CVE-2017-7921
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Wednesday's vulnerability disclosures are headlined by multiple critical Mozilla Firefox and Thunderbird flaws, including two perfect CVSS 10.0 sandbox escapes (CVE-2026-4688, CVE-2026-4725) and several additional 9.8-rated issues spanning privilege escalation and code execution. The day's 30 critical CVEs represent a 43% increase over Tuesday, while the 100 high-priority disclosures held steady. A critical WordPress vulnerability (CVE-2026-4001, CVSS 9.8) and a GitHub Actions workflow flaw (CVE-2026-33475, CVSS 9.1) round out the most severe new disclosures. Among the 14 actively exploited vulnerabilities, Apple products account for five entries and Google Chromium and Skia carry two, alongside ongoing exploitation of Craft CMS, Laravel Livewire, Zimbra, and Wing FTP Server. No patches are currently available for today's disclosed CVEs, making network-level mitigations and monitoring essential in the interim.
Immediate action: Prioritize Mozilla Firefox and Thunderbird updates as soon as patches become available, given the two CVSS 10.0 sandbox escapes and multiple 9.8-rated flaws. Review exposure to WordPress, GitHub Actions, and the actively exploited products â Apple, Chromium, Zimbra, Craft CMS, and Wing FTP Server â and apply compensating controls such as WAF rules and network segmentation until vendor patches are released.
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability - Active in CISA KEV catalog.
Apple Multiple products Use-After-Free Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Integer Overflow or Wraparound Vulnerability - Active in CISA KEV catalog.
Apple iOS and iPadOS Use-After-Free Vulnerability - Active in CISA KEV catalog.
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.
Wing FTP Server Information Disclosure Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability - Active in CISA KEV catalog.
Craft CMS Code Injection Vulnerability - Active in CISA KEV catalog.
Laravel Livewire Code Injection Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Improper Locking Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Classic Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Buffer Overflow Vulnerability - Active in CISA KEV catalog.
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to unauthenticated Remote Code Execution (RCE) via the PHP eval() function in custom pricing formulas.
Unauthenticated remote shell injection in Langflow's GitHub Actions workflows allows attackers to execute arbitrary commands and exfiltrate CI secrets via malicious branch names.
A critical sandbox escape vulnerability in Mozilla products, caused by a use-after-free in Disability Access APIs, allows for full system compromise.
A privilege escalation vulnerability exists in the Netmonitor component of Mozilla Firefox and Thunderbird. Successful exploitation could allow an attacker to gain elevated permissions.
A use-after-free vulnerability in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird enables a critical sandbox escape.
A critical improper input validation vulnerability (CWE-20) in MolotovCherry Android-ImageMagick7 can lead to severe system instability or unauthorized code execution.
A use-after-free vulnerability in the CSS Parsing and Computation component of Mozilla browsers allows for potential remote code execution via specifically crafted web content.
A critical use-after-free vulnerability in the Layout: Text and Fonts component of Mozilla products could allow for remote code execution when processing malicious web content.
A critical JIT miscompilation vulnerability in the JavaScript Engine of Mozilla browsers allows for remote code execution via malicious scripts.
A mitigation bypass vulnerability in the Networking: HTTP component affects several Mozilla products, including Firefox and Thunderbird.
A use-after-free vulnerability in the JavaScript Engine of Mozilla products allows unauthenticated remote code execution through memory corruption.
A JIT miscompilation in the JavaScript Engine of Mozilla products allows unauthenticated attackers to achieve remote code execution via crafted web content.
Undefined behavior in the WebRTC: Signaling component of Mozilla products creates a critical security risk for Firefox and Thunderbird users.
A use-after-free vulnerability in the Widget: Cocoa component of Mozilla products on macOS allows for remote code execution via malicious web interaction.
A use-after-free vulnerability in the JavaScript Engine of Mozilla Firefox and Thunderbird allows for critical remote code execution.
The WP DSGVO Tools (GDPR) plugin for WordPress allows unauthenticated attackers to permanently destroy non-administrator accounts by bypassing the email confirmation flow via AJAX.
An uninitialized memory vulnerability in the Graphics: Canvas2D component affects Mozilla Firefox and Thunderbird, leading to potential memory corruption.
