Critical vulnerabilities, curated daily for security professionals
Saturday's disclosures are led by infrastructure and e-commerce platform flaws, including a maximum-severity Kubernetes identity configuration vulnerability (CVE-2026-46389, CVSS 10) and a perfect-score WooCommerce product slider plugin flaw (CVE-2026-49777, CVSS 10). The day brought 10 critical CVEs, down 41% from the prior day's 17, alongside 30 high-priority vulnerabilities, a 63% decrease from 82. Notable critical issues include Termix remote code execution flaws (CVE-2026-45744 and CVE-2026-45748, CVSS 9.9 and 9.8) and dual Morse Micro HaLowLink 2 wireless gateway vulnerabilities (CVE-2026-7762 and CVE-2026-7763, both CVSS 9.8). Affected products span container orchestration, WordPress/WooCommerce plugins, industrial UPS controllers (NetMan 204), and embedded networking hardware, with remote code execution and authentication bypass the dominant attack patterns. No patches were available for these disclosures at publication, so teams should prioritize mitigations and exposure reduction; six separately tracked vulnerabilities across Ivanti, Oracle, Linux, Android, Magento, and SolarWinds remain under active exploitation.
Immediate action: Prioritize Kubernetes identity configurations (CVE-2026-46389) and WooCommerce/WordPress plugin deployments (CVE-2026-49777, CVE-2026-10580), then assess Termix, Morse Micro HaLowLink 2, and NetMan 204 exposure for remote code execution risk. With no patches available for these disclosures, apply vendor mitigations, restrict network exposure of affected management interfaces, and monitor for vendor advisories. Separately, ensure the six actively exploited vulnerabilities across Ivanti, Oracle, Linux, Android, Magento, and SolarWinds are remediated.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
An authentication bypass vulnerability in the Ivanti vTM admin panel allows remote unauthenticated attackers to gain unauthorized administrative access.
Oracle WebLogic Server contains an unspecified vulnerability that is currently being exploited in the wild.
A privilege escalation vulnerability in the Linux Kernel cgroup_release_agent_write function allows unprivileged users to escape container environments and gain elevated host privileges.
An integer overflow vulnerability in the Android Framework allows for potential unauthorized system access and is currently tracked in the CISA KEV catalog.
Mirasvit Full Page Cache Warmer for Magento 2 contains a PHP object injection vulnerability allowing unauthenticated RCE via the CacheWarmer cookie.
SolarWinds Serv-U is vulnerable to an uncontrolled resource consumption flaw allowing unauthenticated attackers to crash the service via specially crafted POST requests.
A logic error in the Kubernetes UDS Identity Config component allows attackers to bypass client secret authentication and obtain unauthorized OAuth2 tokens.
The Hippoo Mobile App for WooCommerce plugin for WordPress contains an authentication bypass flaw that allows unauthenticated attackers to take over administrator accounts.
The Termix platform contains an OS command injection vulnerability in the resolvePath endpoint, allowing authenticated users with an active session to execute arbitrary commands on remote hosts.
NetMan 204 contains a hard-coded backdoor account that allows remote, unauthenticated attackers to gain administrative access via the login endpoint.
The Termix platform is vulnerable to persistent OS command injection via the tunnel connect endpoint due to improper input sanitization of host record fields.
A heap-based buffer overflow in the Morse Micro HaLowLink 2 kernel driver allows unauthenticated attackers within radio range to achieve DoS or Remote Code Execution.
A heap-based buffer overflow in the Morse Micro HaLowLink 2 kernel driver allows unauthenticated attackers within radio range to cause system crashes or Remote Code Execution.
An improper validation vulnerability in ShapedPlugin Product Slider Pro for WooCommerce allows unauthenticated attackers to perform malicious software implantation.
NetMan 204 fails to enforce authentication on administrative pages, allowing unauthenticated attackers to disclose sensitive information and execute privileged commands.
A critical authentication bypass vulnerability in DTS Electronics Redline WR3200 allows unauthenticated attackers to access restricted functions due to missing access control validation.
A use-after-free vulnerability exists in the Chromoting component of Google Chrome prior to version 149, which could lead to arbitrary code execution.
A use-after-free vulnerability in the WebAppInstalls component of Google Chrome on Android prior to version 149 may allow for arbitrary code execution.
A use-after-free vulnerability in the Autofill component of Google Chrome on iOS prior to version 149 could lead to memory corruption and potential code execution.
A use-after-free vulnerability in the Views component of Google Chrome prior to version 149 could allow for arbitrary code execution.
A heap buffer overflow vulnerability exists in the TabStrip component of Google Chrome, potentially allowing for heap corruption via crafted HTML pages.
A use-after-free vulnerability in the Network module of Google Chrome allows remote attackers to trigger heap corruption via crafted network traffic.
A use-after-free vulnerability in the Views component of Google Chrome may allow remote attackers to exploit heap corruption via crafted HTML pages.
A use-after-free vulnerability in the Base component of Google Chrome on Linux allows attackers to disclose sensitive process memory information.
A use-after-free vulnerability in the WebView component of Google Chrome on Android allows remote attackers to trigger heap corruption via crafted HTML content.
A use-after-free vulnerability exists in the Chromoting component of Google Chrome, allowing remote attackers to execute arbitrary code via malicious network traffic.
A use-after-free vulnerability in the Media component of Google Chrome allows a remote, unauthenticated attacker to execute arbitrary code within the browser sandbox via a crafted video file.
A use-after-free vulnerability in the Omnibox feature of Google Chrome allows an attacker to potentially execute arbitrary code or cause a denial of service via a crafted HTML page.
A use-after-free vulnerability in the USB component of Google Chrome on Android allows a remote attacker to achieve a sandbox escape via a crafted HTML page.
An inappropriate implementation in the GPU component of Google Chrome allows a remote, unauthenticated attacker to potentially perform a sandbox escape via a crafted HTML page.
An inappropriate implementation vulnerability in the V8 engine of Google Chrome allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.
Insufficient input validation in Google Chrome DevTools allows a remote attacker to bypass the Same Origin Policy via malicious network traffic after triggering specific UI gestures.
A Type Confusion vulnerability in the ANGLE graphics library in Google Chrome on Windows allows a remote attacker to trigger out-of-bounds memory access.
An inappropriate implementation in the V8 engine of Google Chrome allows remote attackers to potentially exploit heap corruption via a crafted HTML page.
Insufficient validation of untrusted input in the Media component of Google Chrome on Windows allows a remote attacker to perform a sandbox escape.
Insufficient validation of untrusted input in Google Chrome Codecs allows a remote attacker to perform an out-of-bounds memory write via a crafted video file.
An integer overflow vulnerability in the GPU component of Google Chrome on Android allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page.
An inappropriate implementation in the Dawn component of Google Chrome allows a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page.
Insufficient policy enforcement in Google Chrome DevTools allows an attacker who convinces a user to install a malicious extension to perform privilege escalation.
An insecure implementation in Google Chrome's Isolated Web Apps framework allows a malicious file to trigger code execution within a sandboxed environment.
An inappropriate implementation of NFC in Google Chrome on Android allows a remote attacker to perform privilege escalation via a crafted HTML page.
An incorrect security UI implementation in the Contact Picker of Google Chrome on Android allows remote attackers to perform UI spoofing via a crafted HTML page.
An incorrect security UI implementation in the Messages component of Google Chrome on Android enables remote attackers to perform UI spoofing via a malicious HTML page.
An inappropriate implementation in the Opaque Response Blocking (ORB) mechanism in Google Chrome allows remote attackers to bypass site isolation via a crafted HTML page.
A stored Cross-site Scripting (XSS) vulnerability in Netcad Software's Netigma platform allows remote attackers to inject malicious scripts into web pages.
A cross-site scripting (XSS) vulnerability exists in PROLIZ Computer's OBS system due to improper neutralization of user-supplied input during web page generation.