Unpatched Vulnerability

Unpatched Shopware Flaw CVE-2026-104937 Turns Stored XSS Into Admin Takeover and RCE Shopware vulnerability CVE-2026-104937 stored XSS leading to admin token theft and remote code execution

Shopware vulnerability CVE-2026-104937 stored XSS leading to admin token theft and remote code execution

Unpatched Shopware Flaw CVE-2026-104937 Turns Stored XSS Into Admin Takeover and RCE

Do Son October 14, 2026

TL;DR CERT/CC disclosed CVE-2026-104937 on October 13, 2026, a stored XSS flaw in Shopware 6.7. The Shopware...

CERT/CC Warns of 11 Unpatched Thelia Vulnerabilities Enabling Remote Code Execution

Thelia vulnerabilities enabling remote code execution on unpatched e-commerce servers

CERT/CC Warns of 11 Unpatched Thelia Vulnerabilities Enabling Remote Code Execution

Do Son October 12, 2026

TL;DR CERT/CC published a note on October 12, 2026, listing 11 Thelia vulnerabilities in the open-source e-commerce...

Unpatched RCE: Livewire Filemanager Upload Flaw (CVE-2025-14894) Exposes Laravel Apps Livewire Filemanager RCE CVE-2025-14894

Livewire Filemanager RCE CVE-2025-14894

Unpatched RCE: Livewire Filemanager Upload Flaw (CVE-2025-14894) Exposes Laravel Apps

Do Son January 19, 2026

A critical new security flaw has been unearthed in Livewire Filemanager, a popular tool used within the...

Zero-Day Warning: Unpatched Twonky Server Flaws Expose Media to Total Takeover WHILL Wheelchair Hijacking, CVE-2025-14346 MAS typosquatting malware, get.activate.win vs get.activated.win OpenShift GitOps RCE, Cluster Takeover Flaw Twonky Server, CVE-2025-13315 AI agents CVE-2024-52875 PoC

WHILL Wheelchair Hijacking, CVE-2025-14346 MAS typosquatting malware, get.activate.win vs get.activated.win OpenShift GitOps RCE, Cluster Takeover Flaw Twonky Server, CVE-2025-13315 AI agents CVE-2024-52875 PoC

Zero-Day Warning: Unpatched Twonky Server Flaws Expose Media to Total Takeover

Do Son November 27, 2025

A critical security warning has been issued for users of Twonky Server, the popular media server software...

CERT/CC Warns of Unpatched Root-Level Command Injection Flaws in Tenda 4G03 Pro and N300 Routers (CVE-2025-13207, CVE-2024-24481) Tenda Unpatched RCE, Router Command Injection

Tenda Unpatched RCE, Router Command Injection

CERT/CC Warns of Unpatched Root-Level Command Injection Flaws in Tenda 4G03 Pro and N300 Routers (CVE-2025-13207, CVE-2024-24481)

Do Son November 24, 2025

The CERT Coordination Center (CERT/CC) has issued a warning about multiple unpatched command injection vulnerabilities affecting Tenda’s...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 17, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 17, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 17, 2026
CVE-2026-111862CVSS 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123...
Admin intel📅 Updated: Oct 17, 2026
CVE-2026-111357CVSS 7.0
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to...
Watchtower Verified📅 Updated: Oct 17, 2026
CVE-2025-61624CVSS 6.0
An Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0...
CISA KEV📅 Added to KEV: Oct 16, 2026
CVE-2026-102764CVSS 9.3
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the...
CISA KEV📅 Added to KEV: Oct 16, 2026
CVE-2026-106931CVSS 8.5
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS...
Admin intel📅 Updated: Oct 15, 2026

CVE-2026-111862CVSS 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123...
Admin intel📅 Updated: Oct 17, 2026
CVE-2026-104736CVSS 9.8
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10...
📅 Updated: Oct 17, 2026
CVE-2026-101950CVSS 9.3
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows...
📅 Updated: Oct 17, 2026
CVE-2026-110653CVSS 9.1
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to...
📅 Updated: Oct 17, 2026
CVE-2026-97381CVSS 9.9
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through...
📅 Updated: Oct 17, 2026
CVE-2026-93895CVSS 9.1
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access...
📅 Updated: Oct 17, 2026
CVE-2026-111823CVSS 9.8
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
📅 Updated: Oct 17, 2026
CVE-2026-106629CVSS 9.3
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an...
📅 Updated: Oct 17, 2026