Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.8 CriticalCritical · CVSS 9+
Heap-based Buffer Overflow Vulnerability in JP1/Base
- Hitachi JP1/Base
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
- balbooa.com Gridbox extension for Joomla
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
- balbooa.com Gridbox extension for Joomla
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
- Qode Themes Qode Membership
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
- SMCI X12SPI
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root descrip…
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
- rajnandan1 kener
- Hard-coded credentials
- CVSS 10.0 CriticalCritical · CVSS 9+
TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
- TOTOLINK A950RG
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
TOTOLINK A950RG firewall.so apmib_set command injection
- TOTOLINK A950RG
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection
- TOTOLINK A950RG
- Other injection
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Out-of-bounds write in Apple macOS
- Apple macOS
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Out-of-bounds write in Apple macOS
- Apple macOS
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
Use after free in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Buffer overflow in Apple macOS
- Apple macOS
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Path traversal in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Path traversal
- CVSS 9.0 CriticalCritical · CVSS 9+
Path traversal in Apple macOS
- Apple macOS
- Path traversal
- CVSS 9.0 CriticalCritical · CVSS 9+
Out-of-bounds read in Apple macOS
- Apple macOS
- Memory corruption
- CVSS 9.0 CriticalCritical · CVSS 9+
Improper access control in Apple macOS
- Apple macOS
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Buffer overflow in Apple macOS
- Apple macOS
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
Buffer overflow in Apple macOS
- Apple macOS
- Memory corruption
- CVSS 10.0 CriticalCritical · CVSS 9+
Protection mechanism failure in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- CWE-693
- CVSS 9.4 CriticalCritical · CVSS 9+
TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
- TOTOLINK A950RG
- Other injection
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
- HashiCorp Tooling
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
BUG-000187511 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
- padok-team burrito
- Authentication bypass
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
- OpenHands Software Agent SDK
- CWE-1327
- CVSS 9.3 CriticalCritical · CVSS 9+
Improper Privilege Assignment in boneIO
- boneIO black_debian_images
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
- Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)
- Path traversal
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Avocent ACS8000 wsserver command injection
- Vertiv Avocent ACS8000
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
- Weak cryptography or TLS
>=1.24.0, <4.9.0 · fixed in 4.9.0
EEF-CVE-2026-115693 · CVE-2026-115693 - CVSS 9.6 CriticalCritical · CVSS 9+
Authentication bypass in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox PaaS
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Shared SSH Authentication Key in vSolution Matrix File Sharing
- WolfVision Cynap Pro, Cynap Core Pro
- WolfVision Cynap, Cynap Core
- CWE-797
- CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated RCE Vulnerability in WolfProt interface implementation
- WolfVision Cynap Pure (Next Gen), Cynap Bridge
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
- huangxd- danmu_api
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
- maccmspro maccms10
- magicblack maccms10
- CWE-640
- CVSS 9.9 CriticalCritical · CVSS 9+
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.
- Code injection
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
Improper Authentication Vulnerability in CreditNirvana Collections Platform
- CreditNirvana Collections Platform (CollectionWorkz)
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro Dnsmasq crlf injection
- Oray Pugongying X5 Pro
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro L2TP Authentication crlf injection
- Oray Pugongying X5 Pro
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection
- Oray Pugongying X5 Pro
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro Dnsmasq crlf injection
- Oray Pugongying X5 Pro
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro SNMP snmp_set crlf injection
- Oray Pugongying X5 Pro
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro Ser2net crlf injection
- Oray Pugongying X5 Pro
- Other injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Yoosee GM8135S Camera Secure Boot signature verification
- Yoosee GM8135S Camera
- Weak cryptography or TLS
- CWE-345
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections
- HTTP request smuggling
- CVSS 9.2 CriticalCritical · CVSS 9+
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- grokability snipe-it
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
- parse-community parse-server
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
- Datawiza Proxy Auth Plugin
- Privilege escalation
- CVSS 9.4 CriticalCritical · CVSS 9+
Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
- Unitree Robotics Unitree Go2
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Broken or risky cryptographic algorithm in Oracle Corporation Oracle Java SE and others
- Oracle Corporation Oracle Java SE
- Oracle Corporation Oracle GraalVM for JDK
- Weak cryptography or TLS
- CVSS 9.9 CriticalCritical · CVSS 9+
Forged signed tokens let any registered user take over other users and organizations
- GitroomHQ postiz-app
- Authentication bypass
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Distrust compromised intermediate certificates in ssl module
- Python Software Foundation CPython
- CWE-299
- CVSS 9.6 CriticalCritical · CVSS 9+
Path traversal in post media lets any registered user read server files
- GitroomHQ postiz-app
- Path traversal
- Other injection
- CVSS 9.2 CriticalCritical · CVSS 9+
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
- open62541
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability
- Paytium
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
- WPFactory Product Filter by WBW
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
- Tribulant Software Newsletters
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
- Tribulant Software Newsletters
- SQL injection