Critical vulnerabilities, curated daily for security professionals
Thursday's disclosures include 9 critical vulnerabilities (CVSS 9.0+), down from 22 the prior day. High-priority CVE volume increased to 100 entries. Notably, 15 vulnerabilities are actively exploited in the wild, affecting SolarWinds Web Help Desk, Cisco Unified Communications Manager, Zimbra Collaboration Suite, and Linux kernel. Two maximum-severity flaws (CVSS 10.0) were disclosed: CVE-2026-1633 in Synectix LAN 232 TRIO serial adapters and CVE-2025-59818 involving authenticated RCE via file uploads. Additional critical entries include CVE-2025-13375 (CVSS 9.8) in IBM Common Cryptographic Architecture and CVE-2026-25526 (CVSS 9.8) in HubSpot JinJava template engine. Patch availability stands at 24%, requiring organizations to prioritize compensating controls for unpatched systems.
Immediate action: Organizations using SolarWinds Web Help Desk, Cisco Unified Communications Manager, Zimbra, or Linux systems should implement network segmentation and enhanced monitoring immediately. Prioritize patching IBM CCA, HubSpot JinJava, and SiYuan installations. For Synectix serial adapters, isolate devices on management VLANs until firmware updates are applied.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Cisco Unified Communications Products Code Injection Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability - Active in CISA KEV catalog.
Versa Concerto Improper Authentication Vulnerability - Active in CISA KEV catalog.
Vite Vitejs Improper Access Control Vulnerability - Active in CISA KEV catalog.
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability - Active in CISA KEV catalog.
Linux Kernel Integer Overflow Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
GNU InetUtils Argument Injection Vulnerability - Active in CISA KEV catalog.
Microsoft Office Security Feature Bypass Vulnerability - Active in CISA KEV catalog.
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX OS Command Injection Vulnerability - Active in CISA KEV catalog.
Sangoma FreePBX Improper Authentication Vulnerability - Active in CISA KEV catalog.
JinJava is vulnerable to arbitrary Java execution via a sandbox bypass in the ForTag component, allowing unauthorized class instantiation and file access. This issue is resolved in 2.7.6 and 2.8.3.
SiYuan's /api/file/copyFile endpoint fails to validate the 'dest' parameter, allowing authenticated users to write files to arbitrary locations, potentially leading to Remote Code Execution (RCE).
Delta Course Automation is vulnerable to a critical SQL Injection flaw that allows attackers to manipulate database commands. The vendor has not responded to disclosure attempts.
Alist versions prior to 3.57.0 disable TLS certificate verification by default, exposing all outgoing storage driver communications to Man-in-the-Middle (MitM) attacks and data theft.
IBM Common Cryptographic Architecture (CCA) contains a flaw allowing unauthenticated users to execute arbitrary commands with elevated privileges. Patches are available for affected versions.
Bambuddy versions prior to 0.1.7 contain a hardcoded JWT secret key and lack authentication checks on many API routes, allowing unauthenticated access and system compromise.
The Synectix LAN 232 TRIO serial to ethernet adapter exposes its web management interface without authentication, allowing unauthenticated users to modify settings or factory reset the device.
An authenticated RCE vulnerability exists in an unspecified software product where arbitrary commands can be executed via the filename of an uploaded file.
A path traversal vulnerability in the Unstructured library's partition_msg function allows attackers to write or overwrite arbitrary files when processing malicious MSG attachments.
The Popup builder with Gamification plugin for WordPress is vulnerable to SQL Injection via REST API endpoints. This allows attackers to execute arbitrary SQL commands.
A heap buffer overflow in the libvpx library within Google Chrome allows for potential remote code execution when processing malicious media content. This is resolved in version 144.
The ThemeMove Unicamp theme for WordPress contains a Local File Inclusion (LFI) vulnerability due to improper control of filenames in PHP include statements.
A type confusion vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 144, which could allow a remote attacker to potentially exploit heap corruption via a crafted page.
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action. This allows remote attackers to extract sensitive data.
PHP AddressBook 9 is vulnerable to a high-severity security flaw that could allow for unauthorized data access or system manipulation.
