CVE Watch357,370 in full archive

Vulnerabilities exploitable today

357,370in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,662

New KEV · 24H0

Exploit Today ≥ 701,605

Distribution · last window

Critical
2,576
High
10,966
Medium
6,904
Low
671

Filters

Window

Severity

Flags

Vulnerabilities357,041–357,080 · 357,370

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-48158—

—

———use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 15:57:18 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 15:57:18, and clean local clones.7h CVE-2026-566204.3 MED

—

———HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.6h CVE-2026-667388.8 HIG

—

———SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.6h CVE-2026-72718—

—

———goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = <command>` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0.6h CVE-2026-727196.7 MED

—

———Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.7h CVE-2026-727206.4 MED

—

———Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.7h CVE-2026-727215.3 MED

—

———Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.6h CVE-2026-727224.3 MED

—

———Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.7h CVE-2026-727235.3 MED

—

———Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.7h CVE-2026-727244.3 MED

—

———Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.7h CVE-2026-727255.4 MED

—

———Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.7h CVE-2026-727266.5 MED

—

———Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.6h CVE-2026-126244.3 MED

—

———Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.6h CVE-2026-22651—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-22652—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-22653—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-22654—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-22655—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-22656—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-22657—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-22658—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-23675—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-23676—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-23677—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-23690—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-23691—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-23692—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-23765—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-24438—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-25074—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-25549—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-26229—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-26348—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-26349—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-28533—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-28534—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-28998—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-28999—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-29010—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h CVE-2026-29011—

—

———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6h