Critical vulnerabilities, curated daily for security professionals
Thursday's vulnerability landscape shows modest activity with twelve critical vulnerabilities (CVSS 9.0+) and 100 high-priority CVEs requiring assessment. The critical CVE count decreased by one issue from Wednesday, while high-priority disclosures remained unchanged at 100 vulnerabilities. Ten actively exploited vulnerabilities continue to require priority remediation. Patch availability improved to 15%, up from 9% on Wednesday, providing security teams with more immediate remediation options as the week progresses.
Immediate action: Security teams should assess the twelve active critical vulnerabilities and review the 100 high-priority CVEs for applicability to their environments. Organizations should prioritize remediation of the ten actively exploited vulnerabilities. With patch availability at 15%, teams should deploy available vendor patches while implementing compensating controls for vulnerabilities without immediate fixes.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
Meta React Server Components Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
Android Framework Information Disclosure Vulnerability - Active in CISA KEV catalog.
Android Framework Privilege Escalation Vulnerability - Active in CISA KEV catalog.
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Array Networks ArrayOS AG OS Command Injection Vulnerability - Active in CISA KEV catalog.
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page that are executed in the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that a victim must visit a crafted malicious page.
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page that are executed in the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that a victim must visit a crafted malicious page.
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page that are executed in the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that a victim must visit a crafted malicious page.
Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.
An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.
A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL.
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker. Exploitation of this issue does not require user interaction and scope is changed.
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction and scope is unchanged.
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AndonDesign UDesign Core u-design-core allows PHP Local File Inclusion
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows PHP Local File Inclusion
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 Elements dt-the7-core allows PHP Local File Inclusion
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network
Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network
Okta Java Management SDK facilitates interactions with the Okta management API
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network
Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North - Required Plugin north-plugin allows PHP Local File Inclusion
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally
Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network
The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version <= 5
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally
Neuron is a PHP framework for creating and orchestrating AI Agents
Memory safety bugs present in Firefox ESR 140
Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally
Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally
Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally
Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally
Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally
Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally
Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally
Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally
Acrobat Reader versions 24
Acrobat Reader versions 24
Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion
A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
Jenkins Coverage Plugin 2
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise
SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls
Privilege escalation in the DOM: Notifications component
Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component
NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue
NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider allows SQL Injection
A vulnerability has been identified in RUGGEDCOM ROX II family (All versions < V2
LeptonCMS version 7
Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands through the mobile app service wich could render the device unusable
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally
ColdFusion versions 2025
ColdFusion versions 2025
ColdFusion versions 2025
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows DOM-Based XSS
ColdFusion versions 2025
A vulnerability has been identified in COMOS V10
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
OpenSIS 9
Filament is a collection of full-stack components for accelerated Laravel development
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
ZITADEL is an open-source identity infrastructure tool
Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection
Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally
Improper access control in Storvsp
DNG SDK versions 1
SiYuan is self-hosted, open source personal knowledge management software
A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions
A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges
An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privileges
A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function
Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017
A vulnerability has been identified in RUGGEDCOM ROX II family (All versions < V2
NULL Pointer Dereference vulnerability in ravynsoft ravynos
Spoofing issue in the Downloads Panel component
SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerability
An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP