CVE Monitoring for your infrastructure — WZ-IT monitors your servers, containers and applications for known vulnerabilities. Schedule a consultation
Three numbers from the last four months:
- CVSS 9.9 — Jellyfin: Path Traversal → Remote Code Execution as Root
- CVSS 10.0 — n8n: Unauthenticated RCE in Self-Hosted and Cloud
- 1.5M servers — cPanel: Authentication Bypass, active exploitation since February
Each of these vulnerabilities affects software that enterprises use in production. Each was publicly disclosed before many operators had patched. And each could have been detected early with active CVE monitoring.
Table of Contents
- What happened in 2026 so far
- The pattern behind these vulnerabilities
- Why apt update isn't enough
- CVE monitoring: what it is and how it works
- Tools for enterprises
- How WZ-IT handles CVE monitoring
What happened in 2026 so far
One example without a CVE number: Metabase, SQL injection rated CVSS 10.0 - actively exploited, yet absent from every NVD feed.
Jellyfin: CVSS 9.9 — Subtitle Upload → Root RCE
In April 2026, CVE-2026-35031 was published. The vulnerability exists in Jellyfin's subtitle upload endpoint (versions before 10.11.7). An authenticated user with "Upload Subtitles" permission — no admin rights required — could write arbitrary files to the server through an unvalidated format parameter.
The attack chain: Path Traversal → Arbitrary File Write → .strm file for Arbitrary File Read → Database Extraction → Admin Token → Root RCE via ld.so.preload.
A single API call, no special privileges, complete system compromise.
n8n: CVSS 10.0 — Unauthenticated RCE
CVE-2026-21858, codenamed "Ni8mare": An unauthenticated attacker could execute arbitrary code on the n8n server through manipulated webhook and form requests. According to NVD, versions from 1.65.0 and below 1.121.0 were affected; the fix is in 1.121.0.
CVSS 10.0 — the highest possible score. No login required, no user interaction, remote exploitation.
On the same day, CVE-2026-21877 was published, CVSS 9.9, this time authenticated RCE (fixed in 1.121.3). And in March 2026, two more critical n8n vulnerabilities were published. CISA has listed the older expression injection flaw CVE-2025-68613 in its Known Exploited Vulnerabilities catalog since March 11, 2026, so it is being actively exploited.
cPanel: CVSS 9.8 — 1.5M Servers Affected
CVE-2026-41940 is an authentication bypass flaw in cPanel & WHM. Through a CRLF injection in the login process, attackers could authenticate as root — without a password, without 2FA.
The vulnerability was publicly disclosed in late April 2026. But: evidence of targeted exploitation exists since February 2026. At least 1.5 million cPanel instances were internet-facing and potentially affected. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog on April 30, 2026.
Apache HTTP Server: CVE-2026-23918 — Double Free → RCE
Even foundational technology is affected: Apache HTTP Server 2.4.66 had a double-free vulnerability with HTTP/2 enabled (CVSS 8.8) that could lead to remote code execution. It is fixed in 2.4.67. Apache runs on millions of web servers worldwide.
The pattern behind these vulnerabilities
All four cases share common traits:
- Widely deployed software — not niche products, but tools used by hundreds of thousands to millions
- High to critical severity: CVSS 8.8 to 10.0, and in all four cases exploitable over the network. The score alone does not say that: the attack vector is in the CVSS vector string (AV). The Linux kernel flaw CVE-2026-53266, for example, is also rated 8.8 but requires local access (AV:L).
- Patches were available — in every case, an update was released within days
- Many still didn't patch — because they didn't know about the vulnerability
Point 4 is the actual problem. The vulnerability exists, the patch exists, but the operator knows about neither.
Why apt update isn't enough
Those who believe a weekly apt update && apt upgrade protects their infrastructure underestimate reality:
What apt doesn't cover:
- Docker containers (the majority of modern self-hosted software)
- Helm charts and Kubernetes deployments
- Self-compiled software
- Applications deployed via git pull + docker-compose up
- npm/pip/composer dependencies inside containers
What apt can't do:
- Prioritize by CVSS score
- Alert on critical vulnerabilities
- Scan dependencies inside container images
- Determine if a CVE actually applies to your specific configuration
An enterprise running n8n via Docker Compose doesn't learn about CVE-2026-21858 through apt. They learn about it through Hacker News, Twitter — or through the attacker.
CVE monitoring: what it is and how it works
CVE monitoring is the continuous tracking of all deployed software versions against public vulnerability databases (NVD, MITRE, Greenbone Feed, GitHub Security Advisories).
