Critical vulnerabilities, curated daily for security professionals
This week's security landscape witnessed an unprecedented cascade of critical vulnerabilities with 2 CVSS 10.0 maximum-severity flaws (Logo Software Diva and GoAnywhere MFT), expired federal KEV deadline for Sangoma FreePBX, and WordPress ecosystem under sustained attack with 15+ plugin vulnerabilities. With 8 active CISA KEVs approaching Monday deadlines and only 15% patches available across 400+ weekly vulnerabilities, security teams face significant weekend remediation challenges.
Immediate action: WEEKEND PRIORITY: Patch TP-Link routers and WhatsApp before Monday KEV deadline. Address WordPress plugin vulnerabilities immediately. Change all NeuVector admin passwords if running ≤5.4.5.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
Meta Platforms WhatsApp Incorrect Authorization Vulnerability - Active in CISA KEV catalog.
TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability - Active in CISA KEV catalog.
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability - Active in CISA KEV catalog.
Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability - Active in CISA KEV catalog.
Android Runtime Use-After-Free Vulnerability - Active in CISA KEV catalog.
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating...
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' funct...
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting i...
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A ...
A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By...
Authorization Bypass Through User-Controlled SQL Primary Key, CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Logo Software Diva allows...
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, ...
Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gai...
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access...
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3
The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_media function in all versions up to, and including, 1
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3
Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2
A local attacker with low privileges on the Windows system where the software is installed can exploit this vulnerability to corrupt sensitive data
A security flaw has been discovered in PHPGurukul User Management System 1
A vulnerability was found in PHPGurukul Online Course Registration 3
A vulnerability was determined in PHPGurukul Small CRM 4
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally
The CBIS/NCS Manager API is vulnerable to an authentication bypass
An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent packages by user
The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint
A security flaw has been discovered in D-Link DIR-825 up to 2
A command injection vulnerability in COMFAST CF-XR11 (firmware V2
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software, such as the In-Sight Explorer tool, to perform management operations such as changing network settings or modifying users' access to the device
Hardcoded credentials in default configuration of PPress 0
Server-side template injection (SSTI) vulnerability in PPress 0
Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication
An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in publicly available software
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties
An issue was discovered in PPress 0
Mattermost versions 10
A vulnerability was found in whuan132 AIBattery up to 1
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow management operations on the device such as firmware upgrades and device reboot requiring an authentication
An issue was discovered in Tenda AC6 US_AC6V1
AliasVault is a privacy-first password manager with built-in email aliasing
Parameters are not validated or sanitized, and are later used in various internal operations
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal
StorageGRID (formerly StorageGRID Webscale) versions prior to 11
A vulnerability was identified in SourceCodester Hotel Reservation System 1
A weakness has been identified in itsourcecode Online Discussion Forum 1
A security vulnerability has been detected in itsourcecode Online Discussion Forum 1
A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1
A vulnerability was determined in itsourcecode Student Information Management System 1
An issue in ClipBucket 5
A vulnerability was found in SourceCodester Responsive E-Learning System 1
A vulnerability was determined in SourceCodester Pet Grooming Management Software 1
LinkAce is a self-hosted archive to collect website links
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831
Improper Validation of Specified Type of Input vulnerability in ABB FLXEON
Improper Validation of Specified Type of Input vulnerability in ABB FLXEON
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS