CVE-2026-20131
A critical insecure deserialization flaw in the Cisco FMC web interface allows unauthenticated remote attackers to execute arbitrary Java code with root privileges via crafted serial objects.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Saturday's vulnerability disclosures highlight critical flaws across enterprise infrastructure, with Oracle Identity Manager (CVE-2026-21992, CVSS 9.8), WordPress (CVE-2026-3584, CVSS 9.8), and SiYuan (CVE-2026-32938, CVSS 9.9) among the most severe. The day saw 20 critical vulnerabilities, down 35% from Friday's 31, while 100 high-priority CVEs remained steady. Cisco Secure Firewall Management Center (CVE-2026-20131), Ivanti Endpoint Manager (CVE-2026-1603), and Broadcom VMware Aria Operations (CVE-2026-22719) are confirmed under active exploitation. Google Chrome V8 and Skia components also have actively exploited flaws, alongside legacy vulnerabilities in Apple and Hikvision products resurfacing in exploit activity. No patches are currently available for the disclosed vulnerabilities, requiring defenders to prioritize compensating controls and monitoring.
Immediate action: Prioritize network-level mitigations for Cisco FMC, Ivanti EPM, and VMware Aria Operations environments where active exploitation is confirmed. With 0% patch availability, implement compensating controls including network segmentation, enhanced logging, and access restrictions for affected systems â particularly Oracle Identity Manager and WordPress deployments â until vendor patches are released.
A critical insecure deserialization flaw in the Cisco FMC web interface allows unauthenticated remote attackers to execute arbitrary Java code with root privileges via crafted serial objects.
Omnissa Workspace ONE Server-Side Request Forgery - Active in CISA KEV catalog.
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability - Active in CISA KEV catalog.
VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.
A memory corruption vulnerability exists in memory allocation processes when handling specific alignments, potentially leading to arbitrary code execution or system instability.
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability - Active in CISA KEV catalog.
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability - Active in CISA KEV catalog.
Apple Multiple products Use-After-Free Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Integer Overflow or Wraparound Vulnerability - Active in CISA KEV catalog.
Apple iOS and iPadOS Use-After-Free Vulnerability - Active in CISA KEV catalog.
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.
Wing FTP Server Information Disclosure Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability - Active in CISA KEV catalog.
Craft CMS Code Injection Vulnerability - Active in CISA KEV catalog.
Laravel Livewire Code Injection Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Improper Locking Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Classic Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Buffer Overflow Vulnerability - Active in CISA KEV catalog.
WeGIA versions 3.6.5 and below contain an authenticated SQL injection vulnerability in the restaurar_produto.php endpoint, potentially leading to full database compromise.
WeGIA versions 3.6.6 and below are vulnerable to Reflected Cross-Site Scripting (XSS) in the novo_memorandoo.php endpoint, allowing arbitrary JavaScript execution in user browsers.
A Reflected XSS vulnerability in WeGIA's listar_memorandos_ativos.php endpoint allows attackers to inject malicious JavaScript via the sccd GET parameter.
SiYuan versions 3.6.0 and below contain an authorization bypass in the search endpoint, allowing authenticated users to execute arbitrary SQL statements against the underlying SQLite database.
The Kali Forms WordPress plugin is vulnerable to Remote Code Execution (RCE) via the form_process function, allowing unauthenticated attackers to execute arbitrary code.
SiYuan versions 3.6.0 and below are vulnerable to path traversal and sensitive file exfiltration via improper validation of file:// links in pasted HTML.
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability, enabling remote code execution via malicious ZIP archives.
A critical vulnerability in Oracle Identity Manager and Web Services Manager allows unauthenticated network-based takeover via HTTP.
Anchorr versions 1.4.1 and below suffer from a stored XSS vulnerability in the User Mapping dropdown, enabling unauthenticated attackers to exfiltrate critical secrets and API keys.
Admidio versions 5.0.0 through 5.0.6 fail to validate delete permissions and CSRF tokens in the documents module, allowing unauthenticated or low-privileged users to delete files.
SiYuan versions 3.6.0 and below contain a click-through XSS vulnerability in the dynamic icon API due to incomplete SVG sanitization.
Anchorr versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector, allowing for full administrative session takeover and service-wide credential theft.
The Aimogen Pro plugin for WordPress allows unauthenticated arbitrary function calls. Attackers can exploit this to change the default user role to administrator and gain full site control.
gRPC-Go versions prior to 1.79.3 are vulnerable to an authorization bypass due to improper input validation of HTTP/2 :path pseudo-headers, allowing attackers to circumvent path-based security rules.
Mesop versions 1.2.2 and below contain an unauthenticated remote code execution (RCE) vulnerability in a debugging endpoint within the AI testing module.
Mesop versions 1.2.2 and below are vulnerable to path traversal, allowing unauthorized users to manipulate or delete arbitrary files on the host disk.
