public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

LIVE SIGNAL MAPDEFENSIVE PRIORITY CIRCUITLATEST STATIC SNAPSHOT

PRIORITY ORDER · NOT AN ATTACK PATH

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

Tracked CVEs2020 new in 7d

Critical4canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)0EPSS percentile observed

Monitored Vendors2from current data

VULNERABILITY TREEMAP

DEFENSIVE PRIORITY SURFACE

Stable CVE grouping for defensive triage. Area changes by display mode; severity remains encoded by color.

LATEST STATIC SNAPSHOT2026-08-12 10:39 UTC / 2026-08-12 19:39 JST

DISPLAY MODEDEFENSIVE PRIORITY

Live Vulnerability Feed READ-ONLY

20 signalsView all signals →

2026-08-12

defensive priority signal

CRITICALEPSS 0.0042 (35)NEW-NVD: Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and… Handoff

2026-08-12

defensive priority signal

CRITICALEPSS 0.0036 (29)NEW-NVD: IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin c… Handoff

2026-08-12

defensive priority signal

CRITICALEPSS 0.0058 (45)NEW-NVD: Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product li… Handoff

2026-08-12

defensive priority signal

CRITICALEPSS 0.0031 (24)NEW-NVD: DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0032 (25)NEWeclipse / theiaNVD: In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enable… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0029 (21)NEW-NVD: Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT mes… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0029 (21)NEW-NVD: The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filte… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0020 (10)NEW-NVD: InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!!… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0020 (10)NEW-NVD: Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field value… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0022 (12)NEW-NVD: Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, un… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0022 (13)NEW-NVD: DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0041 (34)NEWeclipse / theiaNVD: In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:pat… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0028 (20)NEW-NVD: Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @log… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0024 (16)NEW-NVD: Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no aut… Handoff

2026-08-12

defensive priority signal

HIGHEPSS 0.0030 (22)NEW-NVD: MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a… Handoff

2026-08-12

defensive priority signal

MEDIUMEPSS 0.0020 (10)NEW-NVD: Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stor… Handoff

2026-08-12

defensive priority signal

MEDIUMEPSS 0.0028 (20)NEWeclipse / theiaNVD: In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges pr… Handoff

2026-08-12

defensive priority signal

MEDIUMEPSS 0.0017 (7)NEWeclipse / accessibility_tools_frameworkNVD: In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based ap… Handoff

2026-08-12

defensive priority signal

MEDIUMEPSS 0.0019 (9)NEW-NVD: DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_requ… Handoff

2026-08-12

defensive priority signal

LOWEPSS 0.0015 (5)NEW-NVD: Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usag… Handoff

