Critical vulnerabilities, curated daily for security professionals
📊
Archived Security Brief
Yesterday's disclosures included 16 critical-severity CVEs, a 27% decrease from the prior day's 22 critical vulnerabilities. High-priority vulnerabilities increased 14% to 96 entries, indicating sustained disclosure volume in the 7.0-8.9 CVSS range. Fourteen actively exploited vulnerabilities appear on the KEV list, including CVE-2026-20805 affecting Microsoft Windows, CVE-2026-20045 in Cisco Unified Communications Manager, and CVE-2025-68645 targeting Zimbra Collaboration Suite. Critical entries include three CVSS 10.0 vulnerabilities: CVE-2026-23830 in SandboxJS, CVE-2025-57792 in Explorance Blue, and CVE-2026-24897 in Erugo, alongside two SolarWinds Web Help Desk deserialization flaws (CVE-2025-40551 and CVE-2025-40553). Patch availability stands at 0%, requiring organizations to implement compensating controls and enhanced monitoring until vendor remediation becomes available.
16 critical-severity CVEs disclosed, down 27% from 22 the prior day
96 high-priority vulnerabilities (CVSS 7.0-8.9), up 14% from 84
14 actively exploited KEV entries affecting Microsoft Windows, Cisco, Zimbra, and VMware vCenter
0% patch availability across disclosed vulnerabilities requires compensating controls
SolarWinds Web Help Desk, Explorance Blue, and DNN Dokploy among affected enterprise products
Immediate action: Organizations running Microsoft Windows, Cisco Unified Communications Manager, Zimbra Collaboration Suite, SolarWinds Web Help Desk, or VMware vCenter should implement network segmentation and enhanced monitoring for the actively exploited vulnerabilities. With no patches currently available, prioritize applying compensating controls such as access restrictions and increased logging for affected systems.
How to read this brief
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges — the access they need first. No privileges means no login required.
No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
An Authentication Bypass Using an Alternate Path or Channel vulnerabilityMultiple Products
🔴 Actively exploited in the wild
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in theMultiple Products
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
SandboxJS is a JavaScript sandboxingMultiple Products
SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version (`SandboxFunction`). This is handled in `utils.ts` by mapping `Function` to `sandboxFunction` within a map used for lookups. However, before version 0.8.26, the library did not include mappings for `AsyncFunction`, `GeneratorFunction`, and `AsyncGeneratorFunction`. These constructors are not global properties but can be accessed via the `.constructor` property of an instance (e.g., `(async () => {}).constructor`). In `executor.ts`, property access is handled. When code running inside the sandbox accesses `.constructor` on an async function (which the sandbox allows creating), the `executor` retrieves the property value. Since `AsyncFunction` was not in the safe-replacement map, the `executor` returns the actual native host `AsyncFunction` constructor. Constructors for functions in JavaScript (like `Function`, `AsyncFunction`) create functions that execute in the global scope. By obtaining the host `AsyncFunction` constructor, an attacker can create a new async function that executes entirely outside the sandbox context, bypassing all restrictions and gaining full access to the host environment (Remote Code Execution). Version 0.8.26 patches this vulnerability.
Explorance Blue versions prior toMultiple Products
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk.
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.
Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares.
By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.
Explorance Blue versions prior toMultiple Products
Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote codeMultiple Products
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote codeMultiple Products
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
10-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows remote attackers to execute arbitrary code. Attackers can craft a malicious file with 209 bytes of padding and a specially constructed Structured Exception Handler to trigger code execution.
Zortam Mp3 Media Studio 27.60 contains a buffer overflow vulnerability in the library creation file selection process that allows remote code execution. Attackers can craft a malicious text file with shellcode to trigger a structured exception handler (SEH) overwrite and execute arbitrary commands on the target system.
Explorance Blue versions prior toMultiple Products
Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict uploaded file types, allowing malicious files to be uploaded and executed by the server. This condition enables remote code execution under default configurations.
