CVE-2026-20963
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Friday's vulnerability disclosures reveal 31 critical-severity flaws across Microsoft, HP, Oracle, and Arch products, including a CVSS 10.0 remote code execution in Azure Cloud Shell (CVE-2026-32169) and multiple CVSS 9.8 issues in Microsoft Bing Images and Oracle Identity Manager. Critical CVE volume rose 158% from the prior day's 12 to 31, while high-priority disclosures increased 19% to 100. Notable entries include CVE-2026-32938 (CVSS 9.9) in SiYuan and CVE-2026-32767 (CVSS 9.8) targeting endpoint bypass in Arch products. Among the 16 actively exploited vulnerabilities are flaws in Microsoft SharePoint, Cisco FMC, Ivanti EPM, and Google Chromium V8, alongside several legacy CVEs in Apple, Hikvision, and Rockwell products still under active exploitation. No patches are currently available for the newly disclosed vulnerabilities, requiring defenders to prioritize compensating controls and monitoring.
Immediate action: Prioritize reviewing exposure to Azure Cloud Shell, Microsoft Bing Images, Oracle Identity Manager, and HP products given the concentration of CVSS 9.0+ vulnerabilities. With zero patches currently available, implement network segmentation, restrict access to affected services, and increase monitoring for exploitation indicators across SharePoint, Cisco FMC, Ivanti EPM, and Chromium environments.
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
A critical insecure deserialization flaw in the Cisco FMC web interface allows unauthenticated remote attackers to execute arbitrary Java code with root privileges via crafted serial objects.
Omnissa Workspace ONE Server-Side Request Forgery - Active in CISA KEV catalog.
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability - Active in CISA KEV catalog.
VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.
A memory corruption vulnerability exists in memory allocation processes when handling specific alignments, potentially leading to arbitrary code execution or system instability.
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability - Active in CISA KEV catalog.
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability - Active in CISA KEV catalog.
Apple Multiple products Use-After-Free Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Integer Overflow or Wraparound Vulnerability - Active in CISA KEV catalog.
Apple iOS and iPadOS Use-After-Free Vulnerability - Active in CISA KEV catalog.
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.
Wing FTP Server Information Disclosure Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability - Active in CISA KEV catalog.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) through FreeScout's email notification templates. Incoming email bodies are stored in the database without sanitization and rendered unescaped in outgoing email notifications using Blade's raw output syntax {!! $thread->body !!}. An unauthenticated attacker can exploit this vulnerability by simply sending an email, and when opened by any subscribed agent or admin as part of their normal workflow, enabling universal HTML injection (phishing, tracking) and, in vulnerable email clients, JavaScript execution (session hijacking, credential theft, account takeover) affecting all recipients simultaneously. This issue has been fixed in version 1.8.209.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This vulnerability is a direct Patch Bypass of CVE-2024-49774. Although the vendor attempted to fix the issue in version 7.14.5, the underlying flaw in ModuleScanner.php regarding PHP token parsing remains. The scanner incorrectly resets its internal state ($checkFunction flag) when encountering any single-character token (such as =, ., or ;). This allows attackers to hide dangerous function calls (e.g., system(), exec()) using variable assignments or string concatenation, completely evading the MLP security controls. Versions 7.15.1 and 8.9.3 patch the issue.
SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlying SQLite database without any authorization or read-only checks. This allows any authenticated user â including those with the Reader role â to execute arbitrary SQL statements (SELECT, DELETE, UPDATE, DROP TABLE, etc.) against the application's database. This is inconsistent with the application's own security model: the dedicated SQL endpoint (/api/query/sql) correctly requires both CheckAdminRole and CheckReadonly middleware, but the search endpoint bypasses these controls entirely. This issue has been fixed in version 3.6.1.
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality. The issue exists in /website_code/php/import/import.php where missing authentication checks allow an attacker to upload a crafted ZIP archive disguised as a project template. The archive can contain a malicious PHP payload placed in the media/ directory, which is extracted into a web-accessible USER-FILES/{projectID}--{targetFolder}/ path. An attacker can then directly access the uploaded PHP file to achieve remote code execution under the web server context.
A server-side request forgery (SSRF) vulnerability in Azure Cloud Shell allows an unauthenticated attacker to elevate privileges over a network.
An OS command injection vulnerability in Microsoft Bing Images allows an unauthenticated attacker to execute arbitrary code over a network.
A command injection vulnerability in Microsoft Bing Images allows an unauthorized attacker to execute arbitrary code via network-based requests.
SiYuan versions 3.6.0 and below are vulnerable to path traversal and sensitive file exfiltration via improper validation of file:// links in pasted HTML.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through 2.0.1.
A critical vulnerability in Oracle Identity Manager and Web Services Manager allows unauthenticated network-based takeover via HTTP.
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the configured guild to execute arbitrary JavaScript in the Anchorr admin's browser. By chaining this with the GET /api/config endpoint (which returns all secrets in plaintext), an attacker can exfiltrate every credential stored in Anchorr which includes DISCORD_TOKEN, JELLYFIN_API_KEY, JELLYSEERR_API_KEY, JWT_SECRET, WEBHOOK_SECRET, and bcrypt password hashes without any authentication to Anchorr itself. This issue has been fixed in version 1.4.2.
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7.
SiYuan versions 3.6.0 and below contain a click-through XSS vulnerability in the dynamic icon API due to incomplete SVG sanitization.
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.
The Aimogen Pro plugin for WordPress allows unauthenticated arbitrary function calls. Attackers can exploit this to change the default user role to administrator and gain full site control.
Mesop versions 1.2.2 and below contain an unauthenticated remote code execution (RCE) vulnerability in a debugging endpoint within the AI testing module.
Mesop versions 1.2.2 and below are vulnerable to path traversal, allowing unauthorized users to manipulate or delete arbitrary files on the host disk.
OpenClaw versions before 2026.2.24 contain a sandbox network isolation bypass vulnerability allowing trusted operators to access other container networks.
The Woocommerce Wholesale Lead Capture plugin is vulnerable to incorrect privilege assignment, which allows attackers to escalate their privileges within the WordPress environment.
A remote code execution (RCE) vulnerability in WGCLOUD v2.3.7 and earlier allows attackers to execute arbitrary code via the test connection function.
The Woocommerce Wholesale Lead Capture plugin allows for the unrestricted upload of files with dangerous types, enabling attackers to upload and execute malicious files on the server.
Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through 1.3.1.
Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.
Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
XML::Parser for Perl contains an off-by-one heap buffer overflow in the st_serial_stack function. Attackers can trigger this by providing XML files with deeply nested elements to cause a crash.
Cozmoslabs Profile Builder Pro is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive information from the database by sending crafted queries.
A path traversal vulnerability in UniFi Network Application allows network-based attackers to access and manipulate sensitive system files. This can lead to unauthorized account access.
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.
OPEXUS eComplaint and eCASE expose secret verification codes in HTTP responses during password resets. Attackers can use this to hijack accounts and reset security questions without authorization.
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.
Spring Security may fail to write HTTP response headers in certain servlet applications. This failure can bypass critical security protections like HSTS or CSP, leaving users vulnerable to web-based attacks.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ovatheme Tripgo allows PHP Local File Inclusion
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection
The KiviCare â Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4
Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework
Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network
Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network
Kysely is a type-safe TypeScript SQL query builder
The Post SMTP â Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the âevent_typeâ parameter in all versions up to, and including, 3
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
OpenClaw versions prior to 2026
The Appointment Booking Calendar â Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1
Server-side request forgery (ssrf) in Microsoft 365 Copilot's Business Chat allows an authorized attacker to elevate privileges over a network
The Photo Gallery, Sliders, Proofing and Themes â NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4
A vulnerability in the Arturia Software Center for MacOS involves the insecure installation of uninstaller components during plugin deployment, potentially allowing unauthorized system changes.
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx
Admidio is an open-source user management solution
The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects
WWBN AVideo is an open source video platform
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and including, 5
ApostropheCMS is an open-source content management framework
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
A flaw was found in pgproto3
Jenkins 2
ClipBucket v5 is an open source video sharing platform
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
OpenEMR is a free and open source electronic health records and medical practice management application
The Kan open-source project management tool is affected by a high-severity vulnerability that may allow for significant unauthorized access or data compromise.
Jenkins 2
Out-of-bounds read in ALPN parsing due to incomplete validation
pyLoad is a free and open-source download manager written in Python
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
pydicom is a pure Python package for working with DICOM files
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service
Missing Authorization vulnerability in Dotstore Fraud Prevention For Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels
OpenClaw versions prior to 2026
Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection
ewe is a Gleam web server
Buffer Overflow vulnerability in giflib v
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard allows Password Recovery Exploitation
An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges
In Juju from version 3
The import form CSRF vulnerability in MuraCMS through 10
The Trash Restore CSRF vulnerability in MuraCMS through 10
HTSlib is a library for reading and writing bioinformatics file formats
BMC FootPrints ITSM versions 20
OpenClaw versions prior to 2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
A vulnerability has been found in Yi Technology YI Home Camera 2 2
Improper Restriction of XML External Entity Reference vulnerability in XMLUtils
LuCI is the OpenWrt Configuration Interface
Improper certificate validation in Devolutions Hub Reporting Service 2025
HTSlib is a library for reading and writing bioinformatics file formats
MuraCMS through 10
Glances is an open-source system cross-platform monitoring tool
Glances is an open-source system cross-platform monitoring tool
HTSlib is a library for reading and writing bioinformatics file formats
HTSlib is a library for reading and writing bioinformatics file formats
HTSlib is a library for reading and writing bioinformatics file formats
HTSlib is a library for reading and writing bioinformatics file formats
HTSlib is a library for reading and writing bioinformatics file formats
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
A vulnerability was identified in Yi Technology YI Home Camera 2 2
LibreChat version 0
MuraCMS through 10
OpenClaw versions prior to 2026
Admidio is an open-source user management solution
An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12
SiYuan is a personal knowledge management system
Glances is an open-source system cross-platform monitoring tool
A zip slip vulnerability in the Admin import functionality of CTFd v3
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
An issue in the VirtualHost configuration handling/parser component of aaPanel v7
A lack of path validation in aaPanel v7
HTSlib is a library for reading and writing bioinformatics file formats
SAMtools is a program for reading, manipulating and writing bioinformatics file formats
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
OpenClaw versions prior to 2026
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels
XML::Parser versions through 2
A flaw was found in libarchive
OpenClaw versions prior to 2026
AutoMapper is a convention-based object-object mapper in
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
A logic error in CRL distribution point validation in AWS-LC before 1
BMC FootPrints ITSM versions 20