Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 10.0 CriticalCritical · CVSS 9+
SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)
- socfortress CoPilot
- Path traversal
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
- huajian123 ng-antd-admin
- Hard-coded credentials
- CVSS 9.3 CriticalCritical · CVSS 9+
SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
- socfortress CoPilot
- Information disclosure
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection
- socfortress CoPilot
- Authentication bypass
- Hard-coded credentials
- CVSS 9.9 CriticalCritical · CVSS 9+
SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
- socfortress CoPilot
- Cross-site scripting (XSS)
- Information disclosure
- CVSS 9.0 CriticalCritical · CVSS 9+
Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
- givanz Vvveb
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover
- givanz Vvveb
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
- yincongcyincong MuseBot
- CWE-1394
- CVSS 9.3 CriticalCritical · CVSS 9+
OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
- AIDotNet OpenDeepWiki
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
- vsftpd
- CWE-940
- CVSS 9.2 CriticalCritical · CVSS 9+
CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
- cakephp
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
- cakephp
- SQL injection
- CVSS 9.5 CriticalCritical · CVSS 9+
Unauthenticated RCE vulnerability against ClickHouse Server
- ClickHouse
- ClickHouse Cloud
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Dahua Intelligent Connection Center command injection
- Dahua Intelligent Connection Center
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
API permission bypass via logic bug
- Teltonika Networks RUT
- Teltonika Networks RUTX
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
- Gravity Forms
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
- Drupal Block AJAX
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
- Imagination Technologies Graphics DDK
- CWE-823
- CVSS 9.6 CriticalCritical · CVSS 9+
Use after free in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.6 CriticalCritical · CVSS 9+
Heap-based buffer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue was discovered in Keyfactor EJBCA 9.
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Deserialization of untrusted data in Veeam Management Pack for Microsoft System Center
- Veeam Management Pack for Microsoft System Center
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
SOCFortress CoPilot: Stored case-report template injection permits backend code execution
- socfortress CoPilot
- Code injection
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Docat has Arbitrary File Upload exists in Upload API
- docat
- Unrestricted file upload
- CVSS 9.4 CriticalCritical · CVSS 9+
Sandbox Escape via Table Rotation in ServiceNow AI Platform
- ServiceNow AI Platform
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Botan: Integer overflow when reporting block size in FFI can cause memory corruption
- randombit botan
- Memory corruption
- CWE-681
- CVSS 9.3 CriticalCritical · CVSS 9+
Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN
- monkeytype
- CWE-829
- CVSS 9.4 CriticalCritical · CVSS 9+
Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
- frappe
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
- zitadel
- CWE-565
- CVSS 9.9 CriticalCritical · CVSS 9+
OS Command Injection in Progress WS_FTP Server
- Progress Software WS_FTP Server
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
- Progress Software WS_FTP Server
- Path traversal
- Unrestricted file upload
- CVSS 9.0 CriticalCritical · CVSS 9+
Command Injection via FTP Notification Variables in Progress WS_FTP Server
- Progress Software WS_FTP Server
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Host Administrator Path Containment Bypass in Progress WS_FTP Server
- Progress Software WS_FTP Server
- Path traversal
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
Privilege Escalation via Missing Authorization in WS_FTP Manager
- Progress Software WS_FTP Server
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Improper Authentication in Progress WS_FTP Server
- Progress Software WS_FTP Server
- Authentication bypass
- Hard-coded credentials
- CVSS 9.3 CriticalCritical · CVSS 9+
Out-of-bounds write when parsing AR Vendor Block requests
- RT-Labs P-Net
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
Logon bypass (trust of attacker-controlled completed-methods list)
- OpenText Advanced Authentication Server
- CWE-349
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
- Zoho Flow
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
- ThemeREX Gunslinger
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
- ThemeREX Good Homes
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
- ThemeREX Gamic
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
- ThemeREX Gamezone
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
- ThemeREX EmojiNation
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
- ThemeREX Edge Decor
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
- ThemeREX Coinpress
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
- ThemeREX Bonbon
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
- ThemeREX Avventure
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability
- ThemeREX Filmax
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability
- ThemeREX Orpheus
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability
- ThemeREX Nuts
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability
- ThemeREX Muzicon
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability
- ThemeREX Motorix
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability
- ThemeREX Mission
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability
- ThemeREX Meals & Wheels
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability
- ThemeREX Marcell
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability
- ThemeREX Le Truffe
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability
- ThemeREX Legal Stone
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
- Von Eyal Fitoussi GEO my WordPress
- Insecure deserialization
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
- Ajax Load More AjaxLoadMore Cache
- Code injection