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that ifMultiple Products
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerabilityMultiple Products
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
YATinyWinFTP contains a denial of service vulnerability that allows attackers to crash the FTP service by sending aMultiple Products
YATinyWinFTP contains a denial of service vulnerability that allows attackers to crash the FTP service by sending a 272-byte buffer with a trailing space. Attackers can exploit the service by connecting and sending a malformed command that triggers a buffer overflow and service crash.
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.
The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generate_sso_url' and 'validate_sso_token' functions in versions 2
The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files
Dell CloudBoost Virtual Appliance, versions prior to 19
CVE-2026-24747
8.8
PyTorchMultiple Products
PyTorch is a Python package that provides tensor computation
CVE-2025-41726
8.8
DeviceMultiple Products
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes
WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating email credentials
CVE-2026-24772
8.9
OpenProjectMultiple Products
OpenProject is an open-source, web-based project management software
CVE-2020-36938
8.8
WinAVRMultiple Products
WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables
CVE-2020-36942
8.8
VictorMultiple Products
Victor CMS 1
CVE-2026-24778
8.8
GhostMultiple Products
Ghost is an open source content management system
CVE-2025-67645
8.8
OpenEMRMultiple Products
OpenEMR is a free and open source electronic health records and medical practice management application
CVE-2025-58150
8.8
ShadowMultiple Products
Shadow mode tracing code uses a set of per-CPU variables to avoid
cumbersome parameter passing
CVE-2020-36969
8.8
UnknownMultiple Products
M/Monit 3
CVE-2025-57793
8.6
priorMultiple Products
Explorance Blue versions prior to 8
CVE-2026-24882
8.4
GnuPGMultiple Products
In GnuPG before 2
CVE-2020-36965
8.4
docPrintMultiple Products
docPrint Pro 8
CVE-2020-36970
8.4
PMBMultiple Products
PMB 5
CVE-2020-36971
8.4
NidesoftMultiple Products
Nidesoft 3GP Video Converter 2
CVE-2021-47902
8.2
ManagementMultiple Products
Testa Online Test Management System 3
CVE-2025-55292
8.2
MeshtasticMultiple Products
Meshtastic is an open source mesh networking solution
CVE-2026-24842
8.2
UnknownMultiple Products
node-tar,a Tar for Node
CVE-2020-36972
8.2
SmartBlogMultiple Products
SmartBlog 2
CVE-2026-24869
8.1
UnknownMultiple Products
Use-after-free in the Layout: Scrolling and Overflow component
CVE-2026-24881
8.1
GnuPGMultiple Products
In GnuPG before 2
CVE-2026-24741
8.1
ConvertXisMultiple Products
ConvertXis a self-hosted online file converter
CVE-2025-40536
8.1
SolarWindsMultiple Products
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality
CVE-2026-24840
8
DokployMultiple Products
Dokploy is a free, self-hostable Platform as a Service (PaaS)
CVE-2026-21569
7.9
ThisMultiple Products
This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7
CVE-2025-41727
7.8
DeviceMultiple Products
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access
CVE-2026-0648
7.8
stemsMultiple Products
The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek
CVE-2026-24873
7.8
RinnegatamanteMultiple Products
Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita
CVE-2026-24875
7.8
yoyofr IntegerMultiple Products
Integer Overflow or Wraparound vulnerability in yoyofr modizer
CVE-2025-33234
7.8
NVIDIAMultiple Products
NVIDIA runx contains a vulnerability where an attacker could cause a code injection
CVE-2020-36974
7.8
RealtekMultiple Products
Realtek Andrea RT Filters 1
CVE-2020-36975
7.8
StatusMultiple Products
EPSON Status Monitor 3 version 8
CVE-2020-36976
7.8
RegistrationMultiple Products
Acer Global Registration Service 1
CVE-2020-36977
7.8
ElevationServiceMultiple Products
Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious code
CVE-2020-36979
7.8
ServiceMultiple Products
Atheros Coex Service Application 8
CVE-2020-36980
7.8
SAntivirusMultiple Products
SAntivirus IC 10
CVE-2020-36981
7.8
DeviceMultiple Products
Motorola Device Manager 2
CVE-2020-36982
7.8
DeviceMultiple Products
Motorola Device Manager 2
CVE-2020-36983
7.8
FTPMultiple Products
Quick 'n Easy FTP Service 3
CVE-2020-36984
7.8
EPSONMultiple Products
EPSON 1
CVE-2020-36985
7.8
WatcherMultiple Products
IP Watcher 3
CVE-2020-36986
7.8
PreyMultiple Products
Prey 1
CVE-2020-36987
7.8
AccessMultiple Products
Program Access Controller 1
CVE-2020-36989
7.8
ManagementMultiple Products
ForensiT AppX Management Service 2
CVE-2020-36990
7.8
InputMultiple Products
Input Director 1
CVE-2020-36991
7.8
ShareMouseMultiple Products
ShareMouse 5
CVE-2025-33219
7.8
NVIDIAMultiple Products
NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wraparound
CVE-2025-33220
7.8
NVIDIAMultiple Products
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed
CVE-2026-24856
7.8
iccDEVMultiple Products
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles
CVE-2025-68662
7.6
DiscourseMultiple Products
Discourse is an open source discussion platform
CVE-2026-24827
7.5
gerstrongMultiple Products
Out-of-bounds Write vulnerability in gerstrong Commander-Genius
CVE-2026-24828
7.5
Missing Release ofMultiple Products
Missing Release of Memory after Effective Lifetime vulnerability in Is-Daouda is-Engine
CVE-2020-36939
7.5
CassandraMultiple Products
Cassandra Web 0
CVE-2020-36946
7.5
SyncBreezeMultiple Products
SyncBreeze 10
CVE-2025-69420
7.5
IssueMultiple Products
Issue summary: A type confusion vulnerability exists in the TimeStamp Response
verification code where an ASN1_TYPE union member is accessed without first
validating the type, causing an invalid or NULL pointer dereference when
processing a malformed TimeStamp Response file
CVE-2026-24831
7.5
LoopMultiple Products
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ixray-team ixray-1
CVE-2026-24868
7.5
MitigationMultiple Products
Mitigation bypass in the Privacy: Anti-Tracking component
CVE-2026-22258
7.5
NSMMultiple Products
Suricata is a network IDS, IPS and NSM engine
CVE-2026-22259
7.5
NSMMultiple Products
Suricata is a network IDS, IPS and NSM engine
CVE-2026-22260
7.5
NSMMultiple Products
Suricata is a network IDS, IPS and NSM engine
CVE-2026-24783
7.5
UnknownMultiple Products
soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts
CVE-2025-40537
7.5
SolarWindsMultiple Products
SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions
CVE-2020-36943
7.5
aScMultiple Products
aSc TimeTables 2021
CVE-2026-22264
7.4
NSMMultiple Products
Suricata is a network IDS, IPS and NSM engine
CVE-2026-1534
7.3
MusicMultiple Products
A weakness has been identified in code-projects Online Music Site 1
CVE-2026-1535
7.3
MusicMultiple Products
A security vulnerability has been detected in code-projects Online Music Site 1
CVE-2026-1545
7.3
ManagementMultiple Products
A weakness has been identified in itsourcecode School Management System 1
CVE-2026-1505
7.2
D-LinkMultiple Products
A vulnerability was found in D-Link DIR-615 4
CVE-2026-1506
7.2
D-LinkMultiple Products
A vulnerability was determined in D-Link DIR-615 4
CVE-2020-36947
7.1
LibreNMSMultiple Products
LibreNMS 1
CVE-2026-24779
7.1
servingMultiple Products
vLLM is an inference and serving engine for large language models (LLMs)