Critical vulnerabilities, curated daily for security professionals
Friday's vulnerability landscape is led by three maximum-severity (CVSS 10) flaws in Ubiquiti UniFi OS and multiple critical WordPress plugin issues affecting widely deployed infrastructure. Critical CVE volume rose 10% to 11, while high-priority disclosures climbed 45% to 64, indicating broader product impact across the disclosure cycle. Notable critical entries include CVE-2026-34908/34909/34910 in Ubiquiti UniFi OS, CVE-2026-48207 in Apache Fory PyFory, and CVE-2026-5433 in Honeywell Control Network. Attack patterns skew toward remote code execution and authentication bypass against network appliances, endpoint security platforms, and content management systems. Patches are not yet broadly published for today's disclosures, so defenders should prioritize compensating controls and monitor vendor advisories closely.
Immediate action: Prioritize Ubiquiti UniFi OS, Trend Micro Apex One, and WordPress plugin environments for immediate review, as these carry the highest combination of severity and exposure. With 0% patch availability reported for today's disclosures, restrict management interface exposure, apply vendor-provided mitigations, and monitor advisories for forthcoming fixes.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows unauthenticated attackers to perform spoofing over a network.
Microsoft Windows Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Microsoft DirectX NULL Byte Overwrite Vulnerability - Active in CISA KEV catalog.
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Microsoft Internet Explorer Use-After-Free Vulnerability - Active in CISA KEV catalog.
Microsoft Internet Explorer Use-After-Free Vulnerability - Active in CISA KEV catalog.
Microsoft Defender Denial of Service Vulnerability - Active in CISA KEV catalog.
Langflow Origin Validation Error Vulnerability - Active in CISA KEV catalog.
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability - Active in CISA KEV catalog.
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads, potentially allowing unauthenticated remote code execution.
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation, allowing unauthenticated users to register as administrators.
Apache Fory PyFory is vulnerable to deserialization of untrusted data, which can bypass safety policies and lead to remote code execution.
A command injection vulnerability in the Honeywell Control Network Module web interface allows unauthenticated remote code execution via command delimiters.
A vulnerability in the Trend Micro Apex One management console allows remote attackers to upload malicious code and execute commands on affected systems.
A secondary vulnerability in the Trend Micro Apex One management console allows remote attackers to upload malicious code and execute commands.
The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive database information.
An improper access control vulnerability in Ubiquiti UniFi OS devices allows network-adjacent attackers to modify system configurations without authorization.
A path traversal vulnerability in Ubiquiti UniFi OS allows network-adjacent attackers to read sensitive system files and potentially compromise user accounts.
An improper input validation flaw in Ubiquiti UniFi OS enables network-adjacent attackers to execute arbitrary commands on the underlying system.
An improper input validation vulnerability in Ubiquiti UniFi OS allows high-privileged, network-adjacent users to execute arbitrary system commands.
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1
A heap buffer overflow vulnerability exists in the Chromecast component of Google Chrome on Android, Linux, and ChromeOS, potentially allowing for memory corruption.
The Open ISES Tickets integration within Google services contains a vulnerability in versions prior to 3, which may expose sensitive information or permit unauthorized actions.
An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations
A type confusion vulnerability in the GFX component of Google Chrome on Linux and ChromeOS prior to version 148 may lead to unexpected application behavior.
Yii 2 is a PHP application framework
The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1
A vulnerability in LiteLLM prior to version 1 allows for potential unauthorized actions or information disclosure within the platform.
The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software
Dell PowerFlex Manager, version(s) <=4
In Splunk Enterprise versions below 10
Open ISES Tickets before 3
Open ISES Tickets before 3
Open ISES Tickets before 3
Open ISES Tickets before 3
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section
Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDirect) on TCP port 9100
Open ISES Tickets before 3
Open ISES Tickets before 3
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation
Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion
ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations
An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations
An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations
MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability
libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available
IINA before 1
LiteLLM prior to 1
An authentication bypass vulnerability in Netatalk 2
Mattermost versions 11
The setcred(2) system call is only available to privileged users
A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations
A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information
A flaw was found in 389-ds-base
Undefined behavior may result due to a race condition leading to a use-after-free violation
Crypt::SaltedHash versions through 0
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation
An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2
Netatalk 2
A logic error involving bitwise OR operations in Netatalk 3
An integer underflow in dsi_writeinit() in Netatalk 1
A missing output length bounds check in pull_charset_flags() in Netatalk 2
Insufficient Validation of Autoprimary SOA Queries
When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network
Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd
Authen::TOTP versions before 0
Netatalk 1
Incorrect Privilege Assignment vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables the export of user data, including cleartext passwords, via the SQL editor
An out-of-bounds read in ASP session ID handling in Netatalk 1
Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3
Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc