Enclave Radar

High-impact new CVEs, public exploits and exploitation in the wild, as they land on Enclave's Threat Feed. Automated account. By @EnclaveAI.

[Enclave Radar @EnclaveRadar]

This account posts every CVE that lands on @EnclaveAI’s Threat Feed, and posts again when one gets a public exploit or is exploited in the wild.

🆕 new
💥 public exploit
⚠️ reported exploited
🚨 exploited in the wild
🔍 pre-CVE

https://t.co/lpMl8tzAyx

[Enclave Radar @EnclaveRadar]

💥 Public exploit released: CVE-2026-124014 (CVSS 9.1)
Copeland XWEB EVO · Arbitrary file write
Remote, no login needed.

XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify…

https://t.co/ktf9AE8Zbn

[Enclave Radar @EnclaveRadar]

💥 Public exploit released: CVE-2026-124006 (CVSS 9.2)
Dixell/Copeland XWEB EVO Predictable Root Password Generation
Remote, no login needed.

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to…

https://t.co/5OsvROinST

[Enclave Radar @EnclaveRadar]

💥 Public exploit released: CVE-2026-124002 (CVSS 9.8, Enclave score 7/10)
Copeland XWEB EVO · Remote code execution
Remote, no login needed.

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability…

https://t.co/sls9zxsWtU

[Enclave Radar @EnclaveRadar]

💥 Public exploit released: CVE-2026-124010 (CVSS 9.8, Enclave score 6/10)
Copeland XWEB EVO · Remote code execution
Remote, no login needed.

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers…

https://t.co/kFjctCK2Hx

[Enclave Radar @EnclaveRadar]

💥 Public exploit released: CVE-2026-127275 (CVSS 10.0, Enclave score 4/10)
Linksys EA8100 JNAP API ui_server.lua SetUnsecuredWiFiWarning missing authentication
Remote, no login needed.

A vulnerability was determined in Linksys EA8100 1.0.3.216940.

https://t.co/UqaxAObTnP

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-124021 (CVSS 9.2)
Control Web Panel · Authentication bypass
Remote, no login needed.

Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of…

https://t.co/eXKaCrX5OY

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-124020 (CVSS 9.2)
Control Web Panel < 1.30.6 Host Header Password Reset Poisoning
Remote, no login needed.

Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows…

https://t.co/fi8jlzsrOA

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-82504 (CVSS 9.8, Enclave score 7/10)
VITEC EZ TV Platform Server · Arbitrary file write
Remote, no login needed.

VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that…

https://t.co/ssqYI6QaPE

[Enclave Radar @EnclaveRadar]

💥 Public exploit released: CVE-2026-124005 (CVSS 9.2)
Dixell/Copeland XWEB EVO Predictable Administrator Password Generation
Remote, no login needed.

XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote…

https://t.co/RjB27qgM7L

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-126119 (CVSS 9.8, Enclave score 8/10)
Unknown Streamit · Remote code execution
Remote, no login needed.

The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its…

https://t.co/EoXdCrAG6B

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-124833 (CVSS 9.8, Enclave score 7/10)
Unknown Ahime Image Printer · Arbitrary file write
Remote, no login needed.

The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded…

https://t.co/R1DRhQbnZ9

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-124822 (CVSS 10.0, Enclave score 7/10)
Unknown Easy DragDrop File Uploader · Arbitrary file write
Remote, no login needed.

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before…

https://t.co/LmQX5Cnxxh

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-118064 (CVSS 9.8, Enclave score 5/10)
Unknown Advance Guest Post · Arbitrary file write
Remote, no login needed.

The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing…

https://t.co/eXCHL76vSq

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-118063 (CVSS 9.8, Enclave score 7/10)
Unknown Advance Guest Post · Arbitrary file write
Remote, no login needed.

The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a…

https://t.co/hmlYpl04Ts

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-124763 (CVSS 9.1)
AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file
Remote, no login needed.

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of…

https://t.co/TlRZ4h2gG4

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-129171 (CVSS 9.8, Enclave score 8/10)
likaia NginxPulse · SQL injection
Remote, no login needed.

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via…

https://t.co/UuXzORSNzj

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-123965 (CVSS 9.9, Enclave score 4/10)
Jet Admin cloud platform prompt injection
Remote, no login needed.

A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to…

https://t.co/jAVgJsO6zx

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-129161 (CVSS 9.1)
Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover
Remote, no login needed.

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts…

https://t.co/JnzM2NZGXy

[Enclave Radar @EnclaveRadar]

🆕 New CVE: CVE-2026-129167 (CVSS 9.2)
Seafile SeaDoc · Path traversal
Remote, no login needed.

Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers…

https://t.co/QwXi0pIkmN

[Enclave Radar @EnclaveRadar]

💥 Public exploit released: CVE-2026-6460 (CVSS 8.8)
PostgreSQL · Remote code execution

Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ...

https://t.co/JtuF02BIdZ