Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.6 CriticalCritical · CVSS 9+
Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- Adobe Connect Desktop App
- Adobe Connect Android Mobile App
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
eMudhra Compromised Certificate vulnerability impacts HCL Domino Server
- HCLSoftware Domino Server
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
- Veeam Backup and Replication
- CWE-636
- CVSS 9.0 CriticalCritical · CVSS 9+
SQL injection in Veeam Backup for Microsoft 365
- Veeam Backup for Microsoft 365
- SQL injection
- CVSS 9.6 CriticalCritical · CVSS 9+
WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability
- Tribulant Software Newsletters
- Cross-site request forgery (CSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
- WatchGuard Fireware OS
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution
- WatchGuard Fireware OS
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
- WatchGuard Fireware OS
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
- WatchGuard Fireware OS
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write
- WatchGuard Fireware OS
- Memory corruption
- Authentication bypass
- CVSS 9.5 CriticalCritical · CVSS 9+
Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution
- WatchGuard Fireware OS
- Memory corruption
- CWE-1284
- CVSS 9.2 CriticalCritical · CVSS 9+
Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
- WatchGuard Fireware OS
- Command injection
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- Code injection
- CWE-829
>=0.7.3, <0.31.0 · fixed in 0.31.0
GHSA-h3rc-6mm3-gc2m · CVE-2026-114053 - CVSS 9.1 CriticalCritical · CVSS 9+
better-auth: OAuth Proxy lets an attacker sign in as another user
- Authentication bypass
- CWE-345
>=1.5.0-beta.12, <1.7.7 · fixed in 1.7.7
GHSA-r4xp-prcw-77qf · CVE-2026-110864 - CVSS 9.3 CriticalCritical · CVSS 9+
better-auth: OAuth state can be used as a Magic Link to sign in as another user
- Authentication bypass
>=1.4.0-beta.18, <1.7.7 · fixed in 1.7.7
GHSA-965c-763c-88jm · CVE-2026-110862 - CVSS 9.2 CriticalCritical · CVSS 9+
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- Command injection
>=3.1.30, <3.2.0 · fixed in 3.2.0
GHSA-f9j4-qggq-h239 · CVE-2026-110858 - CVSS 9.9 CriticalCritical · CVSS 9+
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- Privilege escalation
- CWE-345
>=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2 · fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2
GHSA-7hp6-4w63-5g45 · CVE-2026-114612 - CVSS 9.1 CriticalCritical · CVSS 9+
Authlib: empty signatures validation in JWS JSON deserialization
- Weak cryptography or TLS
- CWE-20
<1.9.0 · fixed in 1.9.0
GHSA-6v38-4h7w-rj9h · CVE-2026-96760 - CVSS 9.1 CriticalCritical · CVSS 9+
Frame poisoning in the Layout component
- Mozilla Firefox
- CWE-451
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape due to use-after-free in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape due to use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Invalid pointer in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Privilege escalation in the Toolkit component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape due to use-after-free in the Print Preview component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect boundary conditions in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect boundary conditions in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use-after-free in the DOM: HTML Parser component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Invalid pointer in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Privilege escalation due to incorrect boundary conditions in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Sandbox escape in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.3 CriticalCritical · CVSS 9+
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
- CWE-20
- CWE-682
<1.6.1 · fixed in 1.6.1
GHSA-6hp3-vr39-rqw8 · CVE-2026-48705 - CVSS 9.1 CriticalCritical · CVSS 9+
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
- CWE-20
- CWE-1284
<0.52.0 · fixed in 0.52.0
GHSA-px68-xx5g-48q5 · CVE-2026-46350 - CVSS 9.3 CriticalCritical · CVSS 9+
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
- spesmilo electrum
- Race condition
- CVSS 9.3 CriticalCritical · CVSS 9+
nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret
- buqiyuan nest-admin
- Hard-coded credentials
- CVSS 10.0 CriticalCritical · CVSS 9+
Missing authentication in NVIDIA NeMo Agent Toolkit
- NVIDIA NeMo Agent Toolkit
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
- Eclipse Foundation Eclipse ioFog
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
- @fastify/express
- CWE-436
- CVSS 9.3 CriticalCritical · CVSS 9+
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
- redaxo core
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Authentication Bypass by Spoofing Vulnerability in HiRDB
- Hitachi HiRDB Server Version 10
- Hitachi HiRDB Server Version 9
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing Authentication for Critical Function Vulnerability in HiRDB
- Hitachi HiRDB Server Version 10
- Hitachi HiRDB Server Version 9
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Stack-based Buffer Overflow Vulnerability in HiRDB
- Hitachi HiRDB Server Version 10
- Hitachi HiRDB Server Version 9
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Heap-based Buffer Overflow Vulnerability in HiRDB
- Hitachi HiRDB Server Version 10
- Hitachi HiRDB Server Version 9
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
OS Command Injection Vulnerability in HiRDB
- Hitachi HiRDB Server Version 10
- Hitachi HiRDB Server Version 9
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Stack-based Buffer Overflow Vulnerability in HiRDB
- Hitachi HiRDB Server Version 10
- Hitachi HiRDB Server Version 9
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Hitachi JP1/Automatic Job Management System 3 - Agent
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Hitachi JP1/Automatic Job Management System 3 - Agent
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Hitachi JP1/Automatic Job Management System 3 - Agent
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Hitachi JP1/Automatic Job Management System 3 - Agent
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Out-of-bounds Write Vulnerability in JP1 Products
- Hitachi JP1/Integrated Management 3 - Manager
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Heap-based Buffer Overflow Vulnerability in JP1 Products
- Hitachi JP1/Integrated Management 3 - Manager
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Stack-based Buffer Overflow Vulnerability in JP1 Products
- Hitachi JP1/Integrated Management 3 - Manager
- Hitachi JP1/Automatic Job Management System 3 - Manager
- Memory corruption