7.1)
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can…
-
CVE-2026-115372: lxc incus (Critical, CVSS 9)
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a…
-
CVE-2026-115374: lxc incus (High, CVSS 7.1)
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an…
-
CVE-2026-115355: lepture mistune (High, CVSS 8.7)
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through…
-
CVE-2026-115352: lepture mistune (High, CVSS 8.7)
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small…
-
CVE-2026-115353: lepture mistune (Critical, CVSS 9.2)
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include…
-
CVE-2026-115347: lepture mistune (High, CVSS 8.7)
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of…
-
CVE-2026-115348: lepture mistune (High, CVSS 8.7)
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing…
-
CVE-2026-115349: lepture mistune (High, CVSS 8.7)
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time,…
-
CVE-2022-51026: bytebase (Critical, CVSS 9.3)
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST…
-
CVE-2026-97631: TianoCore EDK2 (Critical, CVSS 9.5)
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead…
-
CVE-2026-115513: OpenCATS (Medium, CVSS 6.3)
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which…
-
CVE-2026-104068: JetBackup (High, CVSS 8.6)
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import…
-
CVE-2026-111497: Google Brotli (Critical, CVSS 9.2)
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive…
-
CVE-2026-115330: uselotus lotus (High, CVSS 8.7)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST…
-
CVE-2026-115331: uselotus lotus (High, CVSS 8.7)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values…
-
CVE-2026-115332: uselotus lotus (High, CVSS 8.7)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key,…
-
CVE-2026-115323: evershopcommerce evershop (Medium, CVSS 6.9)
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send…
-
CVE-2026-115324: mem0ai mem0 (Critical, CVSS 9.2)
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names…
-
CVE-2026-115325: gravitl netmaker (High, CVSS 8.7)
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can…
-
CVE-2026-115328: riclolsen json-scada (High, CVSS 8.7)
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime…
-
CVE-2026-111079: Red Hat Enterprise Linux 10 (High, CVSS 7.4)
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider…
-
CVE-2024-58396: YouDataSum CPAS Audit Management System (High, CVSS 8.7)
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with…
-
CVE-2025-71434: Weaver Network Co., Ltd. E-cology (High, CVSS 8.8)
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields…
-
CVE-2022-51022: liukuo362573 YiShaAdmin (High, CVSS 8.8)
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers…
-
CVE-2022-51023: PHPOK (High, CVSS 8.8)
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads…
-
CVE-2022-51024: Kareadita Kavita (High, CVSS 8.7)
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload…
-
CVE-2024-58393: i-Netsolution Readymade Unilevel Ecommerce MLM (High, CVSS 8.8)
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with…
-
CVE-2021-48013: Weaver Network Co., Ltd. E-cology (High, CVSS 8.7)
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory…
-
CVE-2021-48014: FanRuan FineReport (Critical, CVSS 9.3)
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory…
-
CVE-2021-48015: erzhongxmu JeeWMS (High, CVSS 8.7)
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences…
-
CVE-2021-48016: DedeCMS (Critical, CVSS 9.3)
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to…