Critical vulnerabilities, curated daily for security professionals
Yesterday's vulnerability disclosures revealed 5 critical CVEs, representing an 86% decrease from the prior day's 37 critical findings. High-priority vulnerabilities remained steady at 100, unchanged from the previous reporting period. Five actively exploited vulnerabilities require attention, including CVE-2025-14847 affecting MongoDB, CVE-2026-20805 targeting Microsoft Windows, and CVE-2025-37164 in HPE OneView. Notable critical vulnerabilities include CVE-2026-22686 and CVE-2026-23550, both scoring CVSS 10.0, affecting Enclave JavaScript sandbox and Modular DS respectively, along with CVE-2025-14301 impacting WooCommerce integrations. Patch availability stands at 0%, necessitating compensating controls and monitoring until vendor updates become available.
Immediate action: Organizations running MongoDB, Microsoft Windows, HPE OneView, Gogs, or affected WordPress plugins should implement network segmentation and enhanced monitoring as compensating controls. With no patches currently available, prioritize vulnerability scanning to identify exposed assets and establish alerting for vendor security bulletins.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
Microsoft Office PowerPoint Code Injection Vulnerability - Active in CISA KEV catalog.
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability - Active in CISA KEV catalog.
Gogs Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Information Disclosure Vulnerability - Active in CISA KEV catalog.
The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the `process_table_bulk_actions()` function processing user-supplied file paths without authentication checks, nonce verification, or path validation. This makes it possible for unauthenticated attackers to delete or download arbitrary files on the server via the `wsaw-log[]` POST parameter, which can be leveraged to delete critical files like `wp-config.php` or read sensitive configuration files.
The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.
Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.
FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network
Bitrix24 contains an authenticated remote code execution vulnerability that allows logged-in attackers to execute arbitrary system commands through the PHP command line admin interface
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server
Hono is a Web application framework that provides support for any JavaScript runtime
Hono is a Web application framework that provides support for any JavaScript runtime
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability
Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally
A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges
Pimcore is an Open Source Data & Experience Management Platform
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration
SumatraPDF is a multi-format reader for Windows
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally
TeamSpeak 3
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table
Memory safety bugs present in Firefox ESR 140
Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network
External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network
Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally
Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally
Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally
Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally
Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally
Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally
Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
ProtonVPN 1
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free
Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally
A vulnerability exists in Progress Flowmon ADS versions prior to 12
Sandbox escape due to integer overflow in the Graphics component
Use-after-free in the IPC component
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles
4images 1
NanoCMS 0
e107 CMS version 3
Algo 8028 Control Panel version 3
e107 CMS version 3
WBCE CMS version 1
An issue in Semantic machines v5
Dreamweaver Desktop versions 21
Dreamweaver Desktop versions 21
Dreamweaver Desktop versions 21
Dreamweaver Desktop versions 21
Illustrator versions 29
Splashtop 8
CoolerMaster MasterPlus 1
Wondershare Dr
Wondershare Dr
Wondershare FamiSafe 1
Wondershare MobileTrans 3
Wondershare UBackit 2
ITeC ITeCProteccioAppServer contains an unquoted service path vulnerability that allows local attackers to execute code with elevated system privileges
EaseUS Data Recovery 15
PTPublisher 2
VIVE Runtime Service 1
Sandboxie-Plus 5
WOW21 5
Cobian Backup 0
Private Internet Access 3
BlueSoleilCS 5
Connectify Hotspot 2018 contains an unquoted service path vulnerability in its ConnectifyService executable that allows local attackers to potentially execute arbitrary code
Emerson PAC Machine Edition 9
Cain & Abel 4
CONTPAQi AdminPAQ 14
Clevo HotKey Clipboard 2
Outline 1
Mediconta 3
Tftpd32 SE 4
Multi-thread race condition vulnerability in the card framework module
Multi-thread race condition vulnerability in the video framework module
An insecure authentication mechanism in the safe_exec
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library version 2
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system
Senayan Library Management System 9
VIAVIWEB Wallpaper Admin 1
Aero CMS 0
Social-Share-Buttons 2
WorkOrder CMS 0
Mitigation bypass in the DOM: Security component
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Multi-thread race condition vulnerability in the card framework module
Multi-thread race condition vulnerability in the card framework module
Multi-thread race condition vulnerability in the card framework module