CVE-2026-22769
Dell RecoverPoint for Virtual Machines contains hardcoded credentials that allow unauthenticated remote attackers to gain root-level access and establish persistence.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Friday's vulnerability disclosures include two maximum-severity CVSS 10.0 flaws in Linux Cyber Protect (CVE-2025-30411, CVE-2025-30412) alongside a critical Microsoft Semantic Kernel Python SDK vulnerability (CVE-2026-26030, CVSS 9.9). The day's 24 critical CVEs represent a 20% increase over Thursday, with 100 high-priority issues marking a 22% rise across both categories. WordPress plugins account for the largest share of critical disclosures, with at least six distinct plugin vulnerabilities scoring CVSS 9.8, while authorization bypass flaws affect Databank Accreditation Software. Among 20 actively exploited vulnerabilities, multiple Microsoft Windows and Office flaws are under active attack alongside legacy issues in GitLab, Zimbra, and Sangoma FreePBX dating back several years. No patches are currently available for the disclosed vulnerabilities, requiring organizations to prioritize compensating controls and monitoring.
Immediate action: Prioritize compensating controls for Linux Cyber Protect, Microsoft Windows and Office, and WordPress plugin deployments, as no patches are currently available for any of the 124 disclosed vulnerabilities. Monitor vendor advisories closely for patch releases on the two CVSS 10.0 Cyber Protect flaws and the six actively exploited Microsoft vulnerabilities, and consider temporarily restricting exposure of affected services where feasible.
Dell RecoverPoint for Virtual Machines contains hardcoded credentials that allow unauthenticated remote attackers to gain root-level access and establish persistence.
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX OS Command Injection Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX Improper Authentication Vulnerability - Active in CISA KEV catalog.
React Native Community CLI OS Command Injection Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the MSHTML Framework allows an unauthenticated attacker to bypass security features over a network, potentially leading to unauthorized system access.
Microsoft Windows NULL Pointer Dereference Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the Windows Shell allows an unauthenticated attacker to bypass security features over a network connection.
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate their privileges locally on the affected system.
A type confusion vulnerability in the Desktop Window Manager (DWM) allows an authorized local attacker to elevate their privileges to a higher level.
A security feature bypass vulnerability in Microsoft Office Word exists due to reliance on untrusted inputs, allowing an unauthorized local attacker to circumvent security protections.
A memory corruption vulnerability in Apple software was addressed through improved state management to prevent potential exploitation.
Microsoft Configuration Manager SQL Injection Vulnerability - Active in CISA KEV catalog.
Notepad++ Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability - Active in CISA KEV catalog.
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Google Chrome is vulnerable to a "Use After Free" condition in its CSS engine, which could allow a remote attacker to execute arbitrary code via a crafted webpage.
GitLab Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion (LFI) via the 'template_name' parameter, enabling unauthenticated RCE.
A remote code execution vulnerability exists in Microsoftâs Semantic Kernel Python SDK due to improper filtering in the `InMemoryVectorStore` component. Attackers can execute arbitrary code.
The Buyent Classified plugin for WordPress allows unauthenticated attackers to register as administrators due to a lack of role validation during REST API registration.
The Slider Future plugin for WordPress allows unauthenticated arbitrary file uploads, which can be leveraged to achieve remote code execution on the server.
The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation, allowing unauthenticated users to register themselves with the 'administrator' role.
The Lizza LMS Pro plugin for WordPress is vulnerable to privilege escalation, enabling unauthenticated attackers to register as administrators and take over the site.
The s2Member plugin for WordPress allows unauthenticated privilege escalation via account takeover due to insufficient identity validation during password updates in versions up to 260127.
Databank Accreditation Software is vulnerable to SQL Injection via an authorization bypass in user-controlled primary keys, affecting all versions through Feb 19, 2026.
Acronis Cyber Protect (Linux and Windows) is vulnerable to sensitive data disclosure and manipulation due to improper authentication in versions 15 and 16.
Acronis Cyber Protect (Linux and Windows) suffers from an improper authentication vulnerability allowing sensitive data disclosure and manipulation in versions 15 and 16.
Acronis Cyber Protect (Linux and Windows) is vulnerable to sensitive data disclosure and manipulation due to missing authorization in versions 15 and 16.
Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 41800.
Ghost CMS is vulnerable to unauthenticated arbitrary database reads, allowing attackers to extract sensitive information directly from the underlying database.
Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.
The 'Saisies' plugin for SPIP contains a critical Remote Code Execution (RCE) vulnerability that allows attackers to run arbitrary code on the host server.
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.
A critical flaw in a system REST API allows an authenticated administrator to upload arbitrary files to user-controlled locations, leading to remote code execution.
A command injection vulnerability in the SECCN Dingcheng G10 login script allows unauthenticated remote attackers to execute OS commands via the User argument.
Gogs Git service exposes unauthenticated file upload endpoints by default, allowing remote users to upload arbitrary files and potentially exhaust disk space or host malware.
RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to execute arbitrary operations on the target system, including reverse shell establishment and command execution.
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting.This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM ultimately achieving arbitrary code execution as root in said VM. The current understanding is this doesnât impact the security of the Host or of other containers / VMs running on that Host (note that arm64 QEMU lacks NVDIMM read-only support: It is believed that until the upstream QEMU gains this capability, a guest write could reach the image file). Version 3.27.0 patches the issue.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion
The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool
Heap buffer overflow in PDFium in Google Chrome prior to 145
Heap buffer overflow in Media in Google Chrome prior to 145
The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4
Integer overflow in V8 in Google Chrome prior to 145
Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network
The Tablesome Table â Contact Form DB â WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function in versions 0
The IDonate â Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_profile() function in versions 2
The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'trman_save_option' function and on the 'trman_save_option_items' in all versions up to, and including, 1
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API endpoint in all versions up to, and including, 4
The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2
PHPGurukul Hospital Management System v4
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0
The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2
The Orderable â WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the 'install_plugin' function in all versions up to, and including, 1
jsPDF is a library to generate PDFs in JavaScript
jsPDF is a library to generate PDFs in JavaScript
code-projects Scholars Tracking System 1
Dell Unisphere for PowerMax, version(s) 10
Dell Unisphere for PowerMax, version(s) 10
ADB Explorer is a fluent UI for ADB on Windows
ScadaApp for iOS 1
Dell Unisphere for PowerMax, version(s) 10
Dell Unisphere for PowerMax, version(s) 10
Dell PowerProtect Data Manager, version(s) prior to 19
HDF5 is software for managing data
Missing authentication in /admin/student
Missing authentication and authorization in print_membership_card
NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution
Gogs is an open source self-hosted Git service
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciously crafted file
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed environments
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file
Jenkins 2
Rack is a modular Ruby web server interface
A vulnerability was detected in itsourcecode Event Management System 1
A flaw has been found in itsourcecode Event Management System 1
A vulnerability has been found in itsourcecode Event Management System 1
Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending specially crafted UDP JSON frames to port 27000
NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection
NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection
NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection
NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafted input to a configuration parameter
NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attacker could cause a code injection
The com
The installer for ã¸ã§ããã°éč¨/åæãŊãããĻã§ãĸ RICOHã¸ã§ããã°éč¨ããŧãĢ versions prior to Ver
The Linux Kernel lockdown mode for kernel versions starting on 6
OpenClaw is a personal AI assistant
httpsig-hyper is a hyper extension for http message signatures
Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection
Notepad++ is a free and open-source source code editor
MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bitpressadmin Bit Form bit-form allows SQL Injection
Centova Cast 3
systeminformation is a System and OS information library for node
Music Assistant is an open-source media library manager that integrates streaming services with connected speakers
Control Center PRO 6
systeminformation is a System and OS information library for node
An issue was discovered in OpenStack Nova before 30
SD
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal
SPIP before 4
A vulnerability has been identified in the OPC
A vulnerability has been identified in the UA
A vulnerability has been identified in Rexroth IndraWorks
A vulnerability has been identified in Rexroth IndraWorks
An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506
A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability
A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability
Fabric
OpenClaw is a personal AI assistant
When BIG-IP AFM or BIG-IP DDoS is provisioned, undisclosed traffic can cause TMM to terminate
XMedia Recode 3
Crystal Live HTTP Server 6
Foscam Video Management System 1
iSmartViewPro 1
gSOAP 2
FileOptimizer 14
WMV to AVI MPEG DVD WMV Convertor 4
Bematech (formerly Logic Controls, now Elgin) MP-4200 TH printer contains a denial of service vulnerability in the admin configuration page
MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files
Penpot is an open-source design tool for design and code collaboration
soroban-sdk is a Rust SDK for Soroban contracts
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback
OpenClaw is a personal AI assistant
OpenClaw is a personal AI assistant
OpenClaw is a personal AI assistant
OpenClaw is a personal AI assistant
A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206
A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3
Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline