Critical vulnerabilities, curated daily for security professionals
Networking infrastructure leads Wednesday's disclosures, with two CVSS 10 flaws in Cisco Catalyst SD-WAN (CVE-2026-20127 and CVE-2026-20182) confirmed under active exploitation alongside the related SD-WAN Manager issue CVE-2026-20262. The set totals 28 vulnerabilities, including 2 rated critical (down 93% from 30) and 26 high-priority (down 58% from 62). The remaining critical entries affect web applications, namely CVE-2026-49774 (CVSS 9.9) in Filipe Nasc RD Station and CVE-2026-40750 (CVSS 9.9) in the themagnifico52 Kids Online Store. Active exploitation extends beyond Cisco to Ivanti Sentry (CVE-2026-10520), Oracle PeopleSoft PeopleTools (CVE-2026-35273), and the Joomla Content Editor (CVE-2026-48907), indicating attacker interest in both edge gateways and content-management plugins. No patches were available across the disclosed set at publication, so organizations should prioritize mitigation, access restriction, and monitoring while fixes are pending.
Immediate action: Prioritize Cisco Catalyst SD-WAN and SD-WAN Manager, Ivanti Sentry, and Oracle PeopleSoft PeopleTools, which face active exploitation at CVSS 9.5 and above. With no patches currently available, restrict management-interface access, apply vendor workarounds, and increase monitoring on affected systems until fixes ship.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
A peering authentication flaw in Cisco Catalyst SD-WAN controllers allows unauthenticated, remote attackers to bypass authentication and gain administrative privileges.
A vulnerability in the control connection handshaking of Cisco Catalyst SD-WAN allows unauthenticated, remote attackers to bypass authentication and obtain administrative access.
A critical OS command injection vulnerability in Ivanti Sentry allows remote unauthenticated users to achieve root-level remote code execution.
An unauthenticated, easily exploitable vulnerability in the PeopleSoft Updates Environment Management component allows for complete system takeover via HTTP.
An improper access control vulnerability in the Widget Factory Joomla Content Editor allows unauthorized users to perform restricted actions.
Cisco Catalyst SD-WAN Manager contains an arbitrary file write vulnerability in its web UI, allowing authenticated remote attackers to escalate privileges to root.
A symlink mishandling vulnerability in the LiteSpeed cPanel plugin allows users with limited access to escalate privileges on shared hosting environments.
A code injection vulnerability in Filipe Nasc RD Station allows for remote code inclusion, potentially leading to full system compromise.
An unrestricted file upload vulnerability in themagnifico52 Kids Online Store allows attackers to upload and execute a web shell.
A remote code execution vulnerability exists in the Dell OpenManage Integration gateway plugin for Windows Admin Center, allowing for privilege escalation and arbitrary code execution.
A tenant-isolation bypass vulnerability exists in the V1 collection-level endpoints of the ChromaDB Python project.
A vulnerability in OpenClaw for Linux and macOS allows attackers to bypass argument pattern validation, enabling the execution of disallowed arguments in allowlisted executables.
A Time-Based Blind SQL Injection vulnerability exists in the alias_management module of the OpenSIPS Control Panel.
An input validation vulnerability in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager 2026 allows for potential security compromise.
A use-after-free vulnerability exists in the Linux kernel's Bluetooth subsystem during SSP passkey handling.
A network-level vulnerability exists in SUSE Harvester that affects the communication between SUSE Virtualization and the Rancher Manager.
A command injection vulnerability in Managed Ethernet Switches allows low-privileged attackers to achieve full system compromise.
A flaw in the Linux kernel's IPv4 ICMP implementation fails to validate reply types, potentially leading to memory corruption or instability.
An integer overflow vulnerability in the Pacemaker CIB remote listener allows unauthenticated remote attackers to trigger memory corruption and denial of service.
A vulnerability in yeoman-environment allows for arbitrary package installation and code execution when processing attacker-controlled configuration without user confirmation.
A vulnerability in the device webserver allows unauthenticated attackers to exploit a hardcoded constant token for REST API access, leading to command execution and configuration modification.
A privilege escalation vulnerability exists in the Graphics: WebRender component of Mozilla products, which can be triggered remotely via user interaction.
A SQL injection vulnerability in the "WP Sessions Time Monitoring Full Automatic" plugin allows for unauthorized database interaction.
Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator, providing unauthorized access to sensitive application components.
The wicked DHCP client is vulnerable to the processing of unsanitized strings from DHCP replies, potentially leading to system compromise.
An authorization bypass vulnerability exists in OpenClaw that allows paired devices to regain unauthorized WebSocket node-level access after token revocation.
A vulnerability within the Moby open-source container framework potentially exposes containerized environments to unauthorized access or execution risks.
The Frontier X2 device is vulnerable to unauthenticated Bluetooth Low Energy (BLE) read/write operations, allowing unauthorized access to critical device characteristics.
A path traversal vulnerability in the Altium Enterprise Server Vault Service UploadController allows authenticated users to write arbitrary files to the server filesystem.
A broken access control vulnerability in ChromaDB allows authenticated users to perform unauthorized data operations across different tenants.
The SimpleRBACAuthorizationProvider in ChromaDB fails to validate the target tenant or collection, leading to cross-tenant authorization bypass.
A code injection vulnerability in ChromaDB allows authenticated attackers to execute arbitrary code by supplying a malicious model repository.
A command injection vulnerability in the Kitty terminal emulator allows for arbitrary code execution via malicious escape sequences.
A local privilege escalation vulnerability in the Kandji Agent allows attackers to invoke restricted functionality through a client validation gap.
A high-severity vulnerability exists in Forem, an open-source platform for building communities, requiring immediate investigation and patching.