CVE-2026-1281
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosure batch contains 10 critical-severity CVEs, an 11% increase from the prior day's 9 critical issues. High-priority vulnerabilities decreased 14% to 78, down from 91. The 14 actively exploited vulnerabilities include CVE-2026-1281 affecting Ivanti Endpoint Manager Mobile, CVE-2026-20805 targeting Microsoft Windows, and CVE-2026-20045 in Cisco Unified Communications Manager. Notable critical disclosures include CVE-2026-1699 (CVSS 10.0) in Eclipse Theia Website and CVE-2026-0963 (CVSS 9.9) in Crafty Controller's File Operations API. Patch availability stands at 0%, requiring organizations to implement compensating controls until vendor remediations become available.
Immediate action: Prioritize review of Ivanti Endpoint Manager Mobile, Microsoft Windows, Cisco Unified Communications Manager, and VMware vCenter Server deployments for actively exploited vulnerabilities. With no patches currently available, implement network segmentation, enhanced monitoring, and access restrictions as interim mitigations.
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Gogs Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Information Disclosure Vulnerability - Active in CISA KEV catalog.
Cisco Unified Communications Products Code Injection Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability - Active in CISA KEV catalog.
Versa Concerto Improper Authentication Vulnerability - Active in CISA KEV catalog.
Vite Vitejs Improper Access Control Vulnerability - Active in CISA KEV catalog.
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability - Active in CISA KEV catalog.
Linux Kernel Integer Overflow Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
GNU InetUtils Argument Injection Vulnerability - Active in CISA KEV catalog.
Microsoft Office Security Feature Bypass Vulnerability - Active in CISA KEV catalog.
AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to run commands with the application's system privileges.
aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php.
Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell commands via `subprocess.Popen()` with `shell=True`, allowing attackers to execute arbitrary commands on the host system. The `find_file()` tool executes without requiring user approval because find is considered a "safe" pre-approved command. This means an attacker can achieve Remote Code Execution (RCE) by injecting malicious arguments (like -exec) into the args parameter, completely bypassing any human-in-the-loop safety mechanisms. Commit e22a1220f764e2d7cf9da6d6144926f53ca01cde contains a fix.
NetPCLinker 1.0.0.0 contains a buffer overflow vulnerability in the Clients Control Panel DNS/IP field that allows attackers to execute arbitrary shellcode. Attackers can craft a malicious payload in the DNS/IP input to overwrite SEH handlers and execute shellcode when adding a new client.
An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal.
10-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections through carefully crafted input. Attackers can exploit the vulnerability by sending a malicious payload to the application's registration key input, enabling remote code execution and launching arbitrary system commands.
Quick Player 1.3 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious .m3l file with carefully constructed payload. Attackers can trigger the vulnerability by loading a specially crafted file through the application's file loading mechanism, potentially enabling remote code execution.
Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger processing to execute remote code on the vulnerable Sickbeard installation.
In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.
Crystal Shard http-protection 0.2.0 contains an IP spoofing vulnerability that allows attackers to bypass protection middleware by manipulating request headers. Attackers can hardcode consistent IP values across X-Forwarded-For, X-Client-IP, and X-Real-IP headers to circumvent security checks and gain unauthorized access.
Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes
Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' parameter
IBM Db2 for Windows 12
e-Learning PHP Script 0
Mocha Telnet Lite for iOS 4
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server)Â 11
Dell Unity, version(s) 5
Dell UnityVSA, version(s) 5
The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025
An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd
SQL injection vulnerability in geopandas before v
TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc
MedDream PACS Server 6
A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1
A vulnerability was identified in Tenda AC21 16
A security flaw has been discovered in Totolink A3600R 5
ChurchCRM is an open-source church management system
Koken CMS 0
Wing FTP Server 6
Frigate Professional 3
Audio Playback Recorder 3
Nidesoft DVD Ripper 5
Port Forwarding Wizard 4
Socusoft Photo to Video Converter Professional 8
FTPDummy 4
Simple Startup Manager 1
RM Downloader 2
Code Blocks 17
Frigate Professional 3
Frigate 3
Parsec is a cloud-based application for cryptographically secure file sharing
Elaniin CMS 1
Ultimate Project Manager CRM PRO 2
berliCRM 1
Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc
Infor Storefront B2B 1
A vulnerability was found in Tenda AX12 Pro V2 16
Improper Access Control vulnerability in AkÄąn Software Computer Import Export Industry and Trade Ltd
BarcodeOCR 19
CodeMeter 6
SonarQube 8
10-Strike Bandwidth Monitor 3
Outline Service 1
Andrea ST Filters Service 1
Popcorn Time 6
Atomic Alarm Clock 6
Salt's junos execution module contained an unsafe YAML decode/load usage
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node
Runtipi is a personal homeserver orchestrator
EasyPMS 1
Gnome Fonts Viewer 3
Ruijie Networks Switch eWeb S29_RGOS 11
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc
Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box
A flaw was found in Undertow
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback
HelloWeb 2
Code Blocks 20
Frigate 2
OpenCTI 3
A vulnerability was determined in itsourcecode School Management System 1
A vulnerability was identified in itsourcecode School Management System 1
A weakness has been identified in itsourcecode Society Management System 1
A security vulnerability has been detected in itsourcecode Society Management System 1
A vulnerability was detected in itsourcecode Society Management System 1
A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon
A security vulnerability has been detected in itsourcecode Directory Management System 1
A vulnerability was detected in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon
A security vulnerability has been detected in itsourcecode Student Management System 1
HotCRP is conference review software
immich is a high performance self-hosted photo and video management solution
Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation
Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages
TimeClock Software 1
PolarLearn is a free and open-source learning program
Navigate CMS 2