Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.6 CriticalCritical · CVSS 9+
Out-of-bounds write in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Out-of-bounds read in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use of uninitialized variable in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
- Command injection
>=2.4.0rc0, <2.12.0 · fixed in 2.12.0
GHSA-w3fx-mc44-mf6j · CVE-2026-45018 - CVSS 9.2 CriticalCritical · CVSS 9+
Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools
- Amazon strands-agents-tools
- CWE-1427
- CVSS 9.3 CriticalCritical · CVSS 9+
Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature
- alluxio
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching
- Authentication bypass
>=0.1.0, <4.14.0 || >=5.0.0-rc.0, <5.0.0-rc.10 · fixed in 4.14.0, 5.0.0-rc.10
GHSA-777c-2fxx-qr28 · CVE-2026-49757 - CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe Campaign Classic
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe Campaign Classic
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Campaign Classic
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
CVE-2026-19912
- Kaltura HTML5 Video Player, html5 library
- Path traversal
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
- Authentication bypass
<0.117.2 · fixed in 0.117.2
GHSA-8vh3-g2qg-2h2c · CVE-2026-55640 - CVSS 9.8 CriticalCritical · CVSS 9+
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
- Code injection
<0.2.1 · fixed in 0.2.1
GHSA-mw6r-2hvm-4rp2 · CVE-2026-55546 - CVSS 9.1 CriticalCritical · CVSS 9+
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
- Broken access control
- CWE-625
<4.6.58 · fixed in 4.6.58
GHSA-6g6r-q6gw-w8fg · CVE-2026-55536 - CVSS 9.8 CriticalCritical · CVSS 9+
File Upload in TRTEK Software's Software Repository Management
- TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
- OpenSSL
- CWE-354
- CVSS 9.8 CriticalCritical · CVSS 9+
Untrusted Sender DN Used as Format String in CMP Response Validation
- OpenSSL
- Memory corruption
- CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Si…
- miniorange.com SAML SSO Free for Joomla extension for Joomla
- miniorange.com SAML SSO Basic for Joomla extension for Joomla
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
WatchGuard Agent improper authentication allows unauthenticated remote code execution
- WatchGuard Agent
- Authentication bypass
- Weak cryptography or TLS
- CVSS 9.4 CriticalCritical · CVSS 9+
WatchGuard Agent path traversal allows unauthenticated remote code execution
- WatchGuard Agent
- Code injection
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
- Apache Software Foundation Apache Hive
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
- Apache Software Foundation Apache Hive
- Server-side request forgery (SSRF)
- CVSS 9.5 CriticalCritical · CVSS 9+
TYPO3-EXT-SA-2026-022: Server-Side Template Injection in extension "powermail" (powermail)
- Code injection
<10.9.3 || >=11.0.0, <12.6.1 || >=13.0.0, <13.2.1 · fixed in 10.9.3, 12.6.1, 13.2.1
PKSA-dhfp-j236-nf9h · CVE-2026-77136 - CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
- Weidmueller Interface IE-SR-2TX-WL
- Weidmueller Interface IE-SR-2TX-WL-4G-EU
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
- Cross-site scripting (XSS)
- CWE-116
>=4.0.0, <5.3.50 || >=5.4.0, <5.7.12 · fixed in 5.3.50, 5.7.12
PKSA-3fqv-nq39-s3wg · CVE-2026-107845 - CVSS 9.8 CriticalCritical · CVSS 9+
Stack buffer overflow in OCPP GetConfiguration key parsing
- zephyr
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Grav Login Plugin before 3.9.1 Email Enumeration via Registration
- getgrav grav-plugin-login
- Information disclosure
- CVSS 9.3 CriticalCritical · CVSS 9+
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
- grav
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
- vrana adminer
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimd…
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
- Cozmoslabs TranslatePress
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
- Nexcess The Events Calendar
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
- weDevs WP Project Manager
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
- A CPT ACPT (Pro) - Custom Post Types Plugin for WordPress
- Insecure deserialization
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability
- tophive UltimateAI
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability
- PixelYourSite Professional Boost
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability
- WBW WooBeWoo Product Filter Pro
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
CakePHP: Potential Authentication bypass with CookieAuthenticator
- cakephp authentication
- Authentication bypass
- Denial of service
- CVSS 9.4 CriticalCritical · CVSS 9+
RansomLook API Key Disclosure Through /admin/apikeys HTML Source
- ransomlook
- Information disclosure
- Hard-coded credentials
- CVSS 10.0 CriticalCritical · CVSS 9+
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
- Code injection
- CWE-693
<1.0.2 · fixed in 1.0.2
GHSA-xm98-3vcf-fph7 · CVE-2026-53710 - CVSS 9.4 CriticalCritical · CVSS 9+
Combodo iTop: Remote code execution using external auth variable value
- Combodo iTop
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
- CWE-20
>=4.11.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0
GHSA-v7h8-xhh6-gfj4 · CVE-2026-78329 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
- CWE-20
>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0
GHSA-m5r8-w65q-8wjf · CVE-2026-71300 - CVSS 9.1 CriticalCritical · CVSS 9+
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
- Path traversal
>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0
GHSA-2x37-89hj-2j95 · CVE-2026-66906 - CVSS 9.3 CriticalCritical · CVSS 9+
DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
- DrayTek Corporation VigorSwitch G2540xs
- DrayTek Corporation VigorSwitch P2540xs
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
- DrayTek Corporation VigorAP 918R
- DrayTek Corporation VigorAP 960C
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Stack-based buffer overflow in Google Nest
- Google Nest
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
- rconfig
- Authentication bypass
- CWE-1188
- CVSS 9.3 CriticalCritical · CVSS 9+
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter
- Netis Systems NC63
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter
- Netis Systems NC63
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
Konami's Metal Gear Online 3 contains a heap-based buffer overflow
- Konami Metal Gear Online 3
- Memory corruption