Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.8 CriticalCritical · CVSS 9+
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them
- CWE-178
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
- Apache Software Foundation Apache Kafka
- Memory corruption
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
- Apache Software Foundation Apache Kafka
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
- Apache Software Foundation Apache Kafka
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
- Apache Software Foundation Apache Kafka
- Weak cryptography or TLS
- CWE-345
- CVSS 9.8 CriticalCritical · CVSS 9+
Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
- Juniper Networks Session Smart Router
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
- Juniper Networks Session Smart Conductor
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
- Ultimate Member
- Insecure deserialization
- CVSS 9.4 CriticalCritical · CVSS 9+
Path Traversal in Wing WFTP Server leading to Remote Code Execution
- Wing Soft Technology Wing FTP Server
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
- Aman FunnelKit Automations
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability
- Crowd Favorite DXP ToolKit
- SQL injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Topluyo Desktop for Linux has an OS Command Injection issue
- topluyo App
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
HCL BigFix AEX is affected by multiple security vulnerabilities.
- HCL Software BigFix AEX
- Command injection
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
- Eclipse Foundation Eclipse Che
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
- Linux kernel
- CVSS 9.6 CriticalCritical · CVSS 9+
SQL injection in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- SQL injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Missing authorization in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
- Tactis NoviGest Desktop App
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Stack-based buffer overflow in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Hard-coded cryptographic key in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
SQL injection (SQLi) in the user authentication module of Futurum Software
- Futurum Software User Authentication Module
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authorization in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper authentication in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
- kleor Contact Manager
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
- Checkout Files Upload for WooCommerce
- Unrestricted file upload
- CVSS 9.4 CriticalCritical · CVSS 9+
Code injection in EagleCloud Aquila on-premises version
- EagleCloud Aquila
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
- Pie Register Premium
- Unrestricted file upload
- CVSS 9.2 CriticalCritical · CVSS 9+
llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
- ggml-org llama.cpp
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
- artbees Jupiter X Core
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
- FasterXML jackson-databind
- Insecure deserialization
- CVSS 9.6 CriticalCritical · CVSS 9+
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Google Chrome: Incorrect reference resolution in UI in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Type confusion in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
GRR vulnerable to Remote Code Execution Via PHP Code Injection
- JeromeDevome GRR
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- Code injection
>=3.12.0rc0, <3.17.0 · fixed in 3.17.0
GHSA-26p8-2jq9-3vq9 · CVE-2026-116692 - CVSS 9.1 CriticalCritical · CVSS 9+
Sunhillo SureLine Authentication Bypass via Session Cookie
- Sunhillo Corporation SureLine
- CWE-565
- CVSS 9.1 CriticalCritical · CVSS 9+
Calendar discovery accepted local file and remote network share locations
- Mozilla Thunderbird
- Open redirect
- CVSS 9.1 CriticalCritical · CVSS 9+
CVE-2026-118170
- Strapi Open Source and Enterprise Headless CMS
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
CVE-2026-118131
- GnuPG
- Broken access control
- CWE-379
- CVSS 9.9 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe Campaign Classic
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- Adobe Campaign Classic
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Campaign Classic
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe Campaign Classic
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Campaign Classic
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- Adobe Campaign Classic
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Campaign Classic
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Campaign Classic
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
eMudhra Compromised Certificate vulnerability impacts HCL Notes Client
- HCLSoftware Notes Client
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
Integer overflow or wraparound in EPICS Base
- The EPICS Community EPICS Base
- Memory corruption