7.0+
Minimum CVSS we track
Synced daily from NVD & CISA KEV
Understand any CVE —
Understand any CVE —
then get it fixed.
Every high-severity vulnerability, explained in plain terms and prioritised for you. When you need one closed, a vetted specialist delivers a reviewed fix — ready to deploy to staging.
- Daily NVD + CISA KEV sync
- Exploit & patch analysis
- 24-hour target on urgent fixes
~/live-feed · high-severity
streaming
- CVE-2026-78213 HIGH 8.7 15h ago
- CVE-2026-78212 HIGH 7.5 15h ago
- CVE-2026-78211 CRIT 9.8 15h ago
- CVE-2026-78185 MED 6.3 15h ago
- CVE-2026-78182 HIGH 7.3 15h ago
- CVE-2026-78181 HIGH 7.3 15h ago
updated continuously
Browse & filter all →
Daily
NVD + CISA KEV sync
0–100
Remediation priority score
24h
Target on urgent fixes
Two ways in
Whether you need a fix — or you are the fix.
dbcve.org connects organisations facing a live vulnerability with the specialists who close it. Start on the side that fits you.
For defenders
A CVE is threatening your systems.
Send your environment and how urgent it is. You deal with our team directly — no marketplace bidding, no access to your production systems.
- A scoped, fixed quote before any work starts — from $750
- A reviewed mitigation you test in staging, then ship
- 24-hour target when it's actively exploited
You fix vulnerabilities for a living.
Join a vetted roster and take on scoped, paid remediation work — remote, project-based, at your own pace. Vetting is judged on the work, not the résumé.
- Real paid engagements with rates agreed up front
- A short quiz and a real technical assessment
- Honest decisions with specific feedback
What's in a record
More than a database entry.
Most databases stop at the raw NVD text. Every dbcve record is enriched into something you can actually act on.
Plain-English breakdown
A clinical two-sentence explanation of how the exploit actually works — generated from the official source, clearly labelled, never invented.
PoC & patch references
Direct links to Proof-of-Concept code and the exact commit that fixes the flaw — discovered and verified, not guessed.
Exploited-in-the-wild flag
Every CVE is cross-referenced against the CISA KEV list of vulnerabilities under active attack right now.
exploited shown when a match is found
Remediation priority
One 0–100 score that folds severity, exploitation and reachability into a straight answer to “fix this now, or later?”.
87/100 · fix now
Practitioner notes
Real engineers share working mitigations and the gotchas vendor advisories miss — voted on, and reputation-gated to keep them honest.
Remediation on tap
See an indicative scope and price straight from the vulnerability profile, then hand it to a specialist without leaving the page.
typical engagement · from $750
How remediation works
Three steps to remediated.
1
Find your CVE
Search or browse the live feed. Read the breakdown, the PoC, and where the patch lives.
2
Get a fix
Tell us your environment and urgency. You get a scope and a fixed quote before anything starts.
3
Deploy the fix
A specialist delivers a reviewed mitigation. You test it in staging, then ship — they never touch prod.
Live feed
Browse & filter all →
Latest high-severity CVEs
| CVE | Severity | Fix | Summary | Disclosed |
|---|---|---|---|---|
| CVE-2026-78213 | HIGH 8.7 | No fix yet | Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious co… | 2026-08-24 |
| CVE-2026-78212 | HIGH 7.5 | No fix yet | 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path… | 2026-08-24 |
| CVE-2026-78211 | CRIT 9.8 | No fix yet | 4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious comma… | 2026-08-24 |
| CVE-2026-78185 | MED 6.3 | No fix yet | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The … | 2026-08-24 |
| CVE-2026-78182 | HIGH 7.3 | No fix yet | A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected elem… | 2026-08-24 |
| CVE-2026-78181 | HIGH 7.3 | No fix yet | A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulatio… | 2026-08-24 |
| CVE-2026-78180 | HIGH 7.3 | No fix yet | A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components… | 2026-08-24 |
| CVE-2026-78179 | MED 6.3 | No fix yet | A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object… | 2026-08-24 |
| CVE-2026-19853 | MED 5.3 | No fix yet | NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality t… | 2026-08-24 |
| CVE-2026-19852 | MED 6.1 | No fix yet | NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including … | 2026-08-24 |
| CVE-2026-19200 | HIGH 8.9 | No fix yet | The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, … | 2026-08-24 |
| CVE-2026-78178 | HIGH 7.3 | No fix yet | A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. Th… | 2026-08-24 |
| CVE-2026-78171 | HIGH 7.3 | No fix yet | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pr… | 2026-08-24 |
| CVE-2026-78170 | HIGH 8.8 | No fix yet | A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipul… | 2026-08-24 |
| CVE-2026-78169 | CRIT 9.9 | No fix yet | A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the… | 2026-08-24 |
| CVE-2026-78168 | CRIT 9.8 | No fix yet | A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Va… | 2026-08-24 |
| CVE-2026-78167 | CRIT 10.0 | No fix yet | A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validatio… | 2026-08-24 |
| CVE-2026-78166 | MED 6.3 | No fix yet | A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src… | 2026-08-24 |
| CVE-2026-78209 | HIGH 8.2 | No fix yet | exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can infl… | 2026-08-24 |
| CVE-2026-78208 | HIGH 7.5 | No fix yet | exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supp… | 2026-08-24 |
| CVE-2026-78207 | CRIT 9.4 | No fix yet | exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype ke… | 2026-08-24 |
| CVE-2026-78206 | HIGH 7.5 | No fix yet | exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. … | 2026-08-24 |
| CVE-2026-78205 | MED 5.8 | No fix yet | BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject… | 2026-08-24 |
| CVE-2026-78204 | MED 5.4 | No fix yet | Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only req… | 2026-08-24 |
| CVE-2026-78203 | HIGH 7.1 | No fix yet | Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from o… | 2026-08-24 |
| CVE-2026-78161 | HIGH 7.3 | No fix yet | A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recor… | 2026-08-24 |
| CVE-2026-78160 | MED 6.3 | No fix yet | A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the compon… | 2026-08-24 |
| CVE-2026-78158 | MED 6.3 | No fix yet | A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipula… | 2026-08-24 |
| CVE-2026-78157 | HIGH 7.4 | No fix yet | A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Hand… | 2026-08-24 |
| CVE-2026-78156 | HIGH 7.4 | No fix yet | A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c … | 2026-08-24 |
| CVE-2026-78154 | HIGH 7.3 | No fix yet | A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/… | 2026-08-24 |
| CVE-2026-78148 | MED 5.3 | No fix yet | A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp … | 2026-08-24 |
| CVE-2026-78147 | HIGH 7.3 | No fix yet | A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp o… | 2026-08-23 |
| CVE-2026-78144 | MED 6.3 | No fix yet | A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality o… | 2026-08-23 |
| CVE-2026-78143 | HIGH 7.3 | No fix yet | A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of… | 2026-08-23 |
| CVE-2026-78142 | MED 6.3 | No fix yet | A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.ph… | 2026-08-23 |
| CVE-2026-78141 | HIGH 7.4 | No fix yet | A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument… | 2026-08-23 |
| CVE-2026-9769 | HIGH 7.5 | No fix yet | justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.fini… | 2026-08-23 |
| CVE-2026-8630 | MED 6.1 | No fix yet | justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <st… | 2026-08-23 |
| CVE-2026-8445 | CRIT 9.8 | No fix yet | justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed do… | 2026-08-23 |
| CVE-2026-7808 | CRIT 9.8 | No fix yet | justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitizatio… | 2026-08-23 |
| CVE-2026-77088 | MED 6.1 | No fix yet | justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as… | 2026-08-23 |
| CVE-2026-74793 | MED 6.1 | No fix yet | justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections.… | 2026-08-23 |
| CVE-2026-6827 | MED 6.1 | No fix yet | justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign n… | 2026-08-23 |
| CVE-2026-5751 | MED 6.1 | No fix yet | justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy … | 2026-08-23 |
| CVE-2026-5389 | MED 6.1 | No fix yet | justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. At… | 2026-08-23 |
| CVE-2026-5388 | CRIT 9.8 | No fix yet | justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown pas… | 2026-08-23 |
| CVE-2026-4671 | HIGH 7.5 | No fix yet | justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-… | 2026-08-23 |
| CVE-2026-78155 | CRIT 9.9 | No fix yet | privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges | 2026-08-23 |
| CVE-2026-78115 | MED 5.4 | No fix yet | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.ph… | 2026-08-23 |
Insights
How these vulnerabilities actually work.
First-party technical breakdowns from the people who remediate them — written under a real byline, not a persona.
Deserialization · RCE
Anatomy of a deserialization vulnerability
Why “just don’t deserialize untrusted input” is harder than it sounds, and what a real fix looks like.
The dbcve.org team Triage · ProcessReading a CVSS vector in ten seconds
The handful of metrics that decide whether a “9.8” is your problem today or next sprint.
dbcve.org insights RemediationWhat a reviewed mitigation actually contains
How we scope a fix, what you receive, and why it never touches your production systems.
dbcve.org insightsFacing a critical CVE right now?
Get a vetted specialist on it. A reviewed mitigation, delivered for you to deploy in staging first — no access to your production systems required.