https://stackwatch.de/en/live Actively exploited vulnerabilities (CISA KEV) and critical package advisories (GitHub), updated daily. en-US Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-110447 https://stackwatch.de/en/live#cve-2026-110447 Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-114625 https://stackwatch.de/en/live#cve-2026-114625 Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-112398 https://stackwatch.de/en/live#cve-2026-112398 Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-114509 https://stackwatch.de/en/live#cve-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-115889 https://stackwatch.de/en/live#cve-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-77363 https://stackwatch.de/en/live#cve-2026-77363 obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-77366 https://stackwatch.de/en/live#cve-2026-77366 obsidian-tc tokens can access arbitrary configured vaults Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#ghsa-cxf3-9h37-7rr8 https://stackwatch.de/en/live#ghsa-cxf3-9h37-7rr8 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls Fri, 23 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-114139 https://stackwatch.de/en/live#cve-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route Thu, 22 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-115324 https://stackwatch.de/en/live#cve-2026-115324 mem0ai Databricks vector store vulnerable to SQL injection Thu, 22 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-96639 https://stackwatch.de/en/live#cve-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions Thu, 22 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#ghsa-2464-fhr4-w9xw https://stackwatch.de/en/live#ghsa-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used Thu, 22 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#ghsa-673q-mjm6-r5xr https://stackwatch.de/en/live#ghsa-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays Thu, 22 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#ghsa-9v8h-qqgm-4m35 https://stackwatch.de/en/live#ghsa-9v8h-qqgm-4m35 Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package Thu, 22 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#ghsa-cg2g-xh64-v4q7 https://stackwatch.de/en/live#ghsa-cg2g-xh64-v4q7 DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes Thu, 22 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-112393 https://stackwatch.de/en/live#cve-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Wed, 21 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-112900 https://stackwatch.de/en/live#cve-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Wed, 21 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-114125 https://stackwatch.de/en/live#cve-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites Wed, 21 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-106931 https://stackwatch.de/en/live#cve-2026-106931 EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-110936 https://stackwatch.de/en/live#cve-2026-110936 Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-96652 https://stackwatch.de/en/live#cve-2026-96652 Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-96654 https://stackwatch.de/en/live#cve-2026-96654 Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-96655 https://stackwatch.de/en/live#cve-2026-96655 Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-96656 https://stackwatch.de/en/live#cve-2026-96656 Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-112403 https://stackwatch.de/en/live#cve-2026-112403 Pillow: Heap buffer overflow in ImagingJpegDecode Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#ghsa-6q48-6c7w-9gw2 https://stackwatch.de/en/live#ghsa-6q48-6c7w-9gw2 certifi bundles emSign root CAs with compromised intermediate CA keys Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#ghsa-hq85-5cpj-mr62 https://stackwatch.de/en/live#ghsa-hq85-5cpj-mr62 uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised Tue, 20 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-111057 https://stackwatch.de/en/live#cve-2026-111057 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass Mon, 19 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-111058 https://stackwatch.de/en/live#cve-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels Mon, 19 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2025-61624 https://stackwatch.de/en/live#cve-2025-61624 FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Fri, 16 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-102764 https://stackwatch.de/en/live#cve-2026-102764 BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Fri, 16 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-105192 https://stackwatch.de/en/live#cve-2026-105192 LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport Fri, 16 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-96620 https://stackwatch.de/en/live#cve-2026-96620 Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Fri, 16 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-21589 https://stackwatch.de/en/live#cve-2026-21589 Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Thu, 15 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-102748 https://stackwatch.de/en/live#cve-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service Thu, 15 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-102989 https://stackwatch.de/en/live#cve-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses Thu, 15 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-104252 https://stackwatch.de/en/live#cve-2026-104252 Vitess vttablet /twopcz reflected XSS Thu, 15 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-77459 https://stackwatch.de/en/live#cve-2026-77459 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks Thu, 15 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-77524 https://stackwatch.de/en/live#cve-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication Thu, 15 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-94603 https://stackwatch.de/en/live#cve-2026-94603 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation Thu, 15 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-0322 https://stackwatch.de/en/live#cve-2026-0322 Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Wed, 14 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-105133 https://stackwatch.de/en/live#cve-2026-105133 Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. Wed, 14 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-105134 https://stackwatch.de/en/live#cve-2026-105134 Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Wed, 14 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-76519 https://stackwatch.de/en/live#cve-2026-76519 Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Wed, 14 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-104935 https://stackwatch.de/en/live#cve-2026-104935 Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Tue, 13 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-96951 https://stackwatch.de/en/live#cve-2026-96951 Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. Tue, 13 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-105016 https://stackwatch.de/en/live#cve-2026-105016 Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability Tue, 13 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-70188 https://stackwatch.de/en/live#cve-2026-70188 Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability Tue, 13 Oct 2026 00:00:00 GMT https://stackwatch.de/en/live#cve-2026-88092 https://stackwatch.de/en/live#cve-2026-88092 Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability Tue, 13 Oct 2026 00:00:00 GMT