Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.8 CriticalCritical · CVSS 9+
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
- jfarthing84 Theme My Login
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
- joedolson My Calendar – Accessible Event Manager
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
- properfraction MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
- kitae-park Mang Board
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection in Wheels
- Wheels
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
- CWE-426
- CVSS 9.8 CriticalCritical · CVSS 9+
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
- magicblack MacCMS
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
- JuggleIM
- CWE-1392
- CVSS 9.3 CriticalCritical · CVSS 9+
Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
- coleam00 Archon
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route
- OpenHealth
- Authentication bypass
- CVSS 9.5 CriticalCritical · CVSS 9+
BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration
- BMC Helix Network Management
- CWE-305
- CVSS 9.3 CriticalCritical · CVSS 9+
Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials
- Jooan JA-A12
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
- Apache Software Foundation Apache Airflow SSH provider
- Apache Software Foundation Apache Airflow SFTP provider
- CWE-322
- CVSS 7.0 HighCritical · KEVKEV
Ivanti Connect Secure: Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts…
- Ivanti Connect Secure
- CWE-829
- CVSS 9.6 CriticalCritical · CVSS 9+
EnergizeLab Station Middleware Admin APIs Missing Role Checks
- EnergizeLab station-middleware
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
- EnergizeLab FastAPI AI inference server
- Authentication bypass
- CVSS 9.9 CriticalCritical · CVSS 9+
EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
- EnergizeLab station-middleware
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
- EnergizeLab FastAPI AI inference server
- Path traversal
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
- BeyondTrust Remote Support
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- Cross-site scripting (XSS)
>=1.143.12, <1.168.60 · fixed in 1.168.60
GHSA-qx66-fv34-fjm8 · CVE-2026-102989 - CVSS 10.0 CriticalCritical · CVSS 9+
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
- CWE-693
>=4.4.0, <5.8.8 · fixed in 5.8.8
GHSA-2cvf-wqm6-wr9g · CVE-2026-94603 - CVSS 9.9 CriticalCritical · CVSS 9+
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
- Privilege escalation
- Server-side request forgery (SSRF)
<=1.5.0 · no fixed version yet
GHSA-637c-6jxx-4rwm · CVE-2026-77524 - CVSS 9.9 CriticalCritical · CVSS 9+
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
- Broken access control
>=2.10.0, <=2.14.21 · no fixed version yet
GHSA-fmxq-cgp8-87wp · CVE-2026-77459 - CVSS 9.2 CriticalCritical · CVSS 9+
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
- Authentication bypass
- Broken access control
<25.4.0 · fixed in 25.4.0
GHSA-qj98-gp63-54xj · CVE-2026-102748 - CVSS 9.8 CriticalCritical · CVSS 9+
Vitess vttablet /twopcz reflected XSS
- Cross-site scripting (XSS)
- CWE-116
<0.23.5 || >=0.24.0, <0.24.2 · fixed in 0.23.5, 0.24.2
GHSA-v75v-6fpf-gvw8 · CVE-2026-104252 - CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
- Netgate pfSense CE
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
OpenNMS REST authorization bypass via non-canonical HTTP method
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- Broken access control
- CWE-204
- CVSS 9.1 CriticalCritical · CVSS 9+
joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json
- authlib joserfc
- Authentication bypass
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox
- containerd runwasi
- Insecure deserialization
- CVSS 9.1 CriticalCritical · CVSS 9+
Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates
- msgbyte tianji
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS
- Nutanix Acropolis Operating System (AOS)
- Authentication bypass
- CWE-302
- CVSS 9.4 CriticalCritical · CVSS 9+
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
- AWS Amazon Neptune Engine
- Insecure deserialization
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Wavlink WN530HG4B api.cgi heap-based overflow
- Wavlink WN530HG4B
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Template injection in WebPros SolusVM 2
- WebPros SolusVM 2
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
- opnsense core
- Path traversal
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection
- Wavlink WL-WN530BE2-A
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
- espocrm
- Insecure deserialization
- CVSS 8.4 HighCritical · KEVKEV
Uncontrolled search path in Siemens Software Center
- Siemens Software Center
- CWE-427
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability
- Link Whisper INC Link Whisper Free
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability
- Shabti Kaplan Frontend Admin by DynamiApps
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
- Link Whisper INC Link Whisper Free
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
ipv4: validate checksum_start before completing checksum
- Linux kernel
- CWE-20
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
- Kitae Park Mang Board WP
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
ipv4: free inet_opt and ireq_opt after an RCU grace period
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
- WP ManageNinja LLC Fluent CRM
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
- TMS Amelia
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Jetty EthereumAuthenticator unanchored login-path matching bypasses authentication and role constraints
- Authentication bypass
- Broken access control
Published by the maintainers · not yet reviewed by GitHub
>=12.1.0, <=12.1.12 · fixed in 12.1.13
GHSA-6m7j-pjmp-crgq · CVE-2026-19863 - CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated remote code execution vulnerability
- QNAP Systems Inc. Qsirch
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
Pre-Authentication Command Injection
- QNAP Systems Inc. HybridDesk Station
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Import Symlink Following Remote Code Execution Vulnerability in QuMagie
- QNAP Systems Inc. QuMagie
- CWE-61
- CVSS 9.3 CriticalCritical · CVSS 9+
Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer
- QNAP Systems Inc. sMedio DTCP MOVE
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Authentication bypass in Stela by Diaple Networking
- Diaple Stela
- CWE-565
- CVSS 9.4 CriticalCritical · CVSS 9+
An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
- Mitsubishi Electric Corporation GENESIS64
- Mitsubishi Electric Iconics Digital Solutions GENESIS64
- Privilege escalation
- CVSS 9.2 CriticalCritical · CVSS 9+
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
- Mitsubishi Electric Corporation GENESIS
- Mitsubishi Electric Iconics Digital Solutions GENESIS
- CWE-640
- CVSS 9.2 CriticalCritical · CVSS 9+
Deserialization of untrusted data in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
Multiple jail filesystem root escapes
- FreeBSD
- CWE-273
- CWE-281
- CVSS 9.8 CriticalCritical · CVSS 9+
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
- User Rights Access Manager
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- Unrestricted file upload