CveMate
Vulnerability intelligence, open to everyone. Vulnerabilities, threat metrics, KEV catalogs and exploit data from 30 sources, in one platform — no account needed.
30data sources
Star on GitHub, 8 starsLatest high-priority signals
Real-time tracking of critical vulnerabilities, ransomware campaigns, and CISA KEV additions.
CriticalCVE-2026-115995unitree robotics · unitree go2Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injectionA security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."CriticalCVE-2026-115933gitroomhq · postiz-appForged signed tokens let any registered user take over other users and organizationsPostiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.
A second, narrower route that creates team invitations signs extra fields from the request body in the same way.CriticalCVE-2026-115932gitroomhq · postiz-appPath traversal in post media lets any registered user read server filesWhen a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.
The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.CriticalCVE-2026-114196paytiumsupport · paytiumWordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.EPSS0.56%CriticalCVE-2026-94075tribulant software · newslettersWordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.EPSS0.56%CriticalCVE-2026-110956unknown · asvereinbaseasVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA ValidationThe asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.EPSS0.19%CriticalCVE-2026-115806codexonics · prime mover – backup and migrationPrime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-ReplaceThe Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.EPSS0.82%CriticalCVE-2026-115931gitroomhq · postiz-appArbitrary file read and backend crash through unrestricted provider method callsPostiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.EPSS0.65%CriticalCVE-2026-115893bytecodealliance · wasmtime +1 moreWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionWasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.EPSS0.79%CriticalCVE-2026-115889bytecodealliance · wasmtime +2 moreWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationWasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.EPSS0.66%