A flaw in the Certificate Management feature of Cisco Meeting Management allows authenticated attackers to upload files and execute commands with root privileges.
A vulnerability in the text rendering subsystem of Cisco TelePresence CE and RoomOS allows unauthenticated remote attackers to cause a denial of service (DoS) condition.
The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation. This allows attackers to upload malicious scripts to the server.
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion (LFI). This allows attackers to read sensitive files from the server's filesystem.
Mitsubishi Electric FREQSHIP-mini for Windows contains an incorrect default permissions vulnerability, potentially allowing unauthorized local users to gain elevated system privileges.
GUnet OpenEclass 1 is affected by a critical security vulnerability that could allow for unauthorized file access or remote code execution.
GUnet OpenEclass 1 is affected by a critical security vulnerability that could lead to a complete system compromise or unauthorized data access.
An arbitrary file upload vulnerability exists in the AddFont() function of the FPDF library version 1.
Victor CMS 1 is affected by a critical vulnerability that could allow for unauthorized file manipulation or system takeover.
A security issue has been discovered in ingress-nginx involving the 'nginx' configuration handling. This vulnerability could lead to unauthorized access or configuration bypass.
A security issue was discovered in ingress-nginx related to the 'rules' processing logic. This flaw could allow for the bypass of routing restrictions.
AnyDesk 5 is affected by a high-severity security vulnerability that could permit unauthorized access or system compromise. Immediate patching is required for all legacy installations.
The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized data modification due to missing capability checks on internal functions.
A high-severity vulnerability exists in 60CycleCMS version 2 that could allow for unauthorized system compromise. Technical details suggest a significant flaw in the application's core logic.
OXID eShop version 6 contains a high-severity vulnerability that may allow for malicious code injection or unauthorized data access. The flaw represents a critical risk to e-commerce integrity.
Victor CMS version 1 is susceptible to a high-severity security flaw that could allow an attacker to gain unauthorized control over the application.
Apache Answer is vulnerable to the exposure of Private Personal Information (PPI) to unauthorized actors. This flaw could lead to a breach of user privacy.
School ERP Pro 1 is vulnerable to a high-severity security flaw that could lead to unauthorized access to sensitive educational and administrative data.
A code injection vulnerability in NVIDIA Megatron-LM for all platforms allows an attacker to execute arbitrary code by providing malicious data to a vulnerable script.
Autodesk 3ds Max is vulnerable to arbitrary code execution via an Untrusted Search Path flaw when opening a maliciously crafted project directory.
Rockwell Automation Studio 5000 Logix Designer version 30 contains a high-severity vulnerability that could impact industrial control system (ICS) configuration and security.
A vulnerability in several Samsung Exynos mobile and wearable processors, as well as specific modems, could allow for unauthorized code execution or information disclosure.
The WpEvently (mage-eventpress) WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted data, potentially leading to remote code execution.
VPN Unlimited 6 is affected by a high-severity vulnerability that could compromise the security of encrypted tunnels or lead to local privilege escalation.
BartVPN 1 contains a high-severity vulnerability that could allow an attacker to compromise the secure communication channel or escalate privileges on the host system.
Shrew Soft VPN Client 2 is vulnerable to a high-severity security flaw that could lead to local privilege escalation or the compromise of secure network tunnels.
The KiviCare clinic management system plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive data from the site's database.
Autodesk 3ds Max is vulnerable to a stack-based buffer overflow when parsing maliciously crafted GIF files, which could lead to arbitrary code execution.
Autodesk 3ds Max is vulnerable to a stack-based buffer overflow when parsing maliciously crafted GIF files, which could lead to arbitrary code execution.
A high-severity vulnerability in i-doit Open Source CMDB 1 allows for potential unauthorized access or manipulation of configuration management data within the application environment.
A Cross-site Scripting (XSS) vulnerability in Karel Electronics software allows attackers to inject malicious scripts into web pages generated by the application.
Alist, a file list program powered by Gin and Solidjs, contains a high-severity vulnerability that could lead to unauthorized file access or system compromise.
