Critical Severity
Published: Oct 25, 2026
Defensive watchlist for recent CVSS 9.x CVEs: patch status, affected ranges, existing-PoC checks, and non-destructive verification scripts.
# Critical CVE Watch (CVSS 9.x)
A small, defensive watchlist of recent **CVSS v3.1 >= 9.0** vulnerabilities. It tracks
patch status, affected ranges, existing public PoCs, and non-destructive detection
guidance.
This repository intentionally contains **no exploit or weaponized PoC code**. The
scripts only compare versions and statically inspect generated source files.
## Scope (verified 2026-10-23)
Source of truth: [cveawg.mitre.org](https://cveawg.mitre.org) records, vendor
advisories, npm registry, and GitHub code search.
| CVE | CVSS | Product | Affected | Fixed | Patch status | Public PoC |
| --- | --- | --- | --- | --- | --- | --- |
| [CVE-2026-76268](https://www.cve.org/CVERecord?id=CVE-2026-76268) | 9.8 | Splunk Enterprise (Patroni REST API) | 10.4.0-10.4.2, 10.2.0-10.2.6 | 10.4.3, 10.2.7 | Patched | **Yes** (`murrez/CVE-2026-76268`, Nuclei) |
| [CVE-2026-108983](https://www.cve.org/CVERecord?id=CVE-2026-108983) | 9.8 | GeoVision GV-ASManager (GeoWebServer.exe) | 6.3.0 | 6.4.0 | Patched | None confirmed |
| [CVE-2026-108551](https://www.cve.org/CVERecord?id=CVE-2026-108551) | 9.8 | openapi-typescript-codegen (npm) | <= 0.31.0 | None yet | **Unpatched** | None public |
| [CVE-2026-62120](https://www.cve.org/CVERecord?id=CVE-2026-62120) | 9.8 | WordPress "Law Office" theme | <= 3.20 | None yet | **Unpatched** | Detection template only |
> Note: two of these are **not** patched. Check the vendor advisory before running
> any verification. Public PoC exists for CVE-2026-76268, so "first PoC" claims do
> not apply to it.
## Layout
```
data/cves.json Structured CVE records (affected/fixed/refs)
scripts/version_check.py Offline version vs. affected-range check
scripts/scan_generated.py Static scan for CVE-2026-108551 patterns
detections/<CVE>/README.md Detection + mitigation guidance, no payloads
```
## Usage
Check whether a version is affected:
```powershell
python scripts/version_check.py "Splunk Enterprise