Critical vulnerabilities, curated daily for security professionals
OpenStack Mistral (CVE-2026-41283, CVSS 9.9) and ABB T-MAC Plus (CVE-2025-14771, CVSS 9.9) lead the day's disclosures, exposing cloud orchestration and industrial monitoring systems to severe compromise. Five critical CVEs were disclosed, down 29% from the prior day's seven, while high-priority vulnerabilities rose 218% to 54 from 17. Additional critical flaws include CVE-2026-47065 (CVSS 9.8) and CVE-2026-36576 (CVSS 9.8) in Openlabs docker-wkhtmltopdf-aas, broadening exposure across containerized and multi-product deployments. The disclosures span cloud platforms, industrial control software, and web infrastructure, with several actively exploited issues affecting Palo Alto Networks PAN-OS and Oracle WebLogic Server. Patches are not yet reflected as available across this set, so organizations should prioritize compensating controls and monitoring while vendor fixes are confirmed.
Immediate action: Prioritize OpenStack Mistral, ABB T-MAC Plus, and Openlabs docker-wkhtmltopdf-aas deployments for immediate review, alongside actively exploited Palo Alto Networks PAN-OS and Oracle WebLogic Server systems. With patches not yet available for this set, apply vendor-recommended mitigations, restrict network exposure, and increase monitoring on affected services until fixes are confirmed.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
An authentication bypass vulnerability exists in Palo Alto Networks PAN-OS GlobalProtect, allowing unauthenticated attackers to forge authentication cookies and establish unauthorized VPN connections.
Oracle WebLogic Server contains an unspecified vulnerability that is currently being exploited in the wild.
A privilege escalation vulnerability in the Linux Kernel cgroup_release_agent_write function allows unprivileged users to escape container environments and gain elevated host privileges.
Mirasvit Full Page Cache Warmer for Magento 2 contains a PHP object injection vulnerability allowing unauthenticated RCE via the CacheWarmer cookie.
An integer overflow vulnerability in the Android Framework allows for potential unauthorized system access and is currently tracked in the CISA KEV catalog.
Multiple deserialization vulnerabilities exist that allow filter bypass and the triggering of unintended static initializers in Java-based products.
An OS command injection vulnerability in the app.py component allows unauthenticated attackers to execute arbitrary commands via a crafted POST request.
OpenStack Mistral allows arbitrary remote code execution via exposed API endpoints, potentially leading to the exfiltration of sensitive service credentials.
An unauthenticated remote attacker can recover a hardcoded password from a firmware image to gain full device access.
A vulnerability in ABB T-MAC Plus allows unauthorized external parties to access restricted files or directories.
A use-after-free vulnerability in Microsoft Office allows unauthorized attackers to achieve local code execution.
Dräger Infinity Explorer C700 contains a privilege escalation vulnerability that allows attackers to break out of kiosk mode to access the underlying operating system.
A use-after-free vulnerability in the Google Chrome Password manager allows for potential sandbox escapes.
A use-after-free vulnerability in the Google Chrome XR component allows for potential sandbox escapes.
A use-after-free vulnerability in the Google Chrome Skia graphics library allows for potential sandbox escapes.
A use-after-free vulnerability in the Google Chrome GPU process allows for potential sandbox escapes.
A use-after-free vulnerability exists in the ANGLE component of Google Chrome, potentially allowing for sandbox escapes.
A use-after-free vulnerability in the Accessibility component of Google Chrome could allow remote attackers to escape the sandbox.
A use-after-free vulnerability in the ANGLE component of Google Chrome allows for potential remote sandbox escapes.
An out-of-bounds read vulnerability in the Headless mode of Google Chrome can be leveraged for sandbox escapes.
Insufficient validation of untrusted input in the UI of Google Chrome on Mac allows for potential sandbox escapes.
An out-of-bounds read vulnerability exists in the GPU component of Google Chrome, potentially allowing for sandbox escape and privilege escalation.
An out-of-bounds write vulnerability in the ANGLE graphics engine of Google Chrome may allow a remote attacker to achieve sandbox escape via a crafted HTML page.
A server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager allows unauthenticated remote attackers to perform arbitrary file operations and escalate privileges to root.
A prototype pollution vulnerability in Velocity.js allows attackers to modify Object.prototype, potentially leading to Denial of Service or Remote Code Execution.
Progress Sitefinity versions 8.0.5700 through 13.3.7652 contain a vulnerability allowing remote authenticated attackers to obtain plain-text credentials for the Sitefinity Insight service.
Rockwell Automation controllers allow unauthenticated remote attackers to modify IP configurations, causing communication loss even when set to Hard RUN mode.
