Critical vulnerabilities, curated daily for security professionals
Wednesday's vulnerability landscape shows increased disclosure activity with eighteen critical vulnerabilities (CVSS 9.0+) and 189 high-priority CVEs requiring assessment. The critical CVE count increased by five issues from Tuesday, while high-priority disclosures increased by 89 vulnerabilities. Ten actively exploited vulnerabilities require priority remediation. The overall critical CVE frequency shows a 54% increase compared to historical averages, marking elevated mid-week disclosure activity with limited patch availability at 9%.
Immediate action: Security teams should prioritize assessment of the five newly disclosed critical vulnerabilities and review the 189 high-priority CVEs for applicability to their environments. Organizations should expedite remediation of the ten actively exploited vulnerabilities. Given the limited 9% patch availability, teams should implement compensating controls and network segmentation where patches are not yet available.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
Meta React Server Components Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
Android Framework Information Disclosure Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Array Networks ArrayOS AG OS Command Injection Vulnerability - Active in CISA KEV catalog.
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sanitized Mermaid content. The recent security patch for MermaidArtifact.vue is insufficient and can be bypassed using unquoted HTML attributes combined with HTML entity encoding. Remote Code Execution is possible on the victim's machine via the electron.ipcRenderer interface, bypassing the regex filter intended to strip dangerous attributes. There is no fix at time of publication.
Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.
Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TalentSoft Software UNIS allows SQL Injection.This issue affects UNIS: before 42321.
Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery. This CSRF vulnerability resulting in Command Injection has been identified. This issue affects Panilux: before v.0.10.0. NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.
ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker. Exploitation of this issue does not require user interaction and scope is changed.
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction and scope is unchanged.
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network
Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network
Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally
Memory safety bugs present in Firefox ESR 140
Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally
Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally
Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally
Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally
Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally
Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally
Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally
Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7
A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution
In grantAllowlistedPackagePermissions of SettingsSliceProvider
Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge
SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls
Privilege escalation in the DOM: Notifications component
Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component
NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue
NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue
In startAlwaysOnVpn of Vpn
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code
A vulnerability has been identified in RUGGEDCOM ROX II family (All versions < V2
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session
Input verification vulnerability in the compression and decompression module
Multi-thread race condition vulnerability in the network management module
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally
ColdFusion versions 2025
ColdFusion versions 2025
ColdFusion versions 2025
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows DOM-Based XSS
ColdFusion versions 2025
A vulnerability has been identified in COMOS V10
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
ZITADEL is an open-source identity infrastructure tool
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy
In multiple functions of Session
In multiple functions of Session
In disassociate of DisassociationProcessor
In multiple functions of NotificationStation
In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code
In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation
In sendCommand of MediaSessionRecord
In multiple functions of CertInstaller
In connectInternal of MediaBrowser
In multiple functions of BaseBundle
In onActivityResult of EditFdnContactScreen
In multiple functions of HeaderPrivacyIconsController
In appendFrom of Parcel
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack
In multiple functions of WifiScanModeActivity
In multiple locations, there is a possible way for an application on a work profile to set the main user's default NFC payment setting due to improper input validation
In getComponentName of MediaButtonReceiverHolder
In onSomePackagesChanged of VoiceInteractionManagerService
In init_pkvm_hyp_vcpu of pkvm
In multiple functions of arm-smmu-v3
In startNextMatchingActivity of ActivityTaskManagerService
In validateIconUserBoundary of PrintManagerService
In findAvailRecognizer of VoiceInteractionManagerService
In setDisplayName of AssociationRequest
In multiple functions of mem_protect
In __pkvm_load_tracing of trace
In preparePackage of InstallPackageHelper
Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection
Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally
Improper access control in Storvsp