Template Injection

GitLab Patches Critical AI Gateway Flaw That Lets Duo Users Run Commands GitLab AI Gateway vulnerability CVE-2026-90970 lets Duo Agent Platform users escape the prompt template sandbox

GitLab AI Gateway vulnerability CVE-2026-90970 lets Duo Agent Platform users escape the prompt template sandbox

GitLab Patches Critical AI Gateway Flaw That Lets Duo Users Run Commands

Do Son October 2, 2026

TL;DR GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970. The GitLab AI Gateway...

FOSSBilling Template Injection Flaw Exploited in the Wild Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

FOSSBilling Template Injection Flaw Exploited in the Wild

Do Son June 26, 2026

TL;DR A critical FOSSBilling template injection flaw, CVE-2026-28496, carries a CVSS score of 9.4. Attackers can read...

CVE-2026-1868: Critical GitLab Gateway Flaw (CVSS 9.9) Allows RCE GitLab AI Gateway Vulnerability CVE-2026-1868 CVE-2025-0314 GitLab Security Update CVE-2025-9222

GitLab AI Gateway Vulnerability CVE-2026-1868 CVE-2025-0314 GitLab Security Update CVE-2025-9222

CVE-2026-1868: Critical GitLab Gateway Flaw (CVSS 9.9) Allows RCE

Do Son February 8, 2026

GitLab has issued an urgent security alert for organizations running self-hosted versions of its AI Gateway, warning...

Critical Elastic Cloud Flaw: CVE-2025-37729 (CVSS 9.1) Allows RCE via Jinjava Template Injection ECE Jinjava Injection, CVE-2025-37729

ECE Jinjava Injection, CVE-2025-37729

Critical Elastic Cloud Flaw: CVE-2025-37729 (CVSS 9.1) Allows RCE via Jinjava Template Injection

Do Son October 14, 2025

Elastic has released urgent security updates for Elastic Cloud Enterprise (ECE) to patch a critical vulnerability (CVE-2025-37729)...

CVE-2025-1087: Critical Template Injection in Insomnia API Client Enables Remote Code Execution Insomnia, template injection

Insomnia, template injection

CVE-2025-1087: Critical Template Injection in Insomnia API Client Enables Remote Code Execution

Do Son May 13, 2025

A critical vulnerability in Kong’s popular open-source API client, Insomnia, could allow attackers to execute arbitrary code...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2014-125131CVSS 5.1
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2015-20124CVSS 8.7
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2016-20102CVSS 5.1
JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2026-66373CVSS 7.5
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution...
Admin intel📅 Updated: Oct 20, 2026
CVE-2026-96652CVSS 5.3
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a...
CISA KEV📅 Added to KEV: Oct 20, 2026

CVE-2026-91403CVSS 9.1
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java...
📅 Updated: Oct 21, 2026
CVE-2026-105944CVSS 10.0
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts...
📅 Updated: Oct 21, 2026
CVE-2026-114509CVSS 9.2
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API...
📅 Updated: Oct 21, 2026
CVE-2026-114383CVSS 10.0
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi...
📅 Updated: Oct 21, 2026
CVE-2026-114382CVSS 10.0
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file...
📅 Updated: Oct 21, 2026
CVE-2026-96620CVSS 9.2
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed...
📅 Updated: Oct 21, 2026
CVE-2026-96639CVSS 9.8
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created...
📅 Updated: Oct 21, 2026
CVE-2026-111704CVSS 9.3
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers...
📅 Updated: Oct 21, 2026