Critical vulnerabilities, curated daily for security professionals
Thursday's disclosures center on critical infrastructure components, with Cisco Secure Workload, NLnet Labs Unbound DNSSEC resolver, and Netatalk file sharing facing maximum-severity flaws. The brief covers 10 critical CVEs (down 58% from prior day) and 44 high-priority vulnerabilities (down 31%), reflecting a narrower but more impactful disclosure set. Notable entries include CVE-2026-20223 (CVSS 10) in Cisco Secure Workload, CVE-2026-42960 (CVSS 10) in NLnet Labs Unbound, and CVE-2026-44050 (CVSS 9.9) in Netatalk. Attack patterns skew toward remote code execution and authentication bypass against network appliances, DNS infrastructure, and WordPress ecosystem plugins, with embedded SMS gateway devices also appearing twice. No vendor patches are currently published for these disclosures, and nine CVEs carry confirmed active exploitation including a Cisco Catalyst SD-WAN flaw and multiple Microsoft Defender issues.
Immediate action: Prioritize inventory and mitigation for Cisco Secure Workload, Cisco Catalyst SD-WAN, NLnet Labs Unbound resolvers, Netatalk deployments, and Microsoft Defender installations, since these account for the highest-severity and actively exploited issues. With no patches yet available, apply vendor-recommended workarounds, restrict management interfaces, and increase monitoring on affected DNS and network infrastructure until fixes ship.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability - Active in CISA KEV catalog.
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows unauthenticated attackers to perform spoofing over a network.
Microsoft Windows Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Microsoft DirectX NULL Byte Overwrite Vulnerability - Active in CISA KEV catalog.
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Microsoft Internet Explorer Use-After-Free Vulnerability - Active in CISA KEV catalog.
Microsoft Internet Explorer Use-After-Free Vulnerability - Active in CISA KEV catalog.
Microsoft Defender Denial of Service Vulnerability - Active in CISA KEV catalog.
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally
The Avada Builder plugin for WordPress is vulnerable to unauthenticated remote code execution via PHP function injection in the `fusion_get_widget_markup` AJAX endpoint.
The Taiko AG1000-01A SMS Alert Gateway exposes hard-coded administrative credentials via client-side JavaScript in its configuration interface.
Cisco Secure Workload contains an access validation flaw in internal REST APIs that permits unauthenticated, remote attackers to perform unauthorized configuration changes as a Site Admin.
NLnet Labs Unbound contains a DNSSEC validation flaw that can be exploited to cause a denial-of-service or potentially remote code execution.
NLnet Labs Unbound is vulnerable to cache poisoning via promiscuous RRSets in the authority section of DNS replies, allowing attackers to inject malicious records into the cache.
The Taiko AG1000-01A SMS Alert Gateway web interface lacks server-side authentication, allowing unauthenticated attackers to access internal pages directly.
The WP Swings Gift Cards For WooCommerce Pro plugin allows unauthenticated users to upload malicious files, leading to potential site compromise.
Netatalk contains a heap-based buffer overflow vulnerability within the `cnid` daemon's `comm_rcv()` function.
Certain ZKTeco CCTV cameras expose an undocumented, unauthenticated configuration export port that reveals sensitive information, including account credentials.
The Mesalvo Meona Client and Server components are vulnerable to code injection, allowing an attacker to execute code on other users' systems.
A use-after-free vulnerability exists in the WebRTC component of Google Chrome on Linux, which could allow for arbitrary code execution.
A use-after-free vulnerability in the GPU component of Google Chrome on Windows could lead to memory corruption and potential arbitrary code execution.
A use-after-free vulnerability in the QUIC protocol implementation within Google Chrome could allow an attacker to trigger memory corruption.
A use-after-free vulnerability exists in the XR (Extended Reality) component of Google Chrome on Windows, potentially leading to code execution.
A heap buffer overflow vulnerability in the WebRTC component of Google Chrome could allow attackers to execute arbitrary code.
Use after free in WebRTC in Google Chrome prior to 148
Use after free in DOM in Google Chrome on prior to 148
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network
NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file
Out of bounds read in GPU in Google Chrome on prior to 148
In Netatalk 3
Improper link resolution before file access ('link following') in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally
Twig versions 2
NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems
NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection
NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write
Privilege escalation in the Application Update component
Privilege escalation in the DOM: Workers component
Privilege escalation in the Enterprise Policies component
Privilege escalation in the WebRTC: Audio/Video component
BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository
Taiko AG1000-01A SMS Alert Gateway Rev 7
MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v
InfoScale CmdServer before 7
In Netatalk 2
authentik is an open-source identity provider
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases
Mitigation bypass in the DOM: Security component
In Netatalk 3
Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd
In `src/havegecmd
`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`
Improper Access Control vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables a normal user gaining access to the admin panel
Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industry and Trade Ltd
In Netatalk 2
Information disclosure in the DOM: Security component
Information disclosure in the IP Protection component
Information disclosure in the Graphics: WebGPU component
NLnet Labs Unbound up to and including version 1
NLnet Labs Unbound 1
NLnet Labs Unbound up to and including version 1