Public-safe defensive signals

CVE-2026-71237 CRITICAL CVSS 9.8 -
NVD: Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1").
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for critical severity review; CVSS 9.8 (CRITICAL); EPSS percentile 35; sources: NVD.
CVE-2026-71231 CRITICAL CVSS 9.8 -
NVD: IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding...
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for critical severity review; CVSS 9.8 (CRITICAL); EPSS percentile 29; sources: NVD.
CVE-2026-66747 CRITICAL CVSS 9.3 -
NVD: Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. NVD: It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. NVD: It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds.
An attacker may gain root or administrative-level privileges on affected systems; CVSS 9.3 (CRITICAL); EPSS percentile 45; sources: NVD.
CVE-2026-71238 CRITICAL CVSS 9.1 -
NVD: DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. NVD: Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens...
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for critical severity review; CVSS 9.1 (CRITICAL); EPSS percentile 24; sources: NVD.
CVE-2026-60009 HIGH CVSS 8.8 eclipse / theia
NVD: In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. NVD: The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no authentication. NVD: In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in @theia/core re-issues the cookie and calls next() without rejecting tokenless HTTP requests.
An attacker may be able to run code or commands on affected systems; CVSS 8.8 (HIGH); EPSS percentile 25; affected product context: eclipse / theia; sources: NVD, OSV, Vendor Advisory.
CVE-2026-71235 HIGH CVSS 8.8 -
NVD: Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. NVD: The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 8.8 (HIGH); EPSS percentile 21; sources: NVD.
CVE-2026-71243 HIGH CVSS 8.8 -
NVD: The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. NVD: cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an... OSV: backmeup (npm) - OS Command Injection via Backup Option Values
An attacker may be able to run unintended system commands through the affected component; CVSS 8.8 (HIGH); EPSS percentile 21; sources: NVD, OSV.
CVE-2026-71233 HIGH CVSS 8.7 -
NVD: InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! NVD: ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.7 (HIGH); EPSS percentile 10; sources: NVD.
CVE-2026-71236 HIGH CVSS 8.7 -
NVD: Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.7 (HIGH); EPSS percentile 10; sources: NVD.
CVE-2026-71242 HIGH CVSS 8.3 -
NVD: Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). NVD: Any authenticated user of one company can read, edit, or delete another company's notes by ID. OSV: Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 8.3 (HIGH); EPSS percentile 12; sources: NVD, OSV.
CVE-2026-71239 HIGH CVSS 8.1 -
NVD: DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.1 (HIGH); EPSS percentile 13; sources: NVD.
CVE-2026-12609 HIGH CVSS 7.5 eclipse / theia
NVD: In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path(*) HTTP endpoint, which resolves the requested file path with path.resolve(localPath, filePath) without verifying that the... NVD: An unauthenticated network attacker can send percent-encoded ../ sequences (%2e%2e%2f) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. NVD: Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure; CVSS 7.5 (HIGH); EPSS percentile 34; affected product context: eclipse / theia; sources: NVD, OSV, Vendor Advisory.
CVE-2026-71241 HIGH CVSS 7.5 -
NVD: Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. NVD: Because card_id values are sequential integers, the entire student database can be enumerated without authentication.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.5 (HIGH); EPSS percentile 20; sources: NVD.
CVE-2026-71234 HIGH CVSS 7.5 -
NVD: Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0)...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.5 (HIGH); EPSS percentile 16; sources: NVD.
CVE-2026-71232 HIGH CVSS 7.2 -
NVD: MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function... OSV: MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE OSV: MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function...
An attacker may be able to run code or commands on affected systems; CVSS 7.2 (HIGH); EPSS percentile 22; sources: NVD, OSV.
CVE-2026-71244 MEDIUM CVSS 6.5 -
NVD: Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.5 (MEDIUM); EPSS percentile 10; sources: NVD.
CVE-2026-14574 MEDIUM CVSS 5.7 eclipse / theia
NVD: In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys (__proto__, constructor, prototype). NVD: Because this function is invoked by PreferenceServiceImpl.doResolve for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (.theia/settings.json or .vscode/settings.json) can... OSV: In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys (__proto__, constructor, prototype).
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.7 (MEDIUM); EPSS percentile 20; affected product context: eclipse / theia; sources: NVD, OSV, Vendor Advisory.
CVE-2026-14304 MEDIUM CVSS 4.6 eclipse / accessibility_tools_framework
NVD: In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. NVD: If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker. OSV: In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists.
An attacker may cross a privilege boundary and gain more access than intended; CVSS 4.6 (MEDIUM); EPSS percentile 7; affected product context: eclipse / accessibility_tools_framework; sources: NVD, OSV, Vendor Advisory.
CVE-2026-71240 MEDIUM CVSS 4.3 -
NVD: DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 4.3 (MEDIUM); EPSS percentile 9; sources: NVD.
CVE-2026-17578 LOW CVSS 2.3 -
NVD: Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. NVD: If a producer sends messages at a sustained high rate without key rotation, which only occurs on reboot of the Kong Event Gateway instance, the probability of a nonce collision becomes non-negligible. NVD: An authorized consumer who detects a nonce collision can recover parts of plaintext from the affected messages.
This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 2.3 (LOW); EPSS percentile 5; sources: NVD.

Critical High Medium Low KEVKnown Exploited NEWNewly ObservedJ / K Move · ↑ / ↓ Move · Enter Open · Esc Close

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-08-12 10:39 UTC / 2026-08-12 19:39 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

40 public-safe changes since the previous successful snapshot.

Added20

Changed0

Removed20

What changed

CVE-2026-12609: newly added to the public-safe set.
CVE-2026-14304: newly added to the public-safe set.
CVE-2026-14574: newly added to the public-safe set.
37 more public-safe changes in the JSON feed.

Previous snapshot2026-08-12 05:14 UTC / 2026-08-12 14:14 JST

Items compared20 -> 20

Feed generated2026-08-12 10:39 UTC / 2026-08-12 19:39 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV7

CISA KEV0

Affected products5partial

CPE5partial

PURL0partial

Canonical vendor/product5partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-08-1220

Severity Distribution

CRITICAL 4
HIGH 11
MEDIUM 4
LOW 1
NONE 0
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

OSV7

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2026-71237

Critical / High4 / 11

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 4,
    "HIGH": 11,
    "LOW": 1,
    "MEDIUM": 4,
    "NONE": 0,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2026-71237"
}

Source Status

NVD20 signalsLast observed: 2026-08-12Status: healthy

EPSS20 signalsLast observed: 2026-08-12Status: healthy

OSV7 signalsLast observed: 2026-08-12Status: healthy

CISA KEV0 signalsLast observed: 2026-08-12Status: not observed

Vendor Advisory20 signalsLast observed: 2026-08-12Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled