Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability
- Royal Plugins SiteVault – Backup, Restore, Migration & Cloning
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability
- ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability
- Sergey AIWU
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
- floci
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
- miniorange otp verification
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability
- rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability
- Tickera
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability
- VillaTheme AFFI – Affiliate Marketing for WooCommerce
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
- ferdikoomen openapi-typescript-codegen
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
- chenhg5 cc-connect
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
>=0.0.0-0, <9.0.0 · fixed in 9.0.0
GHSA-4684-h2q9-2vcp - CVSS 9.1 CriticalCritical · CVSS 9+
Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
- Apache Software Foundation Apache DataSketches
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
- Apache Software Foundation Apache DataSketches
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
- Apache Software Foundation Apache DataSketches
- Memory corruption
- CWE-1284
- CVSS 9.8 CriticalCritical · CVSS 9+
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
- whyun WPCOM Member
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability
- ThemeREX Group Booklovers
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability
- ThemeREX Group Gutentype
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability
- Axiomthemes Balance
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability
- ThemeREX Group Camelia
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability
- ThemeREX Group Convex
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability
- ThemeREX Group Dwell
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability
- ThemeREX Group Edema
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability
- ThemeREX Group Greeny
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability
- ThemeREX Group Hogwords
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability
- ThemeREX Group Hygia
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability
- ThemeREX Group IPharm
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability
- ThemeREX Group Let's Play
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability
- ThemeREX Group Partiso
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability
- ThemeREX Group Rosalinda
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability
- ThemeREX Group Smart Casa
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability
- ThemeREX Group Smash
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability
- ThemeREX Group Tantra
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability
- ThemeREX Group Travesia
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability
- Axiomthemes Veto
- Insecure deserialization
- CVSS 9.1 CriticalCritical · CVSS 9+
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
- themeisle PPOM – Product Addons & Custom Fields for WooCommerce
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
- themefusion Avada (Fusion) Builder
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
- expivi 3D Product configurator for WooCommerce
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
- htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
- inilerm Advanced IP Blocker
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
- creativethemeshq Blocksy Companion
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection in JetBrains Exposed
- JetBrains Exposed
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session
- Privasys ra-tls-clients
- CWE-346
- CVSS 9.1 CriticalCritical · CVSS 9+
enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session
- Privasys enclave-os-virtual
- CWE-346
- CVSS 9.1 CriticalCritical · CVSS 9+
Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
- Privasys go
- CWE-346
- CVSS 9.1 CriticalCritical · CVSS 9+
Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
- Privasys rustls
- CWE-346
- CVSS 9.3 CriticalCritical · CVSS 9+
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
- Open redirect
- CWE-346
<3.14.0 · fixed in 3.14.0
GHSA-x34j-47hf-4xg7 · CVE-2026-108261 - CVSS 9.1 CriticalCritical · CVSS 9+
enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session
- Privasys enclave-os-mini
- CWE-346
- CVSS 9.3 CriticalCritical · CVSS 9+
Contao: Cross-site scripting in the comments bundle
- Cross-site scripting (XSS)
- CWE-116
>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12 · fixed in 5.3.50, 5.7.12
GHSA-628f-v4f6-p37r · CVE-2026-107845 - CVSS 9.1 CriticalCritical · CVSS 9+
Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)
- wizarr
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Astron Agent: Unsandboxed code-node leads to cross-tenant RCE
- iflytek astron-agent
- Code injection
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
- Code injection
>=1.9.10-0.20260421071512-7864e378f5cf, <1.9.10-0.20260728074146-a467ed652591 · fixed in 1.9.10-0.20260728074146-a467ed652591
GHSA-p393-cf76-4jmr · CVE-2026-107806 - CVSS 9.3 CriticalCritical · CVSS 9+
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
- Broken access control
>=0.24.0, <2.4.0 · fixed in 2.4.0
GHSA-rj9j-8772-4h6c · CVE-2026-68582 - CVSS 9.3 CriticalCritical · CVSS 9+
x64dbg-MCP Server exposes debugger operations to unauthenticated network clients
- duty1g x64dbg-mcp-server
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
- Path traversal
- Unrestricted file upload
<=0.5.0b3.dev101 · no fixed version yet
GHSA-fr26-jjhm-638c · CVE-2026-123815 - CVSS 9.2 CriticalCritical · CVSS 9+
Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
- smp46 pingvin-share-x
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Savannah lwIP SMTP client Classic Buffer Overflow
- Savannah lwIP SMTP client
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
- Red Lion Controls 700 Series
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format
- Red Lion Controls 700 Series
- CWE-257
- CVSS 9.3 CriticalCritical · CVSS 9+
PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code
- hotspotbilling phpnuxbill
- Authentication bypass