A high-severity vulnerability has been identified in the GUnet Open eClass platform, a course management system used for educational purposes.
A Reflected Cross-site Scripting (XSS) vulnerability in Ankara Hosting software allows attackers to execute malicious code via specially crafted web requests.
A high-severity vulnerability has been identified in Molecule Boltz 2, potentially allowing for unauthorized system access or data manipulation.
A vulnerability in the 'Compressing' Node.js library could allow for arbitrary file manipulation during the compression or decompression process.
A high-severity vulnerability in School ERP Pro 1 could allow unauthorized access to sensitive educational and personal data.
A security flaw in Melange, a tool for building apk packages using declarative pipelines, could allow for unauthorized actions during the build process.
A high-severity security weakness has been identified in the Ziroom ZHOME A0101 smart home device.
OpenSlides, a web-based presentation and assembly system, is affected by a high-severity vulnerability that could impact the management of agendas and elections.
AutoGPT, an AI agent orchestration platform, is affected by a high-severity vulnerability that could compromise automated workflows. Administrators should refer to vendor advisories for specific details.
A second high-severity vulnerability has been identified in the Melange apk package builder's declarative pipeline system.
A high-severity vulnerability in Disk Sorter Enterprise 12 could allow for unauthorized administrative actions or system compromise.
A high-severity vulnerability in Disk Savvy Enterprise 12 could allow attackers to gain unauthorized access to disk space analysis data or the host system.
A high-severity vulnerability in Sync Breeze Enterprise 12 could allow for unauthorized file synchronization or system access.
A high-severity vulnerability in Adaware Web Companion 4 could allow for unauthorized privilege escalation or system interference on the local machine.
Avanquest Driver Updater contains an insecure permissions vulnerability that could allow local users to perform unauthorized actions or escalate privileges on the affected system.
The CyberArk Endpoint Privilege Manager (EPM) Agent is susceptible to a high-severity vulnerability that may allow for the bypass of security controls or unauthorized privilege escalation.
Quick Heal Total Security 23 contains a vulnerability that could allow an attacker to interfere with security operations or escalate privileges on the host system.
A high-severity vulnerability has been identified in the GUnet Open eClass platform, affecting its course management capabilities.
A vulnerability in the iccDEV libraries and tools, used for ICC color management profiles, could allow for remote exploitation.
Autodesk 3ds Max is vulnerable to memory corruption when parsing a maliciously crafted RGB file, potentially leading to arbitrary code execution.
Autodesk 3ds Max contains an out-of-bounds write vulnerability when processing maliciously crafted GIF files, which may result in arbitrary code execution.
A maliciously crafted USD file, when loaded into Autodesk Arnold or 3ds Max, triggers an Out-of-Bounds Write vulnerability, potentially leading to arbitrary code execution.
Autodesk 3ds Max is subject to a memory corruption vulnerability when parsing maliciously crafted RGB files, potentially allowing for remote code execution.
A high-severity vulnerability in melange affects how declarative pipelines build apk packages, posing a significant risk to supply chain integrity.
The Godot MCP server, used for interacting with the Godot game engine, contains a vulnerability that could lead to unauthorized interactions or system compromise.
The iccDEV color management libraries are vulnerable to a flaw during the processing of ICC profiles, which could lead to memory corruption or arbitrary code execution.
The iccDEV color management libraries contain a high-severity vulnerability that could be triggered by malformed ICC profiles, leading to system instability or code execution.
A vulnerability in the iccDEV color management libraries could allow an attacker to execute arbitrary code by processing a specially crafted ICC profile.
A critical flaw in the iccDEV libraries and tools allows for potential exploitation during the manipulation and application of ICC color management profiles.
A high-severity security vulnerability exists in Wing FTP Server 6 that could allow an attacker to compromise server integrity. The flaw likely involves improper handling of system resources.
Amiti Antivirus 25 contains a high-severity security flaw that may allow an attacker to bypass security features. This vulnerability could lead to local system compromise.
NETGATE Data Backup 3 is affected by a security vulnerability that could compromise backup data integrity. The flaw is rated high severity due to its potential impact on data availability.
