Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.3 CriticalCritical · CVSS 9+
BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
- BioStar BIOS Update Utility
- Memory corruption
- CWE-123
- CVSS 9.8 CriticalCritical · CVSS 9+
WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload
- Web to Print Online Designer
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where
- BioStar Temperature Monitor Utility
- Memory corruption
- CWE-123
- CVSS 9.3 CriticalCritical · CVSS 9+
BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
- BioStar VALKYRIE AURORA
- Memory corruption
- CWE-123
- CVSS 9.3 CriticalCritical · CVSS 9+
BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
- BioStar VIVID LED DJ
- Memory corruption
- CWE-123
- CVSS 9.4 CriticalCritical · CVSS 9+
Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow
- Netcore NBR200V2
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow
- Netcore NBR200V2
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Netcore NBR200V2 Backup Restore restore.cgi command injection
- Netcore NBR200V2
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
- Netcore NBR200V2
- Other injection
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary…
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary…
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code ex…
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpo…
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
- Netcore NBR200V2
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Netcore NBR200V2 LAN IP Configuration network_tools command injection
- Netcore NBR200V2
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection
- Netcore NBR200V2
- Other injection
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow
- D-Link DIR-868L
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
- OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla
- OrdaSoft.com OrdaSoft Joomla Gallery extension for Joomla
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
- OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla
- OrdaSoft.com OrdaSoft Joomla Gallery extension for Joomla
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
- OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla
- OrdaSoft.com OrdaSoft Joomla Gallery extension for Joomla
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Code injection in Vanderbilt University REDCap
- Vanderbilt University REDCap
- Path traversal
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
- Comfast CF-N1-S
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
NivoCart through 2.4.0 Predictable Administrator Password Reset Token
- nivocart
- Weak cryptography or TLS
- CVSS 9.4 CriticalCritical · CVSS 9+
Use after free in OISF Suricata
- OISF Suricata
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Type confusion in OISF Suricata
- OISF Suricata
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
D-Link R95 DHMAPI ssi system os command injection
- D-Link R95
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
- openpanel
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Totolink A3002MU formWsc command injection
- Totolink A3002MU
- Other injection
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route
- Botiga Pro
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Totolink A3002MU formWlWds buffer overflow
- Totolink A3002MU
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
- brechtvds WP Recipe Maker
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
- Gravity Forms
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Totolink A3002MU formWlEncrypt buffer overflow
- Totolink A3002MU
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Totolink A3002MU formWlAc buffer overflow
- Totolink A3002MU
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Totolink A3002MU formSchedule buffer overflow
- Totolink A3002MU
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
FluidSynth: Heap-based buffer overrun
- fluidsynth
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
- Cotonti
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
- 1Panel-dev CordysCRM
- Authentication bypass
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Authentication bypass
- CVSS 9.9 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
pg_partman has privilege escalation through SQL injection in create_partition_time()
- pgpartman pg_partman
- SQL injection
- Privilege escalation
- CVSS 9.9 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- SQL injection
- CVSS 9.0 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Insecure deserialization
- CVSS 9.9 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
IBM Sterling File Gateway is Vulnerable to Authentication Bypass
- IBM Sterling File Gateway
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
- ModelTC LightLLM
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
- Hongjing e-HR
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
- Weak cryptography or TLS
<3.10.1 · fixed in 3.10.1
GHSA-xcw4-53cc-hv32 · CVE-2026-59163