Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.4 CriticalCritical · CVSS 9+
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
- Google Cloud Application Integration
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
FAST FAC1200R MmtAtePrase stack-based overflow
- FAST FAC1200R
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow
- FAST FAC1200R
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
- Apache Software Foundation Apache Roller
- Insecure deserialization
- CVSS 9.9 CriticalCritical · CVSS 9+
Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
- Apache Software Foundation Apache Roller
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
Apache Roller: OAuth authorization endpoint trusts request-supplied identity
- Apache Software Foundation Apache Roller
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection
- aaPanel BaoTa
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
aaPanel BaoTa File Merge files.py merge_split_file command injection
- aaPanel BaoTa
- Other injection
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
aaPanel BaoTa Database Backup database.py InputSql os command injection
- aaPanel BaoTa
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Netcore NBR200V2 Tools Ping network_tools system os command injection
- Netcore NBR200V2
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Netcore NBR200V2 Web Management network_tools eval os command injection
- Netcore NBR200V2
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization
- Netcore NBR100V2
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection
- TOTOLINK N150RT
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication
- Seetong T8108
- Seetong T8108P
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Obot Quickstart Docker Deployment Unauthenticated Admin Access
- obot
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
HTTP Request Smuggling
- Citrix NetScaler ADC
- Citrix NetScaler Gateway
- HTTP request smuggling
- CVSS 9.5 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
- Citrix NetScaler ADC
- Citrix NetScaler Gateway
- Memory corruption
- CVSS 9.5 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
- Citrix NetScaler ADC
- Citrix NetScaler Gateway
- CWE-20
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
- Progressive Robot Ltd hMailServer
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Contrast before 1.16.0 Remote Attestation Relay Attack
- edgelesssys contrast
- Weak cryptography or TLS
- CVSS 9.4 CriticalCritical · CVSS 9+
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write
- D-Link DIR-895L
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
- themefic Ultra Addons for Contact Form 7
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
- cyberlord92 miniOrange OTP Login, Verification and SMS Notifications
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
- lomart.fr UP plugin for Joomla
- Path traversal
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
- lomart.fr UP plugin for Joomla
- Path traversal
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
- lomart.fr UP plugin for Joomla
- Code injection
- CVSS 9.5 CriticalCritical · CVSS 9+
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0
- Datasolution AcyMailing Enterprise extension for Joomla
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3
- joomlaboat.com YouTube Gallery extension for Joomla
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
- froxlor
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
Froxlor before 2.3.12 Privilege Escalation via Symlink
- froxlor
- Path traversal
- CVSS 9.4 CriticalCritical · CVSS 9+
Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
- froxlor
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
- kyverno
- CWE-441
- CVSS 9.2 CriticalCritical · CVSS 9+
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
- budibase server
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
- Flowise
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Flowise through 3.1.4 Authentication Bypass via SSO Email Match
- Flowise
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
- Addify Request a Quote for WooCommerce
- Unrestricted file upload
- CVSS 9.0 CriticalCritical · CVSS 9+
OpenClaw iOS Control UI TLS Pin Enforcement Bypass
- OpenClaw
- Weak cryptography or TLS
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated remote code execution through wikitext in ExternalData
- Wikimedia Foundation Mediawiki - ExternalData Extension
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
- tobychui zoraxy
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
- GestSup
- Unrestricted file upload
- CVSS 9.4 CriticalCritical · CVSS 9+
GLPI: RCE via Form import
- glpi
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
Zammad: Account takeover via unverified email matching during SSO auto-link
- zammad
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
- yzcheng90 X-SpringBoot
- CWE-1392
- CVSS 9.3 CriticalCritical · CVSS 9+
X-SpringBoot through 6.0 Authentication Bypass via Login Code
- yzcheng90 X-SpringBoot
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
- CWE-345
<1.7.4 || >=2.0.0-beta.1, <2.0.0-beta.4 · fixed in 1.7.4, 2.0.0-beta.4
GHSA-g7vj-c29h-3h5m · CVE-2026-92161 - CVSS 9.1 CriticalCritical · CVSS 9+
Piwigo: Authenticated RCE via File Upload in Logo Upload Feature
- Piwigo
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
- Piwigo
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
InvoicePlane: Remote Code Execution via Writable Templates Directory
- InvoicePlane
- File inclusion
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
- Zimbra Collaboration Suite (ZCS)
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
- Zimbra Collaboration Suite (ZCS)
- Path traversal
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
- Zimbra Collaboration Suite (ZCS)
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
- Zimbra Collaboration Suite (ZCS)
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
- Linux kernel
- CVSS 9.3 CriticalCritical · CVSS 9+
Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
- Kovid Goyal kitty
- Other injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
- Apache Software Foundation Apache Qpid Broker-J
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
- 101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
- Privilege escalation
- CVSS 9.1 CriticalCritical · CVSS 9+
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
- ladela Online Scheduling and Appointment Booking System – Bookly
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
- ivole Customer Reviews for WooCommerce
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verif…
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not v…
- Authentication bypass