Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Missing authorization in Google Chrome
- Google Chrome
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Use after free in Google Android
- Google Android
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Path traversal in Dell System Update
- Dell System Update
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE
- SPIP Crayons Plugin
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Payload: Field access control bypass on auth collections
- payload
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Payload: Prototype pollution in Payload Import Export plugin
- Prototype pollution
>=3.0.0, <3.88.0 || >=4.0.0-canary.0, <4.0.0-canary.27 · fixed in 3.88.0, 4.0.0-canary.27
GHSA-qf28-8hc6-vwrp · CVE-2026-105844 - CVSS 9.8 CriticalCritical · CVSS 9+
Payload: SQL Injection in SQLite and Postgres
- SQL injection
>=3.0.0, <3.88.0 || >=4.0.0-canary.0, <4.0.0-canary.27 · fixed in 3.88.0, 4.0.0-canary.27
GHSA-v49j-62m6-pgrr · CVE-2026-105845 - CVSS 9.1 CriticalCritical · CVSS 9+
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
- Weak cryptography or TLS
<2.4.20 || >=2.5.0, <2.5.11 || >=2.6.0, <2.6.1 · fixed in 2.4.20, 2.5.11, 2.6.1
GHSA-w5f4-fx9m-m4q7 · CVE-2026-105794 - CVSS 9.6 CriticalCritical · CVSS 9+
Template injection in Dell Container Storage Modules
- Dell Container Storage Modules
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Hard-coded credentials in Dell Container Storage Modules
- Dell Container Storage Modules
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
Hard-coded credentials in Dell Container Storage Modules
- Dell Container Storage Modules
- Hard-coded credentials
- CVSS 9.9 CriticalCritical · CVSS 9+
Improper privilege management in Dell Container Storage Modules (CSM)
- Dell Container Storage Modules (CSM)
- Privilege escalation
- CVSS 10.0 CriticalCritical · CVSS 9+
Missing authentication in Dell Container Storage Modules
- Dell Container Storage Modules
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
Missing authentication in Dell Container Storage Modules (CSM)
- Dell Container Storage Modules (CSM)
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
- microsoft UFO
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service
- kvcache-ai Mooncake
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
OS command injection in Progress Software Autonomous REST Connector GenAI Agents
- Progress Software Autonomous REST Connector GenAI Agents
- Command injection
- CVSS 9.2 CriticalCritical · CVSS 9+
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
- Command injection
>=1.8.4, <1.11.0 · fixed in 1.11.0
GHSA-pqg4-j6r4-53mv · CVE-2026-102422 - CVSS 10.0 CriticalCritical · CVSS 9+
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
- Code injection
- Privilege escalation
<1.10.1 · fixed in 1.10.1
GHSA-8qpj-27x8-pwpq · CVE-2026-10561 - CVSS 9.1 CriticalCritical · CVSS 9+
PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint
- planka
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Mitigation bypass in the File Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.2 CriticalCritical · CVSS 9+
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
- smarty
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
RDMA/siw: Bound fragmented header copies by the remaining length
- Linux kernel
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
- reputeinfosystems ARMember Premium
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
- p-themes Porto Theme - Functionality
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability
- Weblizar – WordPress Themes & Plugin Newsletter Subscription Form – User Subscriptions Form, Capture Email
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
- Data443 Risk Mitigation, Inc. GDPR Framework By Data443
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
- brewlabs SendPress Newsletters
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
- Serhii Pasyuk Gmedia Photo Gallery
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability
- AmentoTech Doctreat Core
- Privilege escalation
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
- AmentoTech Doctreat
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability
- RadiusTheme Radius Booking — Booking Calendar for Appointments & Services
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability
- eLightUp Meta Box AIO
- Privilege escalation
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability
- AmentoTech Workreap Core
- Unrestricted file upload
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability
- AmentoTech Taskbot
- Unrestricted file upload
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability
- revmakx WP Duplicate
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability
- AmentoTech Taskbot
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability
- Booknetic
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability
- Kognetiks Chatbot for WordPress
- Unrestricted file upload
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability
- JMAPlugins WooCommerce Designer Pro
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability
- BookingWP WooCommerce Appointments
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Information Disclosure Vulnerability in Schmooze dating mobile Application
- Schmooze dating mobile Application
- Hard-coded credentials
- CVSS 9.4 CriticalCritical · CVSS 9+
Tenda AC5 Wifi setWifi stack-based overflow
- Tenda AC5
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Missing authentication for critical function in the aas-edge-client REST API
- Murrelektronik Software AAS Edge Client all versions
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
- TOTOLINK X6000R
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field.
- CWE-20
- CVSS 9.2 CriticalCritical · CVSS 9+
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
- Command injection
- CWE-184
<2.0.1 · fixed in 2.0.1
GHSA-v5rq-49vh-5v5c · CVE-2026-102829 - CVSS 9.2 CriticalCritical · CVSS 9+
simple-git unsafe-operation guard does not block trailer command configuration
- Command injection
- CWE-184
>=3.15.0, <4.0.1 · fixed in 4.0.1
GHSA-x6jw-m9v5-85vh · CVE-2026-102828