Critical vulnerabilities, curated daily for security professionals
Thursday's vulnerability disclosures are dominated by Cisco and WordPress, with Cisco Identity Services Engine and Webex carrying three CVSS 9.9 flaws that could enable full administrative compromise of enterprise network infrastructure. The day's 17 critical vulnerabilities represent a 26% decrease from Wednesday's 23, while 100 high-priority CVEs held steady. CVE-2026-20147 and CVE-2026-20180 target Cisco ISE, CVE-2026-20184 affects Cisco Webex, and CVE-2026-6296 impacts Google Chrome at CVSS 9.6, alongside three WordPress plugin vulnerabilities scoring 9.8. Eight actively exploited vulnerabilities span Microsoft and Adobe products, including legacy flaws in Exchange Server, SharePoint, and Acrobat Reader still being weaponized in the wild. Patch availability stands at 0%, leaving defenders reliant on compensating controls and network segmentation until vendor fixes are released.
Immediate action: Prioritize network segmentation and access restrictions for Cisco ISE, Webex, and any internet-facing WordPress deployments until patches are released. Review exposure to the eight actively exploited Microsoft and Adobe vulnerabilities, applying any existing patches for the older KEV entries and monitoring vendor channels for updates on newly disclosed flaws.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Link Following Vulnerability - Active in CISA KEV catalog.
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Out-of-Bounds Read Vulnerability - Active in CISA KEV catalog.
Adobe Acrobat Use-After-Free Vulnerability - Active in CISA KEV catalog.
Adobe Acrobat Reader is vulnerable to prototype pollution, which can result in arbitrary code execution when a victim opens a malicious file.
Microsoft Office Remote Code Execution - Active in CISA KEV catalog.
Microsoft SharePoint Server Improper Input Validation Vulnerability - Active in CISA KEV catalog.
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0.
The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.1.0. This is due to the `express_pay_product_page_pay_for_order()` function logging users in based solely on a user-supplied billing email address during guest checkout for subscription products, without verifying email ownership, requiring a password, or validating a one-time token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by providing the target user's email address in the billing_details parameter, resulting in complete account takeover and site compromise.
A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service. This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.
The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied Base64-encoded user ID in the token parameter to identify users, leaking valid authentication tokens through the 'barcodeScannerConfigs' action, and lacking meta-key restrictions on the 'setUserMeta' action. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator by first spoofing the admin user ID to leak their authentication token, then using that token to update any user's 'wp_capabilities' meta to gain full administrative access.
The Riaxe Product Customizer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.2. The plugin registers an unauthenticated AJAX action ('wp_ajax_nopriv_install-imprint') that maps to the ink_pd_add_option() function. This function reads 'option' and 'opt_value' from $_POST, then calls delete_option() followed by add_option() using these attacker-controlled values without any nonce verification, capability checks, or option name allowlist. This makes it possible for unauthenticated attackers to update arbitrary WordPress options, which can be leveraged for privilege escalation by enabling user registration and setting the default user role to administrator.
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line including the admin token configured via the --security "token=..." startup flag. An attacker can retrieve the leaked token and reuse it in the X-Dgraph-AuthToken header to gain unauthorized access to admin-only endpoints such as /admin/config/cache_mb, bypassing the adminAuthHandler token validation. This enables unauthorized privileged administrative access including configuration changes and operational control actions in any deployment where the Alpha HTTP port is reachable by untrusted parties. This issue has been fixed in version 25.3.2.
MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code.
Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.
A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.
Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.
@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required. Upgrade to @fastify/express v4.0.5 or later.
Use after free in Proxy in Google Chrome prior to 147
Use after free in Prerender in Google Chrome prior to 147
Use after free in CSS in Google Chrome prior to 147
Use after free in Video in Google Chrome prior to 147
Heap buffer overflow in PDFium in Google Chrome prior to 147
Use after free in Permissions in Google Chrome on Android prior to 147
Use after free in Forms in Google Chrome prior to 147
Use after free in Cast in Google Chrome prior to 147
Use after free in XR in Google Chrome on Android prior to 147
Use after free in Video in Google Chrome on Windows prior to 147
Use after free in FileSystem in Google Chrome prior to 147
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Graphite in Google Chrome prior to 147
Use after free in Viz in Google Chrome prior to 147
Use after free in Dawn in Google Chrome prior to 147
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network
Type Confusion in Turbofan in Google Chrome prior to 147
Type Confusion in Turbofan in Google Chrome prior to 147
Type Confusion in V8 in Google Chrome prior to 147
The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9
Adobe Connect versions 2025
Adobe Framemaker versions 2022
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147
Out of bounds write in GPU in Google Chrome prior to 147
Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user
maddy is a composable, all-in-one mail server
Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally
Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally
The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1
The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7
Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally
Heap-based buffer overflow in Windows Client Side Caching driver (csc
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally
Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network
Composer is a dependency manager for PHP
The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1
Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network
Acrobat Reader versions 26
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7
Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network
Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController
Chamilo LMS is an open-source learning management system
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally
Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally
Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally
Chamilo LMS is an open-source learning management system
Slah CMS v1
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network
OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability
A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter
A vulnerability has been identified in SINEC NMS (All versions < V4
A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network
openITCOCKPIT is an open source monitoring tool built for different monitoring engines
Chamilo LMS is an open-source learning management system
Weblate is a web based localization tool
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more
WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed
ApostropheCMS is an open-source Node
ColdFusion versions 2023
LangChain-ChatChat 0
Agent Zero 0
A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2
ColdFusion versions 2023
Command injection in the connect function in NietThijmen ShoppingCart 0
IdentityIQ 8
An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery
Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels
Luanti 5 before 5
nanobot is a personal AI assistant
A prompt injection vulnerability in Windsurf 1
Velociraptor versions prior to 0
Weblate is a web based localization tool
InDesign Desktop versions 20
InDesign Desktop versions 20
InDesign Desktop versions 20
InDesign Desktop versions 20