OpenClaw versions prior to 2026.3.12 suffer from an authorization bypass in the WebSocket path, allowing authenticated users to self-declare administrative privileges.
WebSocket endpoints in OCPP-compliant charging infrastructure lack authentication, allowing unauthenticated attackers to impersonate charging stations and manipulate backend data.
A critical authentication flaw in OCPP WebSocket endpoints allows unauthenticated attackers to impersonate charging stations and manipulate backend commands and data.
Service information in WebCTRL is transmitted unencrypted over BACnet, allowing attackers to sniff, intercept, and modify sensitive PLC update data and file positions.
Use after free in Digital Credentials API in Google Chrome prior to 146
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania allows PHP Local File Inclusion
Use after free in Base in Google Chrome prior to 146
Heap buffer overflow in CSS in Google Chrome prior to 146
Heap buffer overflow in WebAudio in Google Chrome prior to 146
Stack buffer overflow in WebRTC in Google Chrome prior to 146
Use after free in WebRTC in Google Chrome prior to 146
Use after free in WebRTC in Google Chrome prior to 146
Heap buffer overflow in ANGLE in Google Chrome prior to 146
Use after free in Blink in Google Chrome prior to 146
Use after free in Network in Google Chrome prior to 146
Heap buffer overflow in PDFium in Google Chrome prior to 146
Use after free in Extensions in Google Chrome prior to 146
Heap buffer overflow in WebRTC in Google Chrome prior to 146
Out of bounds memory access in WebGL in Google Chrome on Android prior to 146
Out of bounds read and write in WebGL in Google Chrome prior to 146
Inappropriate implementation in V8 in Google Chrome prior to 146
Out of bounds write in V8 in Google Chrome prior to 146
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 146
Integer overflow in ANGLE in Google Chrome on Windows prior to 146
Type Confusion in V8 in Google Chrome prior to 146
Out of bounds read and write in WebAudio in Google Chrome prior to 146
Out of bounds read in Skia in Google Chrome prior to 146
Inappropriate implementation in V8 in Google Chrome prior to 146
Out of bounds read in Blink in Google Chrome prior to 146
Integer overflow in ANGLE in Google Chrome prior to 146
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework
Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network
Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network
MariaDB server is a community developed fork of MySQL server
Kysely is a type-safe TypeScript SQL query builder
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2
The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1
Budibase is a low code platform for creating internal tools, workflows, and admin panels
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft 365 Copilot's Business Chat allows an authenticated attacker to elevate privileges across a network.
The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1
The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3
The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx
Admidio is an open-source user management solution
WWBN AVideo is an open source video platform
Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud
Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
WWBN AVideo is an open source video platform
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
OpenEMR is a free and open source electronic health records and medical practice management application
pyLoad is a free and open-source download manager written in Python
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
A vulnerability was found in D-Link DIR-513 1
A vulnerability was detected in Tenda A18 Pro 02
A flaw has been found in Tenda A18 Pro 02
A vulnerability has been found in Tenda A18 Pro 02
A vulnerability was found in Tenda A18 Pro 02
A vulnerability was determined in Tenda A18 Pro 02
pydicom is a pure Python package for working with DICOM files
Under certain conditions, an attacker could bind to the same port used by WebCTRL
libfuse is the reference implementation of the Linux FUSE
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service
Stirling-PDF is a locally hosted web application that performs various operations on PDF files
Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints
An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges
BMC FootPrints ITSM versions 20
OpenClaw versions prior to 2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
Langflow is a tool for building and deploying AI-powered agents and workflows
A vulnerability has been found in Yi Technology YI Home Camera 2 2
A vulnerability was determined in UTT HiPER 1200GW up to 2
Precurio Intranet Portal 4
A vulnerability was identified in UTT HiPER 1250GW up to 3
OpenClaw versions 2026
OpenClaw versions prior to 2026
Statamic is a Laravel and Git powered content management system (CMS)
Improper Restriction of XML External Entity Reference vulnerability in XMLUtils
LuCI is the OpenWrt Configuration Interface
Allure 2 is the version 2
FileRise is a self-hosted web file manager / WebDAV server
barebox is a bootloader
OpenEMR is a free and open source electronic health records and medical practice management application
OpenEMR is a free and open source electronic health records and medical practice management application
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application
A vulnerability was identified in Yi Technology YI Home Camera 2 2
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations
mcp-memory-service is an open-source memory backend for multi-agent systems
OneUptime is a solution for monitoring and managing online services
OpenClaw versions prior to 2026
Admidio is an open-source user management solution
ScreenToGif is a screen recording tool
OpenClaw versions prior to 2026
SiYuan is a personal knowledge management system
OpenEMR is a free and open source electronic health records and medical practice management application
Cryptomator encrypts data being stored on cloud infrastructure
OpenClaw versions prior to 2026