Critical vulnerabilities, curated daily for security professionals
Wednesday's vulnerability disclosures highlight three maximum-severity (CVSS 9.9) vulnerabilities affecting SAP Business Planning (CVE-2026-27681), HP file handling (CVE-2026-38526), and an unknown multi-product component (CVE-2026-35031), all requiring immediate risk assessment. Critical CVEs rose to 23, a 21% increase over the prior day, while high-priority vulnerabilities climbed to 100, up 15%. Adobe Connect accounts for three critical flaws (CVE-2026-27303, CVE-2026-34615, CVE-2026-27243) spanning CVSS 9.3–9.6, and Microsoft products dominate the actively exploited list with confirmed exploitation across Exchange Server, Windows, SharePoint, and legacy Office components. Remote code execution and authentication bypass patterns are prominent across enterprise collaboration and document handling platforms. Patch availability currently stands at 0%, making compensating controls and network segmentation essential for all affected systems.
Immediate action: Prioritize risk assessment for SAP Business Planning, HP, and Adobe Connect environments, as these vendors carry the highest-severity scores with no patches available. Implement network segmentation, restrict access to affected services, and monitor for exploitation activity against Microsoft Exchange, SharePoint, and Windows systems where active exploitation is confirmed.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
An unauthenticated SQL injection vulnerability in Fortinet FortiClientEMS 7.4.4 allows for unauthorized code or command execution via crafted HTTP requests.
TrueConf Client Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Link Following Vulnerability - Active in CISA KEV catalog.
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Out-of-Bounds Read Vulnerability - Active in CISA KEV catalog.
Adobe Acrobat Use-After-Free Vulnerability - Active in CISA KEV catalog.
Adobe Acrobat Reader is vulnerable to prototype pollution, which can result in arbitrary code execution when a victim opens a malicious file.
Microsoft Office Remote Code Execution - Active in CISA KEV catalog.
Microsoft SharePoint Server Improper Input Validation Vulnerability - Active in CISA KEV catalog.
PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the browser bridge (praisonai browser start) is vulnerable to unauthenticated remote session hijacking due to missing authentication and a bypassable origin check on its /ws WebSocket endpoint. The server binds to 0.0.0.0 by default and only validates the Origin header when one is present, meaning any non-browser client that omits the header is accepted without restriction. An unauthenticated network attacker can connect, send a start_session message, and the server will route it to the first idle browser-extension WebSocket (effectively hijacking that session) and then broadcast all resulting automation actions and outputs back to the attacker. This enables unauthorized remote control of connected browser automation sessions, leakage of sensitive page context and automation results, and misuse of model-backed browser actions in any environment where the bridge is network-reachable. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents.
PraisonAI GitHub Actions workflows are vulnerable to credential leakage via the ArtiPACKED attack, allowing unauthorized access to repository secrets and supply chain compromise.
The PraisonAI workflow engine is vulnerable to arbitrary command and code execution via untrusted YAML configuration files.
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
OAuth2 Proxy contains an authentication bypass vulnerability when integrated with Nginx auth_request, allowing unauthenticated access to protected resources.
Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to bypass a security feature over a network.
Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code execution (RCE) and/or arbitrary blob writes due to insufficient input validation. The issue is exploitable via URI fragment injection using unsanitized package identifiers, allowing an attacker to control the resolved blob path. This enables writes to arbitrary blobs within the storage container, not limited to .nupkg files, resulting in potential tampering of existing content. This issue has been patched in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.
The LearnPress WordPress plugin is vulnerable to unauthorized data deletion because it lacks proper capability checks on the `delete_question_answer` function.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
A path traversal vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to achieve privilege escalation via crafted file paths.
A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch.
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally
Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network
Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally
Adobe Connect versions 2025
Adobe Framemaker versions 2022
PraisonAI is a multi-agent teams system
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally
Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally
Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally
Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally
Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally
Deserialization of Untrusted Data vulnerability in Apache Storm
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7
Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Windows Client Side Caching driver (csc
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally
Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally
Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network
Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network
Acrobat Reader versions 26
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7
Nitro PDF Pro for Windows 14
Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally
simple-git enables running native Git commands from JavaScript
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network
Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController
Chamilo LMS is an open-source learning management system
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally
Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally
Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally
Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally
Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to elevate privileges locally
Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally
Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally
Chamilo LMS is an open-source learning management system
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController
Pachno 1
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network
A vulnerability was detected in Tenda F456 1
A flaw has been found in Tenda F456 1
A vulnerability has been found in Tenda F456 1
A vulnerability was found in Tenda F456 1
A vulnerability was determined in Tenda F456 1
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3
A security vulnerability has been detected in UTT HiPER 1200GW up to 2
A weakness has been identified in Totolink A3002MU B20211125
A vulnerability has been identified in SINEC NMS (All versions < V4
A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network
openITCOCKPIT is an open source monitoring tool built for different monitoring engines
Chamilo LMS is an open-source learning management system
ColdFusion versions 2023
A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2
ColdFusion versions 2023
jq is a command-line JSON processor
Totara LMS v19
nanobot is a personal AI assistant
InDesign Desktop versions 20
InDesign Desktop versions 20
InDesign Desktop versions 20
InDesign Desktop versions 20