Advisories · Critical
What needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- KEV
It’s in CISA’s KEV catalogue
CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- CVSS 9+
Its CVSS score is 9.0 or more
The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- CVSS 7+ and EPSS
CVSS 7.0 or more, and EPSS 0.1 or more
A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
- WAVLINK WN553X1-B
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
- WAVLINK WN553X1-B
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection
- WAVLINK WN553X1-B
- Command injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability
- Liquid Web / StellarWP BookIt
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Prefab UI Pyodide sandbox escape to host RCE
- PrefectHQ prefab-ui
- Code injection
- Privilege escalation
- CVSS 9.3 CriticalCritical · CVSS 9+
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
- Horizon DataSys Reboot Restore Standard
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
- WAVLINK WN553X1-B
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
- WAVLINK WN701AE
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN553X1-B ioos sub_416B50 os command injection
- WAVLINK WN553X1-B
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN553X1-B ioos Service sub_416D88 os command injection
- WAVLINK WN553X1-B
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Beta9 host filesystem exposure via volume path traversal
- beam-cloud Beta9 gateway
- beam-cloud Beta9 worker
- Path traversal
- Information disclosure
- CVSS 9.9 CriticalCritical · CVSS 9+
Beta9 container escape via unvalidated sandbox file paths
- beam-cloud Beta9 worker
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
Beta9 build sandbox escape via chroot-only isolation
- beam-cloud Beta9 worker
- Privilege escalation
- CWE-653
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
- WAVLINK WN701AE
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
- Oray Pugongying X5 Pro
- Path traversal
- CVSS 9.4 CriticalCritical · CVSS 9+
Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
- Oray Pugongying X5 Pro
- Privilege escalation
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
- WAVLINK WL-WN530BE1-A
- Other injection
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
- WAVLINK WL-WN530HG4B
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WAVLINK WN579X3-D wapi.cgi port_forward os command injection
- WAVLINK WN579X3-D
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
- WAVLINK WL-WN579A3-A
- Command injection
- CVSS 10.0 CriticalCritical · CVSS 9+
D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow
- D-Link DIR-505
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
- Apache Software Foundation Apache MINA
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
- anji-plus AJ-Report
- Hard-coded credentials
- CVSS 9.3 CriticalCritical · CVSS 9+
Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
- dromara Jpom
- Other injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter
- Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
- wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
- uncannyowl Uncanny Toolkit for LearnDash
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
- addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder
- Insecure deserialization
- CVSS 9.1 CriticalCritical · CVSS 9+
Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
- popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups.
- Broken access control
- CVSS 8.1 HighCritical · KEVKEV
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
- WordPress
- Race condition
- CVSS 9.3 CriticalCritical · CVSS 9+
Unverified Sign in with Apple callback parameter can override verified ID token claims
- Authentication bypass
- CWE-349
>=0.1.25, <0.3.2 · fixed in 0.3.2
GHSA-9fr5-g44g-9526 · CVE-2026-117656 - CVSS 9.8 CriticalCritical · CVSS 9+
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
- Path traversal
>=1.0.0, <1.5.3 · fixed in 1.5.3
GHSA-4xm8-rg9h-jhq2 - CVSS 9.8 CriticalCritical · CVSS 9+
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
- Memory corruption
>=4.0.0, <4.0.16 · fixed in 4.0.16
GHSA-hff9-5pqw-6w9f - CVSS 9.8 CriticalCritical · CVSS 9+
TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover
- fctr-id okta-ai-agent
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
MoLing: unauthenticated SSE and wildcard CORS expose tool sessions
- gojue moling
- Authentication bypass
- CWE-942
- CVSS 9.1 CriticalCritical · CVSS 9+
ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
- mqttsnet thinglinks
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks
- mqttsnet thinglinks
- Command injection
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
- Weak cryptography or TLS
>=1.0.1, <1.1.8 · fixed in 1.1.8
GHSA-7gw2-hphm-c5px · CVE-2026-117666 - CVSS 9.8 CriticalCritical · CVSS 9+
HoneySQL unchecked entity names can lead to SQL injection results
- seancorfield honeysql
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
- pgadmin.org pgAdmin 4
- Command injection
- CWE-115
- CVSS 9.2 CriticalCritical · CVSS 9+
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
- pgadmin.org pgAdmin 4
- Authentication bypass
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
- Delinea Secret Server (On-Prem)
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
Secret Server device validation error
- Delinea Secret Server (On-Prem)
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Kargo: Privilege escalation via Project RBAC management in the Kargo API
- akuity kargo
- Privilege escalation
- CVSS 9.1 CriticalCritical · CVSS 9+
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
- madeofpendletonwool PinePods
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
- Thalesgroup Sentinel Keys Server
- Memory corruption
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability
- Marketing Fire Widget Options
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
- Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
- LeadSnap
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability
- Aman FunnelKit Automations
- Insecure deserialization
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
- Ivijan-Stefan Stipic Transliterator
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
- ThemeREX Royal Event
- Insecure deserialization
- CVSS 9.0 CriticalCritical · CVSS 9+
Improper certificate validation in JetBrains Toolbox App and others
- JetBrains Toolbox App
- JetBrains IntelliJ IDEA
- Weak cryptography or TLS
- CVSS 10.0 CriticalCritical · CVSS 9+
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
- morpheus65535 bazarr
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Improper certificate validation in the HTTPS listener in LXD
- Canonical LXD
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
- wbond pybars3
- up9inc pybars4
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
- InternLM lmdeploy
- Insecure deserialization
- CVSS 9.4 CriticalCritical · CVSS 9+
Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
- Google Cloud Application Integration
- Insecure deserialization