Critical vulnerabilities, curated daily for security professionals
Wednesday's vulnerability disclosures include 25 critical-severity CVEs, a fivefold increase from the prior day's 5, alongside 100 high-priority issues across enterprise infrastructure and application platforms. Notable critical flaws include CVE-2025-48611 (CVSS 10.0) in DeviceId.java, two CVSS 9.9 vulnerabilities in OneUptime Synthetic Monitors (CVE-2026-30887, CVE-2026-30957), and CVE-2026-0953 (CVSS 9.8) affecting WordPress. Linux kernel, HP configuration management, Appsmith, and Atlassian products also carry critical-rated vulnerabilities requiring prompt evaluation. Thirteen CVEs have confirmed active exploitation, spanning SolarWinds Web Help Desk, Roundcube Webmail, Ivanti Endpoint Manager, Broadcom VMware Aria Operations, and several Apple products. No patches have been confirmed available at this time, making compensating controls and network-level mitigations essential while vendors release fixes.
Immediate action: Prioritize review of internet-facing deployments of OneUptime, WordPress, Roundcube Webmail, Ivanti EPM, and SolarWinds Web Help Desk, as these carry critical ratings or confirmed exploitation. With 0% patch availability reported, implement network segmentation, restrict administrative access, and deploy available WAF or IDS signatures as interim mitigations until vendor patches are released.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
Omnissa Workspace ONE Server-Side Request Forgery - Active in CISA KEV catalog.
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability - Active in CISA KEV catalog.
VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.
A memory corruption vulnerability exists in memory allocation processes when handling specific alignments, potentially leading to arbitrary code execution or system instability.
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability - Active in CISA KEV catalog.
Apple Multiple products Use-After-Free Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Integer Overflow or Wraparound Vulnerability - Active in CISA KEV catalog.
Apple iOS and iPadOS Use-After-Free Vulnerability - Active in CISA KEV catalog.
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in admin, achieving Remote Code Execution (RCE) on the web server.
SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.
A stored XSS vulnerability in Appsmith's Table Widget allows authenticated users to execute malicious scripts via unsanitized HTML attributes, leading to full administrative account takeover.
An authentication bypass in the Tutor LMS Pro plugin for WordPress allows unauthenticated attackers to log in as any user, including administrators, via the Social Login addon.
NetBox-docker versions before 2.5.0 contain a superuser account with default credentials and a static API token, potentially allowing unauthorized administrative access.
A desync in persistence within DeviceId.java, caused by a missing bounds check, allows for local escalation of privilege without requiring user interaction.
OneUptime Synthetic Monitors are vulnerable to a sandbox escape via the Node.js vm module, allowing authenticated users to achieve remote code execution and full cluster compromise.
A directory traversal vulnerability in the MCP Atlassian server allows attackers to write arbitrary files to the server, potentially leading to remote code execution.
A server-side RCE vulnerability in OneUptime Synthetic Monitors allows low-privileged users to execute arbitrary commands by abusing exposed Playwright browser objects.
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
The `simple-git` library is vulnerable to a remote code execution bypass that allows attackers to circumvent previous security fixes and achieve full host compromise.
SAP NetWeaver Enterprise Portal is vulnerable to a critical deserialization flaw that allows privileged users to compromise the confidentiality, integrity, and availability of the host system.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required. An attacker can create, read, update, or delete records in any internal relationship table. Exploiting this allows the attacker to inject themselves into any Parse Role, gaining all permissions associated with that role, including full read, write, and delete access to classes protected by role-based Class-Level Permissions (CLP). Similarly, writing to any such table that backs a Relation field used in a pointerFields CLP bypasses that access control. This vulnerability is fixed in 9.5.2-alpha.7 and 8.6.20.
An unauthenticated remote attacker can bypass authentication controls on AOS-CX switches, potentially allowing them to reset the administrative password and gain full control.
A Local File Inclusion (LFI) vulnerability in WellChoose IFTOP allows unauthenticated remote attackers to execute arbitrary code on the server.
Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration.
Low-privileged users in OneUptime can achieve server-side RCE by abusing injected Playwright browser objects within Synthetic Monitors to spawn arbitrary executables.
A critical authorization bypass in OneUptime allows low-privileged users to forge headers, escape tenant isolation, and achieve full account takeover of other users.
A critical vulnerability exists in a specific component of various products, allowing an attacker to cause a major impact via an unspecified vector. Technical details remain limited.
The use of hard-coded credentials in Mitsubishi Electric MR-GM series routers allows attackers to gain unauthorized administrative access to the device.
Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering a legitimate user to import a specially crafted trace file
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31.
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.
Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1
Adobe Commerce versions 2
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network
External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally
Adobe Commerce versions 2
Adobe Commerce versions 2
Adobe Commerce versions 2
Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally
Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network
Use after free in Windows Print Spooler Components allows an authorized attacker to execute code over a network
Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network
Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally
Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally
A vulnerability in Apache Airflow allows a user with database access to execute arbitrary code on the Triggerer component by crafting a malicious database entry.
Memory safety bugs present in Firefox 148
A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7
The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4
A security issue was discovered in ingress-nginx where the `nginx
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally
External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally
Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally
Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally
Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally
Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)
An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8
A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7
A stack-based buffer overflow in the ubr-network method of the wwwubr service allows low-privileged remote attackers to achieve full device compromise via a crafted POST request.
A vulnerability was found in Tenda FH1202 1
Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network
OneUptime is a solution for monitoring and managing online services
Illustrator versions 29
A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload
A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior
MobaXterm versions prior to 26
An exposed dangerous method in Ivanti DSM before version 2026
A vulnerability in the ubr-editfile method of the wwwubr service allows low-privileged remote attackers to perform unauthorized file manipulations.
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion
Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally
Buffer Overflow vulnerability in Uderzo Software SpaceSniffer v
A high-severity vulnerability exists in the Budibase low-code platform, potentially allowing unauthorized access or manipulation of internal tools and workflows.
FileBrowser Quantum is a free, self-hosted, web-based file manager
A security flaw has been discovered in UTT HiPER 810G up to 1
A weakness has been identified in UTT HiPER 810G up to 1
By default, jailed processes cannot mount filesystems, including nullfs(4)
Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network
Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network
StudioCMS is a server-side-rendered, Astro native, headless content management system
A vulnerability in the `filestring()` function of the `nltk
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services
OliveTin gives access to predefined shell commands from a web interface
In multiple places, there is a possible out of bounds write due to memory corruption
In EfwApTransport::ProcessRxRing of efw_ap_transport
Sylius is an Open Source eCommerce Framework on Symfony
A high-severity vulnerability in ImageMagick's image processing logic could allow attackers to compromise systems that utilize the software for digital image manipulation.
A local attacker with low privileges can exploit the UBR service account to potentially escalate privileges or access sensitive system data within the Windows environment.
Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally
Incorrect default permissions in
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Premiere Pro versions 25
Substance3D - Stager versions 3
Substance3D - Stager versions 3