TexasSoft CyberPlanet 6 contains a high-severity security vulnerability that could lead to unauthorized system control. The flaw affects the management capabilities of the software.
Easy-Hide-IP 5 is affected by a high-severity security vulnerability that could result in information disclosure or traffic interception. The flaw undermines the core privacy features of the product.
ProShow Producer 9 contains a high-severity security vulnerability that could lead to arbitrary code execution. This flaw is particularly dangerous when processing specially crafted project files.
NCP Secure Entry Client 9 is affected by a high-severity vulnerability that could compromise VPN tunnel security. This flaw could allow for unauthorized access to internal network resources.
Alps Pointing-device Controller 8 contains a high-severity vulnerability that could allow for local privilege escalation. This flaw resides in the driver-level software.
Garena GCafé 3 is affected by a high-severity security vulnerability that could lead to unauthorized administrative access. The flaw impacts the management of café networks.
Adaware Web Companion version 4 contains a high-severity security vulnerability that could allow for unauthorized system modifications. The flaw affects the software's ability to protect web traffic.
A security vulnerability exists in Wacom WTabletService 6 that could allow for unauthorized actions. The flaw resides in the core service handling tablet input and driver communications.
A vulnerability in the n8n open-source workflow automation platform could allow for unauthorized access or execution. The flaw affects the core automation engine and its handling of workflow data.
The OpenClaw personal AI assistant contains a high-severity vulnerability that could allow for unauthorized access or system manipulation.
Ofisimo Web Package Flora is vulnerable to Cross-Site Scripting (XSS) via improper neutralization of input within HTTP headers. This allows attackers to inject malicious scripts into web pages.
A high-severity security issue was discovered in an unspecified product identified only as "6". The lack of detailed vendor information necessitates a cautious and broad defensive approach.
A high-severity vulnerability has been identified in a software product versioned "6". Specific technical details regarding the vulnerability type and vendor remain undisclosed in the primary summary.
The Articentgroup Zip Rar Extractor Tool 1 contains a vulnerability that could be exploited during the extraction of compressed files. This flaw affects the core file handling logic of the utility.
The Open eClass course management platform is affected by a high-severity vulnerability that could lead to unauthorized platform access or data compromise.
A security vulnerability has been identified in version 3 of the Blesta billing and management platform. The flaw affects the core application logic used for managing client accounts and financial data.
VirtualTablet Server 3 contains a security vulnerability that could be exploited to perform unauthorized actions on the host system. This affects the server component responsible for receiving input from remote devices.
A security vulnerability has been identified in the Netis E1+ version 1 range extender. This flaw resides in the device's firmware and could allow for unauthorized access to the network device.
A vulnerability in the Netis E1+ 1 range extender could allow for unauthorized device manipulation. This flaw is distinct from other reported issues for the same product line and affects core firmware components.
A security vulnerability exists in the Edimax EW-7438RPn range extender that could allow for unauthorized access or system compromise.
A vulnerability in the Fastify web framework for Node.js could allow for high-impact attacks against applications built on this framework.
A path traversal vulnerability in Moo Chan Song v4 allows unauthenticated attackers to access sensitive files on the host system.
A high-severity vulnerability in apko affects the building and publishing of OCI container images, potentially compromising container security.
Another high-severity vulnerability has been identified in the apko container build tool, impacting the security of OCI image generation.
Apollo Server is vulnerable to a security flaw that may allow unauthorized GraphQL operations or data exposure.
A security vulnerability in the Open eClass platform could allow attackers to compromise course management functions and user data.
A security flaw has been identified in the Ziroom ZHOME A0101 smart home device. This vulnerability potentially allows attackers to compromise the integrity of the device's operations.
Open5GS, an open-source implementation for 5G Core and EPC, is affected by a security flaw in versions up to 2. This vulnerability may impact mobile core network stability.
A vulnerability in Blesta 3 could allow for unauthorized access or administrative compromise within the billing and management platform.
Victor CMS 1 is vulnerable to a security flaw that could allow for unauthorized content manipulation or system access.