CVE-2026-3910
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosures reveal 12 critical vulnerabilities concentrated across WordPress plugins, HP products, and NPM packages, alongside continued active exploitation of Google Chrome and Apple platforms. Critical CVE volume dropped 60% from the prior day (12 vs. 30), while 100 high-priority vulnerabilities held steady. Notable critical findings include CVE-2026-25366 (CVSS 9.9, HP code execution), CVE-2026-4484 (CVSS 9.8, WordPress), and CVE-2026-26830 (CVSS 9.8, pdf-image NPM package command injection). Attack patterns are dominated by remote code execution across web content management systems and supply chain risks in NPM dependencies. No patches are currently available for yesterday's disclosures, and 10 vulnerabilities have confirmed active exploitation targeting Google Chromium, Apple products, and Zimbra.
Immediate action: Prioritize monitoring Google Chromium, Apple iOS/iPadOS, Zimbra, and Wing FTP Server environments where active exploitation is confirmed, and apply any out-of-band mitigations available from vendors. Review WordPress plugin deployments â especially JetFormBuilder, Green Downloads, and TotalPoll Lite â and consider disabling vulnerable plugins until patches are released, as no fixes are currently available for any of yesterday's critical disclosures.
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.
Wing FTP Server Information Disclosure Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability - Active in CISA KEV catalog.
Craft CMS Code Injection Vulnerability - Active in CISA KEV catalog.
Laravel Livewire Code Injection Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Improper Locking Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Classic Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Langflow Code Injection Vulnerability - Active in CISA KEV catalog.
A buffer overflow vulnerability in the kernel was addressed through improved bounds checking. Remote attackers may cause system termination or corrupt kernel memory.
The Masteriyo LMS plugin for WordPress allows authenticated Student-level users to escalate their privileges to Administrator via the InstructorsController.
The Woody ad snippets plugin for WordPress is vulnerable to code injection. Attackers can exploit the insert-php component to execute arbitrary code on the host server.
PublishPress Revisions is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands. This affects versions up to 3.7.23.
A two-step attack targeting the RESTful API in N2WS Backup & Recovery enables remote code execution. This critical flaw is resolved in version 4.4.0.
Total Poll Lite is vulnerable to Remote Code Inclusion (RCI) due to improper control of code generation. This affects versions up to and including 4.12.0.
JetFormBuilder is vulnerable to Code Injection due to improper control of code generation. This affects versions up to and including 3.5.6.1.
Green Downloads allows unrestricted upload of files with dangerous types, enabling the use of malicious files. This affects versions up to 2.08.
The pdf-image npm package is vulnerable to OS command injection via the pdfFilePath parameter. This occurs due to improper interpolation of user paths into shell commands.
The node-tesseract-ocr npm package allows OS command injection in the recognize() function. File path parameters are concatenated into shell commands without proper sanitization.
Widget Wrangler is vulnerable to Code Injection due to improper control of code generation. This affects versions up to and including 2.3.9.
Nelio AB Testing plugin for WordPress contains a code injection vulnerability. This allows remote attackers to execute arbitrary code by exploiting improper control of code generation.
A vulnerability in Cisco's IKEv2 implementation allows unauthenticated remote attackers to cause a memory leak. This leak eventually leads to a Denial of Service (DoS) condition on the affected network device.
A flaw in the DHCP snooping feature of Cisco IOS XE allows unauthenticated attackers to cause BOOTP packets to be forwarded between VLANs. This leads to a Denial of Service (DoS) condition.
A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device
A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition
Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' GET parameter
Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters
Netartmedia Vlog System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion
NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file
OpenCart Core 4
NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution
Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the profile_list endpoint
Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various POST parameters
The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2
The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9
A security flaw has been discovered in Netcore Power 15AX up to 3
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root
PhreeBooks ERP 5
PhreeBooks ERP 5
The installer for OM Workspace (Windows Edition) Ver 2
The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs
The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder
eNdonesia Portal v8
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file
Wallos is an open-source, self-hostable personal subscription tracker
Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters
DedeCMS v5
NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution
NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution
OpenEMR is a free and open source electronic health records and medical practice management application
OpenEMR is a free and open source electronic health records and medical practice management application
A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33
Sonarr is a PVR for Usenet and BitTorrent users
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17
OpenEMR is a free and open source electronic health records and medical practice management application
Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion
NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file
NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards
GitLab has remediated an issue in GitLab EE affecting all versions from 15
Privilege escalation in the IPC component
Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection
Intake is a package for finding, investigating, loading and disseminating data
An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into clicking a malicious link
A logic issue was addressed with improved checks
Kiteworks is a private data network (PDN)
OpenEMR is a free and open source electronic health records and medical practice management application
OpenEMR is a free and open source electronic health records and medical practice management application
Sandbox escape due to incorrect boundary conditions in the Telemetry component
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
NATS-Server is a High-Performance server for NATS
River Past Cam Do 3
FlexHEX 2
AIDA64 Extreme 5
AIDA64 Business 5
AIDA64 Extreme 5
Base64 Decoder 1
X-NetStat Pro 5
Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer
Undefined behavior in the WebRTC: Signaling component
Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform
LibVNCServer versions 0
FileRise is a self-hosted web file manager / WebDAV server
Dagu is a workflow engine with a built-in Web user interface
A race condition was addressed with improved state handling
A race condition was addressed with additional validation
Sonarr is a PVR for Usenet and BitTorrent users
A flaw was found in the libtiff library
A vulnerability exists in IDriveâs id_service component. The flaw could allow for unauthorized actions or service disruption depending on the specific implementation of the service.
An issue in Eufy Homebase 2 version 3
OpenEMR is a free and open source electronic health records and medical practice management application
OpenEMR is a free and open source electronic health records and medical practice management application
Kiteworks is a private data network (PDN)
OpenEMR is a free and open source electronic health records and medical practice management application
Race condition, use-after-free in the Graphics: WebRender component
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Audio/Video: Playback component
Incorrect boundary conditions, integer overflow in the Graphics component
Incorrect boundary conditions in the Audio/Video: Web Codecs component
Incorrect boundary conditions in the Audio/Video: Web Codecs component
Incorrect boundary conditions in the Layout: Text and Fonts component
Denial-of-service in the WebRTC: Signaling component
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Audio/Video: GMP component
Information disclosure in the Widget: Cocoa component
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Audio/Video component
Incorrect boundary conditions in the Graphics: Text component
Denial-of-service in the XML component
Denial-of-service in the Libraries component in NSS
DiceBear is an avatar library for designers and developers
Langflow is a tool for building and deploying AI-powered agents and workflows