Comprehensive CVE monitoring covers:
| Layer | What is checked | Example tool |
|---|---|---|
| Network | Open ports, reachable services, known vulnerabilities | Greenbone OpenVAS |
| Container | Base images, packages, application dependencies | Trivy, Grype |
| Code | Dependencies in package.json, requirements.txt, go.mod | Snyk, Dependabot |
| Configuration | Misconfigurations, default credentials, TLS settings | OpenSCAP, Lynis |
| CVE Intelligence | Track new CVEs, filter, prioritize, assign to teams | OpenCVE |
| Aggregation | Central collection, deduplication, compliance mapping | DefectDojo |
The goal: know within 24 hours of a CVE publication whether your infrastructure is affected.
Tools for enterprises
Greenbone OpenVAS — Network Vulnerability Scanning
OpenVAS scans infrastructure from the outside and inside for known vulnerabilities. The largest freely available vulnerability database on the market. Detects outdated software, open ports, misconfigurations.
For enterprises: regular automated scans with reporting, not just one-time audits.
OpenCVE — CVE Intelligence Platform
OpenCVE is an open-source vulnerability intelligence platform that aggregates CVEs from five authoritative sources (MITRE, NVD, RedHat, Vulnrichment and more) and updates hourly. The critical difference to pure scanners: OpenCVE doesn't monitor your servers — it monitors CVE databases and proactively notifies you when a new vulnerability appears for software you use.
Why OpenCVE matters for enterprises:
- Vendor/Product Subscriptions — Subscribe to the software you deploy (Proxmox, Nextcloud, n8n, nginx, PostgreSQL...) and only receive relevant CVEs
- Projects & Organizations — Organize CVEs by team, client or infrastructure area
- Custom Tags & Status Tracking — Mark CVEs as "Under Analysis", "Risk Accepted", "Patched" and assign a responsible person
- Filters & Views — Filter by CVSS score, EPSS (exploitation probability), KEV (Known Exploited Vulnerabilities) and CWE. Save complex filters as reusable views
- Alerting — Notifications via email, webhook or Slack as soon as a relevant CVE is published or updated
- Self-Hosted — Fully self-hostable via Docker. Your CVE data stays on your infrastructure
Had an enterprise set up OpenCVE with subscriptions for Jellyfin, n8n and cPanel, they would have been notified within hours of CVE publication — not days later via tech news.
OpenCVE doesn't replace scanners like OpenVAS or Trivy. It complements them: scanners find what's running on your servers, OpenCVE tells you what's happening in the world.
Trivy — Container Security
Trivy scans container images, filesystems and Git repositories for CVEs in OS packages and application dependencies. Integrates into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins).
Ideal for enterprises deploying applications via Docker/Kubernetes.
DefectDojo — Central Vulnerability Platform
DefectDojo aggregates findings from over 200 security tools, deduplicates them and maps them to compliance frameworks. For enterprises running multiple scanners that need a unified overview.
How the tools work together
These tools don't compete — they complement each other:
OpenCVE → "There's a new CVE for n8n" (proactive)
Trivy → "Your n8n container has the affected version" (scan)
OpenVAS → "The n8n port is reachable from the internet" (network)
DefectDojo → Aggregate everything, prioritize, report
For most SMEs, OpenCVE + Trivy is a solid starting point. OpenVAS and DefectDojo come in as infrastructure grows.
How WZ-IT handles CVE monitoring
We offer CVE monitoring as part of our Managed Operations:
- Inventory — Which software runs in which version on which server?
- Monitoring Setup — OpenVAS for network scans, Trivy for containers, automated alerting
- Triage — For new CVEs: Does it affect our clients? How critical? Is it being actively exploited?
- Patching — Coordinated updates with maintenance windows, rollback strategy, verification
- Reporting — Monthly security report with all found and resolved vulnerabilities
No enterprise should learn about a CVSS 10.0 vulnerability from the news.
CVE monitoring for your infrastructure? We monitor your servers, containers and applications — and patch before it's too late. Schedule a consultation | CVE Monitoring Service
Related Guides
- Nextcloud Built-in CODE Server: Unauthenticated Command Injection (CVE-2026-110447)
- Metabase emergency patch: SQL injection at CVSS 10.0 - the case where a CVE feed alone would have reported nothing
- Vulnerability Management with OpenVAS & Greenbone CE — Installation and configuration
- Managed Operations: CVE Monitoring — Our service in detail
- Linux patch management: process, deadlines and evidence - how a CVE notice becomes a documented update
- Vulnerability scanning with OpenVAS - active testing of the systems as a complement to the inventory match
- SLA & Service Levels — Standard, Professional, Enterprise
- Security Audit — One-time security analysis of your infrastructure
