Daily vulnerability intelligence for defenders – fresh CVEs with exploitability signals, patch status, and action-oriented priorities from 22+ sources.

CVEs published

Get CVEs that hit your stack — not 200/day

Pick your technologies, get a weekly digest by email. Free, no spam.

React Python Postgres +200 more

React Next.js Python Postgres AWS +200 more

Trending Now See all

Critical Watch See all

Weekly Report See all

Actively Exploited Edge and Browser Flaws Anchor This Week's Risk Aug 31 – Sep 07, 2026

Web App RCE and Privilege Escalation Dominate; Zero KEV This Week Aug 24 – Aug 31, 2026

Actively Exploited RCE in Entra, MLflow, TrueConf Anchor This Week's Risk Aug 17 – Aug 24, 2026

Actively Exploited Unpatched RCE and Privilege Flaws Lead the Week Aug 10 – Aug 17, 2026

Weekly Vulnerability Briefing: Unpatched Critical RCE Dominates Findings Aug 03 – Aug 10, 2026

Actively Exploited KEVs and Widespread PoC-Available RCE Flaws Lead Week Jul 27 – Aug 03, 2026

Autel & Check Point Flaws Drive 1,096 Unpatched Critical/High Count Jul 20 – Jul 27, 2026

Actively Exploited SharePoint and SMA1000 Zero-Days Lead the Week Jul 13 – Jul 20, 2026

ICT Providers at Risk

View all

Last 30 days

Upcoming Zero-Day Disclosures 598 568 overdue

View all

to view ZDI disclosures

Attack Technique Trend

Prediction based on ZDI Disclosures & CVE data · 30 days

Analytics

Vendor Today – Quick Filter

Techniques

results

Sort:

Base Score

Vector String

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

Integrity (I)

Availability (A)

0 | 3.9| 6.9| 8.9| 10

NONE LOW MEDIUM HIGH CRITICAL

CVSS Filter – CVEs match

No CVEs match the selected criteria

ZDI Disclosures – Sep 17 10 5d

View all

MATE Desktop

Adobe

Cisco

Cisco

dnsmasq

Bosch Rexroth

GStreamer

Docker

Browse older vulnerabilities in Archive

Live Feed auto-refresh 60s

Vulnerability Intelligence — September 12, 2026

4 CVEs tracked today. 4 Critical, 3 High, 7 Medium, 0 Low.

CVE-2026-87719 CRITICAL CVSS 9.9
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited.

Deserialization Gitlab
CVE-2026-85706 CRITICAL CVSS 10.0
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.

Authentication Bypass Path Traversal Gitlab
CVE-2026-78159 CRITICAL CVSS 9.8
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.

WordPress RCE Code Injection The Events Calendar Wordpress Plugin
CVE-2026-78006 CRITICAL CVSS 9.8
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.

PHP WordPress RCE Deserialization The Events Calendar

Track CVEs for your stack Sign up free →

Today's Vulnerabilities Vulnerabilities