High-impact new CVEs, public exploits and exploitation in the wild, as they land on Enclave's Threat Feed. Automated account. By @EnclaveAI.
Joined November 2026
- Tweets243
- Following12
- Followers216
- Likes69
Pinned Tweet
This account posts every CVE that lands on @EnclaveAI’s Threat Feed, and posts again when one gets a public exploit or is exploited in the wild.
🆕 new
💥 public exploit
⚠️ reported exploited
🚨 exploited in the wild
🔍 pre-CVE
app.enclave.ai/threat-feed
🆕 New CVE: CVE-2026-123550 (CVSS 9.8, Enclave score 5/10)
OpenIdentityPlatform OpenAM · Authentication bypass
Remote, no login needed.
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-123549 (CVSS 9.8, Enclave score 6/10)
OpenIdentityPlatform OpenAM · Privilege escalation
Remote, no login needed.
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-123614 (CVSS 9.8, Enclave score 6/10)
imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow
Remote, no login needed.
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-123551 (CVSS 10.0, Enclave score 6/10)
OpenIdentityPlatform OpenAM · Information disclosure
Remote, no login needed.
OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-121491 (CVSS 9.0)
Unknown Fiber Admin · Remote code execution
Remote, no login needed.
The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-123966 (CVSS 10.0, Enclave score 6/10)
Tenda AC19 saveParentControlInfo heap-based overflow
Remote, no login needed.
A vulnerability was determined in Tenda AC19 16.03.10.07.
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-122041 (CVSS 9.1)
Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX…
Remote, no login needed.
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-119075 (CVSS 9.8, Enclave score 7/10)
themegrill Registration Form for WooCommerce · Privilege escalation
Remote, no login needed.
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-104014 (CVSS 9.8, Enclave score 5/10)
naimurrahmannahid Naimur Email OTP Verification for WooCommerce · Authentication bypass
Remote, no login needed.
The Naimur Email OTP Verification for WooCommerce plugin for WordPress is…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-118066 (CVSS 9.1)
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · Authentication bypass
Remote, no login needed.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-17408 (CVSS 9.8, Enclave score 5/10)
IBM API Connect · Remote code execution
Remote, no login needed.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-17360 (CVSS 9.8, Enclave score 5/10)
Multiple Vulnerabilities in IBM API Connect
Remote, no login needed.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-17340 (CVSS 9.8, Enclave score 5/10)
IBM API Connect · Remote code execution
Remote, no login needed.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-17313 (CVSS 9.8, Enclave score 6/10)
IBM API Connect · Authentication bypass
Remote, no login needed.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-17301 (CVSS 9.8, Enclave score 5/10)
IBM API Connect · Authentication bypass
Remote, no login needed.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-17278 (CVSS 9.8, Enclave score 5/10)
IBM API Connect · Authentication bypass
Remote, no login needed.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-16720 (CVSS 9.8, Enclave score 4/10)
IBM API Connect · Authentication bypass
Remote, no login needed.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-16884 (CVSS 9.9, Enclave score 5/10)
Multiple Vulnerabilities in IBM API Connect
Remote, no login needed.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-18838 (CVSS 9.4)
IBM API Connect · Authentication bypass
Remote, no login needed.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper…
app.enclave.ai/threat-feed/C…
🆕 New CVE: CVE-2026-17297 (CVSS 9.6)
Multiple Vulnerabilities in IBM API Connect
Remote, no login needed.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an…
app.enclave.ai/threat-feed/C…
