Credential Exposure

Twenty CRM Flaw CVE-2026-105763 Exposes Plaintext Email Passwords to Any Workspace Member Twenty CRM vulnerability CVE-2026-105763 exposing plaintext IMAP SMTP CalDAV passwords via GraphQL

Twenty CRM vulnerability CVE-2026-105763 exposing plaintext IMAP SMTP CalDAV passwords via GraphQL

Twenty CRM Flaw CVE-2026-105763 Exposes Plaintext Email Passwords to Any Workspace Member

Do Son October 6, 2026

TL;DR A Twenty CRM vulnerability, CVE-2026-105763, let any workspace member read other members’ IMAP, SMTP and CalDAV...

EKS Security Alert: Overprivileged Containers Exposing AWS Credentials via Unencrypted API aws

EKS Security Alert: Overprivileged Containers Exposing AWS Credentials via Unencrypted API

Do Son June 23, 2025

In the complex world of cloud-native applications, Kubernetes and Amazon Elastic Kubernetes Service (EKS) have become the...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 20, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 20, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 20, 2026
CVE-2026-66373CVSS 7.5
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution...
Admin intel📅 Updated: Oct 20, 2026
CVE-2026-110936CVSS 8.4
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link...
Admin intel📅 Updated: Oct 20, 2026
CVE-2026-111862CVSS 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123...
Admin intel📅 Updated: Oct 17, 2026
CVE-2026-111357CVSS 7.0
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to...
Watchtower Verified📅 Updated: Oct 17, 2026
CVE-2025-61624CVSS 6.0
An Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0...
CISA KEV📅 Added to KEV: Oct 16, 2026

CVE-2026-110957CVSS 10.0
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580...
📅 Updated: Oct 20, 2026
CVE-2026-77524CVSS 9.9
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can...
📅 Updated: Oct 20, 2026
CVE-2026-110646CVSS 9.2
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to...
📅 Updated: Oct 20, 2026
CVE-2026-110636CVSS 9.3
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands...
📅 Updated: Oct 20, 2026
CVE-2026-110631CVSS 9.3
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect...
📅 Updated: Oct 20, 2026
CVE-2026-110616CVSS 9.2
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API...
📅 Updated: Oct 20, 2026
CVE-2026-77936CVSS 9.3
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added...
📅 Updated: Oct 20, 2026
CVE-2026-77933CVSS 9.3
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and...
📅 Updated: Oct 20, 2026