AI Gateway

GitLab Patches Critical AI Gateway Flaw That Lets Duo Users Run Commands GitLab AI Gateway vulnerability CVE-2026-90970 lets Duo Agent Platform users escape the prompt template sandbox

GitLab AI Gateway vulnerability CVE-2026-90970 lets Duo Agent Platform users escape the prompt template sandbox

GitLab Patches Critical AI Gateway Flaw That Lets Duo Users Run Commands

Do Son October 2, 2026

TL;DR GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970. The GitLab AI Gateway...

CVE-2026-71479: New API Integer Overflow Exploited in the Wild CVE-2026-71479 New API integer overflow quota billing vulnerability exploited in the wild self-crediting AI gateway

CVE-2026-71479 New API integer overflow quota billing vulnerability exploited in the wild self-crediting AI gateway

CVE-2026-71479: New API Integer Overflow Exploited in the Wild

Do Son August 18, 2026

TL;DR A billing flaw in New API, a popular open-source AI API gateway, is under active attack....

LiteLLM Authentication Bypass via Host Header Injection (CVE-2026-49468)

LiteLLM authentication bypass via Host Header Injection in the AI Gateway proxy (CVE-2026-49468)

LiteLLM Authentication Bypass via Host Header Injection (CVE-2026-49468)

Do Son June 19, 2026

Critical bug exposes LiteLLM management routes A newly disclosed LiteLLM authentication bypass could let unauthenticated attackers...

CVE-2026-1868: Critical GitLab Gateway Flaw (CVSS 9.9) Allows RCE GitLab AI Gateway Vulnerability CVE-2026-1868 CVE-2025-0314 GitLab Security Update CVE-2025-9222

GitLab AI Gateway Vulnerability CVE-2026-1868 CVE-2025-0314 GitLab Security Update CVE-2025-9222

CVE-2026-1868: Critical GitLab Gateway Flaw (CVSS 9.9) Allows RCE

Do Son February 8, 2026

GitLab has issued an urgent security alert for organizations running self-hosted versions of its AI Gateway, warning...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 19, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 19, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 19, 2026
CVE-2026-111862CVSS 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123...
Admin intel📅 Updated: Oct 17, 2026
CVE-2026-111357CVSS 7.0
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to...
Watchtower Verified📅 Updated: Oct 17, 2026
CVE-2025-61624CVSS 6.0
An Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0...
CISA KEV📅 Added to KEV: Oct 16, 2026
CVE-2026-102764CVSS 9.3
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the...
CISA KEV📅 Added to KEV: Oct 16, 2026
CVE-2026-106931CVSS 8.5
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS...
Admin intel📅 Updated: Oct 15, 2026

CVE-2025-39496CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter...
📅 Updated: Oct 18, 2026
CVE-2025-48100CVSS 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code...
📅 Updated: Oct 18, 2026
CVE-2025-49387CVSS 10.0
Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms...
📅 Updated: Oct 18, 2026
CVE-2025-49388CVSS 9.8
Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Core Plugin:...
📅 Updated: Oct 18, 2026
CVE-2025-52761CVSS 9.8
Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel...
📅 Updated: Oct 18, 2026
CVE-2025-58159CVSS 9.9
WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was...
📅 Updated: Oct 18, 2026
CVE-2025-31100CVSS 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to...
📅 Updated: Oct 18, 2026
CVE-2025-53693CVSS 9.8
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM),...
📅 Updated: Oct 18, 2026