Critical vulnerabilities, curated daily for security professionals
Yesterday's disclosures revealed 17 critical vulnerabilities affecting Changing IDExpert Windows Logon Agent, e-Excellence U-Office Force, MongoDB, and multiple WordPress-related products. Critical CVEs jumped sharply from 3 to 17 compared to the prior day, while high-priority vulnerabilities rose from 15 to 69, reflecting a broad increase in disclosure volume. Notable critical entries include CVE-2026-2999 and CVE-2026-3000 targeting Changing IDExpert authentication agents, CVE-2026-3431 affecting MongoDB tool endpoints, and CVE-2026-2628 impacting a Microsoft 365 Entra ID SSO WordPress plugin. Attack patterns center on authentication bypass and remote code execution across identity providers, web ordering systems, and enterprise collaboration tools. No patches are currently available for yesterday's disclosures; 11 actively exploited vulnerabilities span Apple, Microsoft, Google Chromium, GitLab, and Roundcube Webmail.
Immediate action: Prioritize reviewing exposure to Changing IDExpert Windows Logon Agent, MongoDB tool endpoints, and Microsoft 365 Entra ID SSO plugin environments, as these carry CVSS 9.8 scores with no patches available. For the 11 actively exploited vulnerabilities affecting Apple, Chromium, GitLab, and Roundcube, verify that existing mitigations or prior patches are applied and monitor vendor channels for updates on newly disclosed issues.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
A memory corruption vulnerability in Apple software was addressed through improved state management to prevent potential exploitation.
Microsoft Configuration Manager SQL Injection Vulnerability - Active in CISA KEV catalog.
Notepad++ Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability - Active in CISA KEV catalog.
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Google Chrome is vulnerable to a "Use After Free" condition in its CSS engine, which could allow a remote attacker to execute arbitrary code via a crafted webpage.
GitLab Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
A remote code execution vulnerability in IDExpert Windows Logon Agent allows unauthenticated attackers to force arbitrary file downloads and execution from remote sources.
IDExpert Windows Logon Agent is vulnerable to unauthenticated remote code execution via unauthorized remote DLL downloads and execution.
An insecure deserialization vulnerability in U-Office Force allows unauthenticated remote attackers to execute arbitrary code via crafted serialized content.
The Simple Food Order System v1.0 is vulnerable to a critical SQL Injection in the edit-orders.php router, allowing for full database compromise.
The Simple Food Order System v1.0 contains a critical SQL Injection vulnerability in the cancel-order.php script, posing a risk of unauthorized database access.
Simple Food Order System v1.0 is vulnerable to SQL Injection in the view-ticket.php file, allowing unauthenticated attackers to extract sensitive information from the database.
The Simple Food Order System v1.0 is vulnerable to SQL Injection in the view-ticket-admin.php file, allowing attackers to compromise the administrative database interface.
The All-in-One Microsoft 365 SSO Login plugin for WordPress allows unauthenticated attackers to bypass authentication and gain full administrative access due to an insecure login implementation.
The RegistrationMagic WordPress plugin allows unauthenticated attackers to create administrator accounts by exploiting improper privilege management during the membership registration process.
SimStudio's MongoDB tool endpoints allow unauthenticated attackers to connect to arbitrary MongoDB instances and perform unauthorized data operations due to missing host restrictions.
A buffer overflow exists in Tenda W20E V4 routers due to improper size validation of the nptr parameter when processed by the getMibPrefix function using sprintf.
Tenda W20E V4 routers are vulnerable to a buffer overflow when processing overly long addDhcpRules data via the sscanf function without proper size validation.
Chamilo LMS is vulnerable to Remote Code Execution via an unvetted SOAP request parameter, allowing unauthenticated attackers to execute arbitrary commands on the host server.
A heap buffer overflow in multiple system locations allows for unauthenticated remote code execution without user interaction, representing a severe risk to affected devices.
Tenda W20E V4 contains a command injection vulnerability due to the failure to validate the usbPartitionName parameter before it is passed to the doSystemCmd function.
A command injection vulnerability in Tenda AC15V1 routers exists in the goform/formSetIptv endpoint due to unvalidated input in the s1_1 parameter used in system commands.
Twenty CRM is vulnerable to arbitrary code execution via the local.driver.ts module, allowing a remote attacker to compromise the application server.
The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2
Microsoft Exchange Server (through 2019) ActiveSync configurations may transmit sensitive user data, including passwords and bearer tokens, in cleartext when communicating with Samsung devices.
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28
AFFiNE is an open-source, all-in-one workspace and an operating system
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2
Textream is a free macOS teleprompter app
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7
A vulnerability in projectworlds Online Art Gallery Shop version 1 could allow attackers to compromise the e-commerce platform's security.
sourcecodester Personnel Property Equipment System v1
A security flaw in MaxSite CMS up to version 109 presents a high-severity risk to the integrity of the content management system.
A security weakness has been identified in itsourcecode Society Management System version 1, potentially allowing for unauthorized data access.
A security vulnerability in itsourcecode University Management System version 1 could lead to unauthorized access to academic and administrative records.
A flaw in itsourcecode University Management System version 1 presents a high-severity security risk to the application's environment.
A high-severity vulnerability has been determined in the Tenda F453 router, which could lead to unauthorized administrative access or system failure.
A vulnerability was identified in Tenda F453 1
A security flaw has been discovered in Tenda AC15 up to 15
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes
In multiple locations, there is a possible information disclosure due to SQL injection
In multiple locations, there is a possible privilege escalation due to a confused deputy
In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check
Chamilo is a learning management system
In broadcastIntentLockedTraced of BroadcastController
A security vulnerability has been detected in LLM-Claw 0
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI
In UsageEvents of UsageEvents
In validateAddingWindowLw of DisplayPolicy
In multiple functions of MediaProvider
In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect
In openFile of BugreportContentProvider
In setupLayout of PickActivity
In parsePermissionGroup of ParsedPermissionUtils
In hasInteractAcrossUsersFullPermission of AppInfoBase
In __pkvm_host_share_guest of mem_protect
In __host_check_page_state_range of mem_protect
In multiple functions of mem_protect
In setPackageOrComponentEnabled of ManagedServices
In createRequest of MediaProvider
In multiple functions of ffa
In multiple functions of mem_protect
In dumpBitmapsProto of ActivityManagerService
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands
Chamilo is a learning management system
Memory Corruption when accessing buffers with invalid length during TA invocation
Memory corruption while handling different IOCTL calls from the user-space simultaneously
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources
Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs
Memory Corruption when accessing trusted execution environment without proper privilege check
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs
Memory Corruption when adding user-supplied data without checking available buffer space
Memory Corruption when processing invalid user address with nonstandard buffer address
Memory corruption while using alignments for memory allocation
In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization
In multiple functions of MediaProvider
In executeRequest of ActivityStarter
In removePermission of PermissionManagerServiceImpl
In Modem, there is a possible out of bounds write due to a missing bounds check
In multiple locations, there is a possible lockscreen bypass due to a race condition
In multiple functions of KeyguardViewMediator
A security vulnerability has been identified in eosphoros-ai db-gpt version 0, potentially impacting the security of AI-driven database interactions.
In pcie, there is a possible out of bounds write due to a missing bounds check
Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE
In wlan STA driver, there is a possible out of bounds write due to a missing bounds check
Chamilo is a learning management system
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI