Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.1 CriticalCritical · CVSS 9+
Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId
- ADK TypeScript (@google/adk)
- Path traversal
- CVSS 9.4 CriticalCritical · CVSS 9+
aaPanel File Manager common.py ExecShell os command injection
- aaPanel
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
- giuseppe99barchetta SuggestArr
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password
- networknt light-4j
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
- froxlor
- Path traversal
- CVSS 9.2 CriticalCritical · CVSS 9+
FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
- FlexGet
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
Apache CouchDB: Admin credentials leading to code execution as operating system user
- Apache Software Foundation Apache CouchDB
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
- CWE-1284
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Tomcat: AJP response mix-up
- Apache Software Foundation Apache Tomcat
- CWE-127
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
- Apache Software Foundation Apache Tomcat
- Race condition
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
- Apache Software Foundation Apache Tomcat
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect boundary conditions in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
- DrayTek Vigor2960
- Other injection
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Eclipse ioFog operator WebSocket accepts an unverified JWT
- Eclipse Foundation Eclipse ioFog
- Weak cryptography or TLS
- CVSS 9.4 CriticalCritical · CVSS 9+
DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
- DrayTek Vigor2960
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
- DrayTek Vigor2960
- Other injection
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
- Red Hat StreamsHub Console for Apache Kafka®
- Red Hat streams for Apache Kafka 2
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
Unblu Spark Authorization Bypass in Configuration Cascade Operations
- Unblu inc. Unblu Spark
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Weak password recovery in Advantech ADAM-3600
- Advantech ADAM-3600
- CWE-640
- CVSS 9.3 CriticalCritical · CVSS 9+
Improper authentication in Advantech ADAM-3600
- Advantech ADAM-3600
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Stack-based buffer overflow in Advantech ADAM-3600
- Advantech ADAM-3600
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Command injection in Advantech ADAM-3600
- Advantech ADAM-3600
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Improper check for unusual conditions in Signal RingRTC
- Signal RingRTC
- CWE-754
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper authentication in Apple macOS
- Apple macOS
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access
- letta
- CWE-1188
- CVSS 9.3 CriticalCritical · CVSS 9+
DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
- eosphoros-ai DB-GPT
- CWE-1392
- CVSS 9.3 CriticalCritical · CVSS 9+
DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
- eosphoros-ai DB-GPT
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents
- EvoScientist
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint
- chatchat-space Langchain-Chatchat
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
- Tracer-Cloud opensre
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
- cas-bigdatalab piflow
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
H3C Magic NX15 RPC esps write code injection
- H3C Magic NX15
- Other injection
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
H3C Magic NX15 usrlist sub_416874 os command injection
- H3C Magic NX15
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
- grav
- CWE-749
- CVSS 9.3 CriticalCritical · CVSS 9+
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
- getgrav grav-plugin-api
- Denial of service
- CVSS 9.3 CriticalCritical · CVSS 9+
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
- cms
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend
- CognicellAI Cognition
- Authentication bypass
- CWE-1188
- CVSS 9.1 CriticalCritical · CVSS 9+
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack
- CCC-Attestation attested-tls-poc
- CWE-346
- CVSS 10.0 CriticalCritical · CVSS 9+
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
- Broken access control
- CWE-185
>=3.0.0, <3.2.4 · fixed in 3.2.4
GHSA-f8c7-rwf9-fmgm · CVE-2026-111057 - CVSS 9.8 CriticalCritical · CVSS 9+
Mercury: Unauthenticated Remote Code Execution via /api/kernels
- Broken access control
<3.2.6 · fixed in 3.2.6
GHSA-rv4m-xm3f-3ccq · CVE-2026-111058 - CVSS 9.6 CriticalCritical · CVSS 9+
Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
- Eptura Archibus
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
- RankMath Rank Math SEO PRO
- CWE-506
- CVSS 9.3 CriticalCritical · CVSS 9+
Camunda Expression Injection via orQueries RCE
- Camunda 7
- Command injection
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
FlyCms through commit edfdf724 Default Super Administrator Credentials
- sunkaifei FlyCms
- CWE-1392
- CVSS 9.3 CriticalCritical · CVSS 9+
CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules
- operacle checkcle
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Bit-packing in Cranelift compiler causes silent overflow and miscompilation
- Memory corruption
- CWE-197
Published by the maintainers · not yet reviewed by GitHub
>=0.0.0-0, <36.0.19 || >=37.0.0, <43.0.0 · fixed in 36.0.19, 43.0.0
GHSA-897f-g5gm-fmxm · CVE-2026-115889 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
- Apache Software Foundation Apache Johnzon
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
- Apache Software Foundation Apache Camel
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Answer: Reaction API authorization bypass for restricted content
- Apache Software Foundation Apache Answer
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
- Apache Software Foundation Apache Answer
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
- Apache Software Foundation Apache Kylin
- Authentication bypass
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
- HivePress
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
- PT Norther Lights Production MapSVG
- Unrestricted file upload
- CVSS 9.3 CriticalCritical · CVSS 9+
Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
- Google SAM
- Information disclosure
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
- Google SAM
- Authentication bypass
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
GV-ASManager Web Server Command Injection Vulnerability
- GeoVision Inc. GV-ASManager
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.…
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Command injection