CVE-2026-20045
Cisco Unified Communications Products Code Injection Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosures include 15 critical-severity CVEs (CVSS 9.0+), a 114% increase from the prior day's 7 critical issues. High-priority vulnerabilities (CVSS 7.0-8.9) rose modestly to 81, a 13% increase over the previous 72. Sixteen actively exploited vulnerabilities remain on the CISA KEV catalog, including CVE-2026-20045 affecting Cisco Unified Communications Manager, CVE-2025-68645 targeting Zimbra Collaboration Suite, and CVE-2024-37079 in VMware vCenter Server. Notable critical disclosures include CVE-2026-0488 (CVSS 9.9) in SAP CRM, CVE-2026-1868 (CVSS 9.9) in GitLab, and CVE-2026-22903 (CVSS 9.8) in lighttpd. Patch availability stands at 0%, requiring organizations to prioritize compensating controls and monitoring until vendor remediations are released.
Immediate action: Organizations running SAP CRM, SAP NetWeaver, GitLab, Cisco Unified Communications Manager, Zimbra, and VMware vCenter Server should assess exposure immediately and apply network-level mitigations. With 0% patch availability, implement compensating controls such as network segmentation, enhanced logging, and access restrictions for affected systems until vendor patches are released.
Cisco Unified Communications Products Code Injection Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability - Active in CISA KEV catalog.
Versa Concerto Improper Authentication Vulnerability - Active in CISA KEV catalog.
Vite Vitejs Improper Access Control Vulnerability - Active in CISA KEV catalog.
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability - Active in CISA KEV catalog.
Linux Kernel Integer Overflow Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
GNU InetUtils Argument Injection Vulnerability - Active in CISA KEV catalog.
Microsoft Office Security Feature Bypass Vulnerability - Active in CISA KEV catalog.
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX OS Command Injection Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX Improper Authentication Vulnerability - Active in CISA KEV catalog.
React Native Community CLI OS Command Injection Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
All versions of the jsonpath library are vulnerable to arbitrary code injection via unsafe evaluation of user-supplied JSON Path expressions.
A flaw in SAP CRM and S/4HANA allows authenticated attackers to exploit generic function module calls to execute arbitrary SQL statements, leading to full database compromise.
Agentflow by Flowring contains a missing authentication vulnerability, allowing unauthenticated remote attackers to read, modify, or delete database contents.
SandboxJS versions before 0.8.31 contain a sandbox escape vulnerability via prototype pollution, potentially allowing sandboxed code to achieve remote code execution (RCE) on the host.
Insecure template expansion in GitLab AI Gateway allows attackers to cause a denial-of-service or execute arbitrary code via crafted Duo Agent definitions.
SAP NetWeaver AS ABAP allows low-privileged authenticated users to execute Remote Function Calls (RFC) without proper S_RFC authorization, impacting system integrity and availability.
A stack buffer overflow in modified lighttpd servers allows unauthenticated remote code execution via a crafted SESSIONID cookie.
Improper length handling of cookie fields, including TRACKID, allows unauthenticated remote attackers to trigger a stack buffer overflow and execute arbitrary code.
User credentials are stored using weak AES-ECB encryption with a hardcoded key, allowing unauthenticated attackers to recover plaintext passwords.
Agentflow by Flowring suffers from an authentication bypass vulnerability, allowing unauthenticated attackers to obtain arbitrary user tokens and impersonate any user.
A missing authentication vulnerability in HGiga C&Cm@il allows unauthenticated attackers to read and modify any user's email content.
MarkUs versions before 2.9.1 allow instructors to perform path traversal via malicious zip file uploads, enabling arbitrary file writes to the server disk.
Xpoda Studio is vulnerable to SQL injection due to improper neutralization of special elements, potentially allowing unauthorized database access and manipulation.
JetBrains Hub versions prior to 2025.3.119807 contain an authentication bypass vulnerability that allows unauthenticated attackers to perform administrative actions.
The Okulistik platform contains a Server-Side Request Forgery (SSRF) vulnerability, allowing attackers to make unauthorized requests from the server to internal or external resources.
Adminer is open-source database management software
Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents
The WCFM β Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6
A SQL Injection vulnerability in HGiga C&Cm@il allows unauthenticated remote attackers to inject arbitrary commands and read database contents.
Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents
A high-severity vulnerability exists in SumatraPDF for Windows. This flaw could allow for exploitation when the reader processes specially crafted multi-format documents.
PowerDocu contains a Windows GUI executable to perform technical documentations
Axios is a promise based HTTP client for the browser and Node
SumatraPDF for Windows is affected by a high-severity vulnerability. The flaw resides in the handling of multi-format files, potentially allowing for unauthorized actions on the host system.
A weakness has been identified in detronetdip E-commerce 1
A security vulnerability has been detected in code-projects Online Reviewer System 1
A vulnerability was found in code-projects Online Student Management System 1
A vulnerability was determined in code-projects Online Application System for Admission 1
A security flaw has been discovered in code-projects Online Reviewer System 1
A flaw has been found in itsourcecode News Portal Project 1
A vulnerability has been found in D-Link DIR-615 4
A vulnerability was found in D-Link DIR-615 4
A vulnerability was detected in code-projects Student Web Portal 1
A vulnerability was found in itsourcecode Directory Management System 1
A security flaw has been discovered in detronetdip E-commerce 1
A vulnerability was identified in code-projects Online Examination System 1
A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73
A vulnerability was identified in itsourcecode School Management System 1
A security flaw has been discovered in itsourcecode School Management System 1
A vulnerability has been found in code-projects Online Reviewer System 1
A vulnerability was found in code-projects Online Reviewer System 1
A vulnerability was determined in code-projects Online Reviewer System 1
A vulnerability was identified in code-projects Online Reviewer System 1
A security flaw has been discovered in code-projects Online Reviewer System 1
A vulnerability was determined in code-projects Online Music Site 1
A vulnerability was identified in code-projects Online Music Site 1
A vulnerability was found in itsourcecode Event Management System 1
A vulnerability was identified in code-projects Online Reviewer System 1
A security vulnerability has been detected in code-projects Online Reviewer System 1
MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability
A vulnerability was identified in Tenda RX3 16
A security flaw has been discovered in Tenda RX3 16
A flaw has been found in Tenda RX3 16
A vulnerability has been found in Tenda RX3 16
A vulnerability was found in Tenda RX3 16
A vulnerability was detected in Tenda AC8 16
A flaw has been found in Tenda AC8 16
Super-linter is a combination of multiple linters to run as a GitHub Action or standalone
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier
Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server
The SAP Solution Tools Plug-In (ST-PI) fails to perform necessary authorization checks in a specific function module, allowing authenticated users to access sensitive information.
SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart
An unauthenticated attacker can send a crafted network request to a trusted endpoint in SAP BusinessObjects BI, breaking authentication and causing a Denial of Service.
An authenticated user can cause a Denial of Service in SAP systems by invoking a remote-enabled function module with an excessively large loop-control parameter.
A security flaw has been discovered in D-Link DIR-823X 250416
A security vulnerability has been detected in D-Link DIR-823X 250416
A weakness has been identified in D-Link DIR-823X 250416
A weakness has been identified in Tenda AC9 15
A security vulnerability has been detected in Tenda AC9 15
A vulnerability has been found in D-Link DIR-823X 250416
A vulnerability was found in D-Link DCS-931L up to 1
Insufficient URI validation and path traversal sequences allow unauthenticated remote attackers to bypass authentication on the affected system.
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework
The VAPIX API mediaclip
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools
AXIS Camera Station Pro contained a flaw toΒ perform a privilege escalation attack on the server as a non-admin user
Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd
A flaw was found in Keycloak
ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc
In JetBrains PyCharm before 2025
Crafted delegations or IP fragments can poison cached delegations in Recursor
A flaw was found in Keycloak
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files
vscode-spell-checker is a basic spell checker that works well with code and documents
Cube is a semantic layer for building data applications
FileRise is a self-hosted web file manager / WebDAV server
Sliver is a command and control framework that uses a custom Wireguard netstack
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub
A security flaw has been discovered in code-projects Contact Management System 1
A vulnerability has been found in SourceCodester Prison Management System 1
Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd
SAP BusinessObjects BI Platform allows high-privileged authenticated attackers to inject malicious URLs, creating risks of phishing or unauthorized redirects.
A security weakness has been identified in the UTT θΏε 521G 3 router that could compromise the device's security posture.
A vulnerability in the UTT θΏε 521G 3 router allows for potential compromise of the device by remote attackers.