CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA and the probability of exploitation (EPSS) – each one researched individually: what is affected, what helps, what to do.

89published today

3455in the last 7 days

249of them critical

9newly exploited (7 days)

1 vulnerability · Vendor: AIDotNet

CVE-2026-119597Critical 9.330 Oct 2026, 15:16

AIDotNet OpenDeepWiki: Hard-coded JWT signing key allows admin token forgery

OpenDeepWiki through 2.0.6 uses a JWT signing key that is hard-coded in appsettings.json (Jwt:SecretKey) and publicly visible in the source code. An unauthenticated remote attacker can sign HS256 tokens with an Admin role claim and use them against /api/admin endpoints. This allows control over users, roles, repositories, settings and stored API keys. The attack requires only network access to the instance and knowledge of the public key.

AIDotNet · OpenDeepWiki

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.