CVE Watch
Every published CVE, mapped to engagement reality.
Crawled from cve.org every day. Each entry annotated with the QSearch coverage signal — how many of our agents, skills, and playbooks address the technique. Subscribe via RSS for SIEM pipe, or get the weekly digest by email.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
apacheCWE-200Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
CWE-80Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
apacheCWE-434Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
apacheCWE-434Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability
Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
CWE-59Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
apacheCWE-359Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer
Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
apacheCWE-87Logic bypass vulnerability in the file system
Logic bypass vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-606UAF vulnerability in the package management module
UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
CWE-284UAF vulnerability in the package management module
UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
CWE-284DoS vulnerability in the browser kernel
DoS vulnerability in the browser kernel. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-399Race condition vulnerability in the IPC module
Race condition vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-416Out-of-bounds write vulnerability in the IPC module
Out-of-bounds write vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-122DoS vulnerability in the log service
DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-190Permission control vulnerability in the audio framework
Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CWE-275Permission control vulnerability in service notifications
Permission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-264Permission control vulnerability in calls
Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-840Path traversal vulnerability in the SMS app
Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability.
CWE-22The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that ...
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
CWE-79The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, ...
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
CWE-862
6.5 MEDIUM
2.4 LOWWeekly digest
Get the curated CVE digest every Monday
One email a week, sent Monday morning CET. The CVEs published or modified in the last seven days, severity-ordered, with the QSearch coverage signal. Unsubscribe with one click — included in every send.
Pipe the CVE feed into your stack.
CVE Watch publishes RSS, Atom, and JSON feeds — wire them into your SIEM, Slack, Discord, or your RSS reader of choice. Or get the curated weekly digest by email.