CVE-2026-20963
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Thursday's vulnerability disclosures include 12 critical-severity flaws affecting WordPress, Shinetheme Traveler, and Rymera Web WooCommerce plugins, alongside enterprise platforms like OpenProject and Glances. Critical CVEs rose 33% from the prior day while high-priority vulnerabilities decreased 16% to 84. CVE-2026-2991 (CVSS 9.8) targets WordPress core, CVE-2026-25449 (CVSS 9.8) affects Shinetheme Traveler, and CVE-2026-25873 (CVSS 9.8) impacts the Reward Server â all carrying the highest severity scores in this batch. Microsoft SharePoint, Ivanti Endpoint Manager, Broadcom VMware Aria Operations, and Google Chrome components are among 15 actively exploited vulnerabilities, reflecting broad targeting across enterprise infrastructure. No patches are currently available for these disclosures, requiring organizations to prioritize compensating controls and monitoring.
Immediate action: Prioritize network segmentation and access restrictions for Microsoft SharePoint, Ivanti Endpoint Manager, VMware Aria Operations, and Google Chrome environments where active exploitation is confirmed. With 0% patch availability across all 96 disclosed CVEs, deploy compensating controls including WAF rules, enhanced logging, and temporary access restrictions for affected WordPress installations and enterprise platforms until vendor patches are released.
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Omnissa Workspace ONE Server-Side Request Forgery - Active in CISA KEV catalog.
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability - Active in CISA KEV catalog.
VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.
A memory corruption vulnerability exists in memory allocation processes when handling specific alignments, potentially leading to arbitrary code execution or system instability.
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability - Active in CISA KEV catalog.
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability - Active in CISA KEV catalog.
Apple Multiple products Use-After-Free Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Integer Overflow or Wraparound Vulnerability - Active in CISA KEV catalog.
Apple iOS and iPadOS Use-After-Free Vulnerability - Active in CISA KEV catalog.
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.
Wing FTP Server Information Disclosure Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability - Active in CISA KEV catalog.
A critical flaw in the Moodle Custom Certificate plugin allows teachers to read or overwrite certificate elements from any other course in the system.
The KiviCare EHR plugin for WordPress suffers from an authentication bypass in its social login function, allowing unauthenticated attackers to log in as any patient or capture administrator cookies.
jsPDF versions prior to 4.2.1 are vulnerable to HTML and script injection via the output function's options argument, leading to Cross-Site Scripting (XSS).
OpenProject is vulnerable to an SQL injection via custom field names, which can be leveraged to manipulate git checkout paths and achieve arbitrary Ruby code execution upon application restart.
The Woocommerce Wholesale Lead Capture plugin is vulnerable to incorrect privilege assignment, which allows attackers to escalate their privileges within the WordPress environment.
The OmniGen2-RL reward server contains an unauthenticated remote code execution (RCE) vulnerability due to insecure pickle deserialization of HTTP POST request bodies.
The Woocommerce Wholesale Lead Capture plugin allows for the unrestricted upload of files with dangerous types, enabling attackers to upload and execute malicious files on the server.
The Glances monitoring tool exposes sensitive HTTP Basic credentials for downstream servers via an unauthenticated API endpoint when the central browser is run without a password.
The Traveler theme/plugin by Shinetheme is vulnerable to PHP Object Injection via deserialization of untrusted data, potentially leading to remote code execution.
Cozmoslabs Profile Builder Pro is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive information from the database by sending crafted queries.
A "Zip Slip" path traversal vulnerability in the ApostropheCMS import-export module allows authenticated users with content modification permissions to write arbitrary files to the host filesystem.
The OpenProject Repositories module is vulnerable to a persisted Cross-Site Scripting (XSS) attack due to improper sanitation of filenames within repository commits.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ovatheme Tripgo allows PHP Local File Inclusion
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection
The KiviCare â Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4
The Post SMTP â Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the âevent_typeâ parameter in all versions up to, and including, 3
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers
A stored crossâsite scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code
The Photo Gallery, Sliders, Proofing and Themes â NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
Kube-router is a turnkey solution for Kubernetes networking
A vulnerability in the Arturia Software Center for MacOS involves the insecure installation of uninstaller components during plugin deployment, potentially allowing unauthorized system changes.
jsPDF contains a high-severity vulnerability within its JavaScript-based PDF generation logic that could allow for malicious exploitation during document creation.
LDAP Account Manager (LAM) is a webfrontend for managing entries (e
The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and including, 5
Apache Airflow versions 3
ApostropheCMS is an open-source content management framework
Apache Airflow versions 3
ClipBucket v5 is an open source video sharing platform
The Kan open-source project management tool is affected by a high-severity vulnerability that may allow for significant unauthorized access or data compromise.
Cockpit is a headless content management system
A vulnerability was identified in code-projects Simple Food Order System 1
IBM Sterling B2B Integrator and Sterling File Gateway 6 are affected by a security vulnerability that could lead to unauthorized access or data exposure.
A high-severity security vulnerability has been identified in IBM Sterling B2B Integrator and IBM Sterling File Gateway 6, potentially impacting system security.
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory
OpenClaw versions prior to 2026
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands
A command injection vulnerability in the deviceâs Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges
The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries, leading to potential system takeover.
Unprotected internal endpoints in Cloud Foundry Capi Release 1
OpenClaw versions 2026
Buffer Overflow vulnerability in giflib v
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard allows Password Recovery Exploitation
A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage
A vulnerability was determined in UTT HiPER 810G up to 1
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline
Kanboard is project management software focused on Kanban methodology
In Juju from version 3
The import form CSRF vulnerability in MuraCMS through 10
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions
Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026
Improper certificate validation in Devolutions Hub Reporting Service 2025
Sipeed NanoKVM before 2
OpenClaw versions prior to 2026
Outline is a service that allows for collaborative documentation
An issue was discovered in SpeedExam Online Examination System (SaaS) after v
Edimax GS-5008PL firmware version 1
A flaw was found in Keycloak
Glances is an open-source system cross-platform monitoring tool
Glances is an open-source system cross-platform monitoring tool
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries
LibreChat version 0
An outâofâbounds write vulnerability exists in the EMF functionality of Canva Affinity
A type confusion vulnerability exists in the EMF functionality of Canva Affinity
Improper trust boundary enforcement in Kiro IDE before version 0
A flaw was found in Keycloak
IncusOS is an immutable OS image dedicated to running Incus
An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3
A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12
The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials
JetKVM before 0
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2
A high-severity vulnerability has been identified in IBM i version 7, requiring immediate vendor-supplied security updates to mitigate risk.
Edimax GS-5008PL firmware version 1
Next
Next
DiceBear is an avatar library for designers and developers
pyasn1 is a generic ASN
music-metadata is a metadata parser for audio and video media files
Glances is an open-source system cross-platform monitoring tool
Glances is an open-source system cross-platform monitoring tool
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
OpenClaw versions prior to 2026
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels
Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents
OpenClaw versions prior to 2026
OpenClaw versions prior to 2026
OpenClaw versions prior to 2026
OpenClaw versions prior to 2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tips and Tricks HQ WP eMember allows Reflected XSS
Glances is an open-source system cross-platform monitoring tool
Glances is an open-source system cross-platform monitoring tool