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
Tabs Mail Carrier 2.5.1 contains a buffer overflow vulnerability in the MAIL FROM SMTP command that allows remote attackers to execute arbitrary code by sending a crafted MAIL FROM parameter. Attackers can connect to the SMTP service on port 25 and send a malicious MAIL FROM command with an oversized buffer to overwrite the EIP register and execute a bind shell payload.
Zimbra Collaboration Suite (ZCS) PostJournal service version 8.8.15 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by exploiting improper sanitization of the RCPT TO parameter via SMTP injection. Attackers can inject shell expansion syntax through the RCPT TO parameter to achieve remote code execution under the Zimbra service context.
Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix.
Download Accelerator Plus DAP 10.0.6.0 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting malicious URLs. Attackers can create specially crafted URLs with overflowing buffer data that overwrites SEH pointers and executes embedded shellcode when imported through the application's web page import functionality.
NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects environments that use PyTorch versions earlier than 2.6. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, data tampering, and information disclosure.
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Graphiti framework versions prior to 1.10.2 are vulnerable to arbitrary method execution, allowing attackers to invoke destructive operations on underlying models via malicious JSONAPI payloads.
A critical Server-Side Request Forgery (SSRF) in lollms-webui allows unauthenticated attackers to force arbitrary GET requests, potentially exfiltrating sensitive cloud metadata and IAM tokens.
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof_15.3.0.
Out-of-bounds Read vulnerability in slajerek RetroDebugger.This issue affects RetroDebugger: before v0.64.72.
Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' GET parameter
Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters
Netartmedia Vlog System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter
Heap buffer overflow in WebAudio in Google Chrome prior to 146
Heap buffer overflow in WebGL in Google Chrome prior to 146
Use after free in Dawn in Google Chrome prior to 146
Use after free in WebGPU in Google Chrome prior to 146
Use after free in FedCM in Google Chrome prior to 146
NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file
Out of bounds read in CSS in Google Chrome prior to 146
Inappropriate implementation in WebAudio in Google Chrome prior to 146
Integer overflow in Fonts in Google Chrome prior to 146
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework
NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution
Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the profile_list endpoint
Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various POST parameters
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28
The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up to, and including, 2
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4
Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
PhreeBooks ERP 5
PhreeBooks ERP 5
Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7
The installer for OM Workspace (Windows Edition) Ver 2
WWBN AVideo is an open source video platform
eNdonesia Portal v8
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file
Wallos is an open-source, self-hostable personal subscription tracker
WWBN AVideo is an open source video platform
Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters
WWBN AVideo is an open source video platform
DedeCMS v5
NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution
NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
A command injection vulnerability exists in DigitalOcean Droplet Agent through 1
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories
An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpointâs authentication method due to improper neutralization of special elements in a SQL SELECT command
Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms
A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution
NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file
NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards
Privilege escalation in the IPC component
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms
WWBN AVideo is an open source video platform
Blinko is an AI-powered card note-taking project
Census CSWeb 8
Census CSWeb 8
Connect-CMS is a content management system
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Intake is a package for finding, investigating, loading and disseminating data
An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into clicking a malicious link
Connect-CMS is a content management system
Sandbox escape due to incorrect boundary conditions in the Telemetry component
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
cgltf version 1
River Past Cam Do 3
FlexHEX 2
AIDA64 Extreme 5
AIDA64 Business 5
AIDA64 Extreme 5
Base64 Decoder 1
X-NetStat Pro 5
Connect-CMS is a content management system
Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer
Connect-CMS is a content management system
Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform
FileRise is a self-hosted web file manager / WebDAV server
Dagu is a workflow engine with a built-in Web user interface
llama
Out-of-bounds Write vulnerability in WujekFoliarz DualSenseY-v2
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in joncampbell123 doslib
A flaw was found in the libtiff library
A flaw was found in the `github
A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap
A NULL pointer dereference in the safe_atou64 function (src/misc
strongSwan versions 4
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format
Blinko is an AI-powered card note-taking project
Connect-CMS is a content management system
Active Storage allows users to attach cloud and local files in Rails applications