Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.1 CriticalCritical · CVSS 9+
Microsoft Entra ID Elevation of Privilege Vulnerability
- Microsoft Entra
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
- Microsoft Entra
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Copilot Studio Elevation of Privilege Vulnerability
- Microsoft Copilot Studio
- Weak cryptography or TLS
- CVSS 10.0 CriticalCritical · CVSS 9+
Azure AI Language Elevation of Privilege Vulnerability
- Microsoft Azure AI Language Authoring
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents
- Information disclosure
- Broken access control
<0.0.0-20260724091654-82e9ded423e4 · fixed in 0.0.0-20260724091654-82e9ded423e4
GHSA-vpjw-wf5h-cgpq · CVE-2026-72804 - CVSS 9.3 CriticalCritical · CVSS 9+
MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length
- themoos core-moos
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
- moos-ivp
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders
- moos-ivp
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment
- moos-ivp
- CWE-345
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping
- moos-ivp
- CWE-345
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration
- themoos essential-moos
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
- themoos core-moos
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE
- themoos essential-moos
- CWE-494
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names
- moos-ivp
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
- moos-ivp
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR
- themoos core-moos
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)
- Broken access control
<0.0.0-20260723013612-ba948639d7f6 · fixed in 0.0.0-20260723013612-ba948639d7f6
GHSA-mw8r-mw84-88v2 · CVE-2026-72810 - CVSS 9.9 CriticalCritical · CVSS 9+
SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle
- SQL injection
<0.0.0-20260723004839-1a5b3431d5ab · fixed in 0.0.0-20260723004839-1a5b3431d5ab
GHSA-q2vg-7qgx-x5fc · CVE-2026-72811 - CVSS 9.4 CriticalCritical · CVSS 9+
D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection
- D-Link DNS-320 ShareCenter
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
python-jose algorithm confusion guard bypassed by DER-encoded public keys
- Weak cryptography or TLS
<=3.5.0 · no fixed version yet
GHSA-3qf3-8w2g-rqmx · CVE-2024-33663 - CVSS 9.2 CriticalCritical · CVSS 9+
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
- Authentication bypass
<0.0.0-20260721020826-2d069dce84a2 · fixed in 0.0.0-20260721020826-2d069dce84a2
GHSA-7j72-f6wg-cxw6 · CVE-2026-68584 - CVSS 9.2 CriticalCritical · CVSS 9+
SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered
- Broken access control
<0.0.0-20260721014413-f45749a7ef6e · fixed in 0.0.0-20260721014413-f45749a7ef6e
GHSA-36v8-mpjm-8j5r · CVE-2026-68586 - CVSS 9.2 CriticalCritical · CVSS 9+
SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check
- Broken access control
<0.0.0-20260721013353-69db783b782a · fixed in 0.0.0-20260721013353-69db783b782a
GHSA-69mh-gvh4-8gp7 · CVE-2026-68587 - CVSS 9.4 CriticalCritical · CVSS 9+
D-Link DNS-340L CGI dropbox.cgi os command injection
- D-Link DNS-340L
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
- SQL injection
<0.0.0-20260721004815-cf42dd5680c8 · fixed in 0.0.0-20260721004815-cf42dd5680c8
GHSA-fph3-ghq9-vw66 · CVE-2026-69083 - CVSS 9.4 CriticalCritical · CVSS 9+
D-Link DNS-340L Add-On Center addon_center.cgi os command injection
- D-Link DNS-340L
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write
- SQL injection
<0.0.0-20260721002947-23a17d44b5f3 · fixed in 0.0.0-20260721002947-23a17d44b5f3
GHSA-vh22-h7hf-www7 · CVE-2026-69084 - CVSS 9.6 CriticalCritical · CVSS 9+
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Out-of-bounds write in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 8.8 HighCritical · KEVKEV
Type confusion in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-fg9p-mrxr-hvq7 · CVE-2026-62681 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-88f2-fpv8-89q2 · CVE-2026-62682 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via schema default -> zod module-level template literal
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-w727-8j6c-2rj4 · CVE-2026-72717 - CVSS 9.3 CriticalCritical · CVSS 9+
Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
- peppermint
- Hard-coded credentials
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via array-items default -> zod module-level template literal
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-2h9g-j24r-h63g · CVE-2026-71869 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-8j6p-r8jg-mxqh · CVE-2026-71871 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- SQL injection
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-2w86-xfrc-g85r · CVE-2026-71867 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-3575-w9fc-c2j6 · CVE-2026-71868 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-653q-5476-x79g · CVE-2026-71865 - CVSS 9.3 CriticalCritical · CVSS 9+
R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
- SciPhi-AI R2R
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
- Code injection
- CWE-116
<8.21.0 · fixed in 8.21.0
GHSA-6437-gxhq-pqv8 · CVE-2026-71864 - CVSS 9.1 CriticalCritical · CVSS 9+
GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
- core-geonetwork
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
unstructured: Server-Side Request Forgery in the URL-based partitioning
- Open redirect
- Server-side request forgery (SSRF)
>=0.4.7, <0.24.0 · fixed in 0.24.0
GHSA-4mvj-m6j5-pmf7 · CVE-2026-71428 - CVSS 9.8 CriticalCritical · CVSS 9+
WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
- eyecix JobSearch
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability
- Bricksforge
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability
- Paolo GeoDirectory
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability
- e4jvikwp VikAppointments Services Booking Calendar
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
- WPFunnels Mail Mint
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability
- YITH Request a Quote for WooCommerce Premium
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
- Cross-site scripting (XSS)
<0.0.0-20260714095344-f08dee71ba8e · fixed in 0.0.0-20260714095344-f08dee71ba8e
GHSA-99rq-75j6-5j9f · CVE-2026-66394 - CVSS 9.3 CriticalCritical · CVSS 9+
Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- Avaiga taipy
- CWE-1385
- CVSS 9.3 CriticalCritical · CVSS 9+
CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
- dianping cat
- CWE-565
- CVSS 9.5 CriticalCritical · CVSS 9+
MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
- misp
- Hard-coded credentials
- CVSS 9.3 CriticalCritical · CVSS 9+
Tenda HG10 Boa Web Server formLogin buffer overflow
- Tenda HG10
- Memory corruption
- CVSS 9.5 CriticalCritical · CVSS 9+
Improper certificate validation in Eclipse Foundation Eclipse Arrowhead
- Eclipse Foundation Eclipse Arrowhead
- Authentication bypass
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0
- joodb.feenders.de JooDatabase Lite extension for Joomla
- SQL injection
- CVSS 9.5 CriticalCritical · CVSS 9+
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
- j2commerce.com J2Store extension for Joomla
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
- WWBN AVideo
- Privilege escalation