Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.6 CriticalCritical · CVSS 9+
Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Authentication Bypass leads to Unauthorized Access in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
Authentication Bypass Leading to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
Authentication Bypass Leading to Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Path traversal
- CVSS 9.6 CriticalCritical · CVSS 9+
Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Unauthenticated Adjacent Command Injection Vulnerability in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 10.0 CriticalCritical · CVSS 9+
Authentication Bypass Leading to Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Memory corruption
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated Command Injection Vulnerabilities in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Authentication Bypass Leading to Remote Code Execution in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack
- schorschii OCO-Server
- Weak cryptography or TLS
- CVSS 9.5 CriticalCritical · CVSS 9+
Pre-boot RCE in EDK II PXE driver
- TianoCore EDK2
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
- Memory corruption
>=11.0.0, <13.0.0 · fixed in 13.0.0
GHSA-v9pv-5gc8-w2m6 · CVE-2026-96639 - CVSS 9.1 CriticalCritical · CVSS 9+
Sentry-Javascript: Middleware Bypass when using Tunnel route
- CWE-693
>=9.36.0, <9.47.2 || >=10.0.0-alpha.0, <10.75.2 || >=11.0.0-alpha.0, <11.0.0-rc.1 · fixed in 9.47.2, 10.75.2, 11.0.0-rc.1
GHSA-mchm-gjx6-7h55 · CVE-2026-114139 - CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
- yootheme.com YOOtheme Pro extension for Joomla
- Unrestricted file upload
- CVSS 9.2 CriticalCritical · CVSS 9+
mem0ai Databricks vector store vulnerable to SQL injection
- SQL injection
>=0.1.117, <1.0.8 · fixed in 1.0.8
GHSA-7587-9684-52r6 · CVE-2026-115324 - CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
- CozyThemes Rootblox
- File inclusion
- CVSS 9.3 CriticalCritical · CVSS 9+
DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
- DedeCMS
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer
- FanRuan FineReport
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability
- Brainstorm Force SureCart
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability
- TMS Amelia
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
NewType Infortech｜NT OneAPP - Improper Certificate Validation
- NewType Infortech NT OneAPP
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
NewType Infortech｜NT OneAPP - Hard-coded Credentials
- NewType Infortech NT OneAPP
- Hard-coded credentials
- CVSS 9.0 CriticalCritical · CVSS 9+
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
- openremote
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
- Drupal Webform
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
TOTOLINK A950RG product.so UploadCustomModule command injection
- TOTOLINK A950RG
- Other injection
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Integer Overflow or Wraparound in GitLab
- GitLab
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _loc…
- Cross-site scripting (XSS)
- CVSS 9.9 CriticalCritical · CVSS 9+
Files or Directories Accessible to External Parties in Splunk SOAR
- Splunk SOAR
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Protection of Alternate Path in Splunk SOAR
- Splunk SOAR
- CWE-424
- CVSS 9.8 CriticalCritical · CVSS 9+
Protection Mechanism Failure in Splunk SOAR
- Splunk SOAR
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Check or Handling of Exceptional Conditions in Splunk SOAR
- Splunk SOAR
- CWE-703
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Control of a Resource Through its Lifetime in Splunk SOAR
- Splunk SOAR
- CWE-664
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Access Control in Splunk SOAR
- Splunk SOAR
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Security Hardening in Splunk Enterprise - October 2026
- Splunk Enterprise
- CWE-707
- CVSS 9.8 CriticalCritical · CVSS 9+
Security Hardening in Splunk Enterprise - October 2026
- Splunk Enterprise
- CWE-693
- CVSS 9.9 CriticalCritical · CVSS 9+
Security Hardening in Splunk Enterprise - October 2026
- Splunk Enterprise
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
- TOTOLINK EX200
- Memory corruption
- CVSS 10.0 CriticalCritical · CVSS 9+
TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
- TOTOLINK EX200
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
- Memory corruption
>=2.0.0, <13.0.0 · fixed in 13.0.0
GHSA-332p-7hrc-92wf · CVE-2026-112393 - CVSS 9.1 CriticalCritical · CVSS 9+
Broken or risky cryptographic algorithm in Oracle Corporation Oracle Java SE and others
- Oracle Corporation Oracle Java SE
- Oracle Corporation Oracle GraalVM for JDK
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts
- CWE-322