Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.8 CriticalCritical · CVSS 9+
CVE-2026-86793
- SGLang
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
- hugo
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get
- hugo
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo Bookmark Plugin Stored XSS via Chapter Names
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo LoginControl Stored XSS via PGP Public Key
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo CustomizeUser Stored XSS via field_name Parameter
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo Stored XSS via donationLink in watch page button
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo YPTWallet Stored XSS via CryptoWallet Configuration
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.2 CriticalCritical · CVSS 9+
WWBN AVideo Stored XSS via UserGroups setGroup_name
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.2 CriticalCritical · CVSS 9+
Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin
- Cloud Foundry Foundation UAA
- Cloud Foundry Foundation cf-deployment
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover
- advanced-customized-prompts
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
- teddy-bear-customize-addon
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
- teddy-bear-customize-addon
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
- mulika MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields.
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and comp…
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earl…
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missin…
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php
- SQL injection
- CVSS 7.7 HighCritical · CVSS 7+ and EPSS
OS Command Injection Vulnerability in Deco Devices
- TP-Link Systems Inc. Deco BE11000 V2
- TP-Link Systems Inc. Deco M9 Plus V2
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Traefik HTTP/3 Backend NTLM Connection Reuse
- Authentication bypass
- Broken access control
>=2.11.0, <2.11.57 · fixed in 2.11.57
GHSA-qqjf-53cj-pwvv · CVE-2026-88007 - CVSS 9.8 CriticalCritical · CVSS 9+
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- Authentication bypass
<1.75.1 · fixed in 1.75.1
GHSA-xwwr-4h3p-r22c · CVE-2026-88018 - CVSS 9.1 CriticalCritical · CVSS 9+
rclone: RC per-server auth-proxy bypass
- Broken access control
>=1.70.0, <1.75.1 · fixed in 1.75.1
GHSA-p569-5gjg-9cmj · CVE-2026-88044 - CVSS 9.1 CriticalCritical · CVSS 9+
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
- IBM Common Licensing
- CWE-1149
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM ContextForge MCP Gateway is affected by use of default credentials
- IBM ContextForge MCP Gateway
- CWE-1392
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 9.6 CriticalCritical · CVSS 9+
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Path traversal
- CVSS 9.6 CriticalCritical · CVSS 9+
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Authentication bypass
- CVSS 9.5 CriticalCritical · CVSS 9+
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
- Code injection
- Authentication bypass
<=3.8.50 · no fixed version yet
GHSA-hf57-cqmx-p4gr · CVE-2026-88062 - CVSS 9.1 CriticalCritical · CVSS 9+
Suricata http2: protocol-change type confusion can lead to denial of service
- OISF suricata
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Hard-coded credentials in Lenovo Health Application
- Lenovo Health Application
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Template injection in Forgejo
- Forgejo
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper signature verification in OCaml jose
- OCaml jose
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
- krakenjs passport-saml-encrypted
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
- krakenjs passport-saml-encrypted
- Weak cryptography or TLS
- CVSS 9.5 CriticalCritical · CVSS 9+
OS command injection in WebPros ConfigServer Security & Firewall and others
- WebPros ConfigServer Security & Firewall
- ConfigServer Security & Firewall
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Path traversal in WebPros Plesk
- WebPros Plesk
- Path traversal
- CVSS 9.2 CriticalCritical · CVSS 9+
OS command injection in WebPros ConfigServer Security & Firewall and others
- WebPros ConfigServer Security & Firewall
- ConfigServer Security & Firewall
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Time-of-check time-of-use race condition in WebPros Plesk
- WebPros Plesk
- Race condition
- CVSS 9.4 CriticalCritical · CVSS 9+
Improper access control in Dell ThinOS 10
- Dell ThinOS 10
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
OS command injection in Dell ThinOS 10
- Dell ThinOS 10
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
OS command injection in Dell ThinOS 10
- Dell ThinOS 10
- Command injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Command injection in Dell ThinOS 10
- Dell ThinOS 10
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
- knowns
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability
- Par avisverifies Verified Reviews (Avis Vérifiés)
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Renovate before 44.11.2 Credential Exfiltration via Link Header
- renovate
- mend renovate-ce
- Open redirect
- CVSS 9.2 CriticalCritical · CVSS 9+
Renovate before 44.11.2 Credential Exfiltration via Link Header
- renovate
- mend renovate-ce
- Open redirect
- CVSS 9.2 CriticalCritical · CVSS 9+
Renovate before 44.11.3 Credential Exfiltration via Link Header
- renovate
- mend renovate-ce
- Open redirect
- CVSS 9.2 CriticalCritical · CVSS 9+
Renovate before 44.11.3 Credential Exfiltration via Link Header
- renovate
- mend renovate-ce
- Open redirect
- CVSS 9.3 CriticalCritical · CVSS 9+
Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- traefik
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo AD_Server Stored XSS via log.php label parameter
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo LiveLinks Stored XSS via title and description fields
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo Stored XSS via Category Name and Icon Class
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo LoginControl Stored XSS via User-Agent Header
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
- Cap-go capgo.app
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Capgo Authorization Bypass via Stale Channel Permission Overrides
- Cap-go capgo.app
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in GIS Informatics' GisLab Laboratory Management System
- GIS Informatics GisLab Laboratory Management System
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4
- joomshaper.com SP Property extension for Joomla
- SQL injection