Rockwell Automation MicroLogix 1100 controllers allow remote unauthenticated attackers to cause a denial-of-service by triggering a controller fault when switching to RUN mode.
An incorrect privilege assignment vulnerability in the Mojoomla School Management extension allows unauthorized users to escalate their privileges.
A post-authentication remote buffer overflow in the Vivotek FD8136 camera firmware allows authenticated attackers to execute arbitrary code as root.
A remote buffer overflow vulnerability in the Vivotek FD8136 camera firmware allows authenticated attackers to execute arbitrary code as root.
A stack buffer overflow vulnerability exists that allows a remote attacker with existing user privileges to elevate their access to full system root privileges.
A stack buffer overflow in the dali-devconfig utility allows authenticated users to execute arbitrary code with root privileges.
A stack-based buffer overflow in the gdv-serverconfig component allows a remote, authenticated user to achieve full system compromise with root-level privileges.
A lack of rate-limiting on the debug SSH service of the Archer C64 v1 router allows attackers to brute-force credentials, leading to full administrative access.
The Orpak SiteOmat management console is vulnerable to insecure communication due to the use of an invalid SSL certificate across all known software versions.
Moxa NPort devices are vulnerable to an information exposure flaw caused by improper handling of Ethernet frame padding, potentially allowing unauthorized access to sensitive data.
The Orpak SiteOmat OrCU component contains a code injection vulnerability caused by a search query utilizing a direct shell command, enabling remote code execution.
Rockwell Automation MicroLogix 1400 controllers are vulnerable to a buffer overflow via crafted Modbus packets, potentially causing a denial-of-service or unauthorized register manipulation.
The ugw-logread method contains a path traversal vulnerability that allows authenticated remote attackers to access arbitrary local files.
The Mercusys AC12G router contains an unauthenticated brute-force vulnerability in the TDDP password change endpoint due to a lack of rate limiting.
The Mercusys AC12G router allows UPnP AddPortMapping to forward external traffic to the router's own administrative interface, exposing it to unauthorized access.
The Eliz Software Panel is vulnerable to SQL injection, which can be leveraged to achieve arbitrary command line execution on the underlying host.
A SQL injection vulnerability in the Egebilgi Software Website Template allows unauthenticated attackers to execute malicious queries against the database.
Autodesk 3ds Max is vulnerable to a stack-based buffer overflow when parsing maliciously crafted GIF files, which could lead to arbitrary code execution.
The ABB T-MAC Plus system contains an authorization bypass vulnerability caused by improper handling of user-controlled keys.
A cryptographic weakness (CWE-326) in BOSH allows local attackers to perform MITM attacks to steal credentials or redirect token requests.
Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc
Universal Software Inc products are affected by a vulnerability involving improper privilege definition and missing authentication for critical functions, potentially allowing unauthorized access.
A DOM-based cross-site scripting (XSS) vulnerability exists in Cribl Stream, allowing attackers to inject malicious scripts into the web interface.
The Dräger Infinity Acute Care System and standalone Infinity M540 patient monitors running software version VG4 are subject to a high-severity security vulnerability.
A remote vulnerability in Dräger Infinity patient monitors allows attackers to inject spoofed data, causing denial-of-service conditions through system reboots.
A command injection vulnerability in a console interface allows attackers to execute arbitrary commands on the underlying system.
A divide-by-zero vulnerability in the O-RAN RAN function module of OpenAirInterface5G can lead to application crashes.
A server-side request forgery (SSRF) vulnerability in the Medplum subscription worker allows authenticated users to trigger unauthorized requests to internal services.
A SAML XML Signature Wrapping (XSW) vulnerability in authentik allows attackers to bypass authentication and impersonate users.
A local information disclosure vulnerability exists in TigerVNC's x0vncserver due to insecure file permissions on shared memory segments.
The Apache Directory LDAP API client fails to verify the hostname during TLS certificate validation, enabling man-in-the-middle attacks.
Autodesk 3ds Max is vulnerable to memory corruption when parsing a maliciously crafted RGB file, potentially leading to arbitrary code execution.
Autodesk 3ds Max contains an out-of-bounds write vulnerability when processing maliciously crafted GIF files, which may result in arbitrary code execution.
Autodesk 3ds Max is subject to a memory corruption vulnerability when parsing maliciously crafted RGB files, potentially allowing for remote code execution.
A stack-based buffer overflow in Base64 Decoder allows local attackers to execute arbitrary code via crafted input.
Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code via malicious input files.
An authentication bypass in Cr*nMaster allows unauthenticated users to execute privileged actions by manipulating session cookies.