Critical vulnerabilities, curated daily for security professionals
Saturday's disclosures center on enterprise identity and data infrastructure, with maximum-severity flaws in Microsoft Azure Active Directory (CVE-2026-45480, CVSS 10) and Azure Synapse (CVE-2026-48584, CVSS 9.9) alongside a perfect-score ProxySQL flaw (CVE-2026-48772, CVSS 10). Critical CVEs rose sharply to 8 from 1 the prior day (+700%), while high-priority issues climbed to 47 from 41 (+15%) across 55 total disclosures. JetBrains Hub accounted for two criticals (CVE-2026-50242, CVSS 10; CVE-2026-56142, CVSS 9.9), and file-management platform FileRise (CVE-2026-54414, CVSS 9.8) and the BetterDocs Pro WordPress plugin (CVE-2026-7515, CVSS 9.8) round out the top tier. The mix favors authentication bypass and remote code execution against cloud identity services, databases, and developer collaboration tooling, with four CVEs—affecting LiteSpeed cPanel, Joomla Content Editor, Splunk, and Cisco Catalyst SD-WAN Manager—carrying confirmed active exploitation. Patch availability is currently reported at 0%, so teams should prioritize compensating controls and exposure reduction until vendor fixes land.
Immediate action: Prioritize Microsoft Azure Active Directory and Synapse, ProxySQL, JetBrains Hub, and FileRise deployments, and apply mitigations for the actively exploited Splunk, Cisco SD-WAN Manager, LiteSpeed cPanel, and Joomla Content Editor flaws. With patch availability at 0%, restrict network exposure, enforce access controls, and monitor affected services closely until vendor updates are released.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
A symlink mishandling vulnerability in the LiteSpeed cPanel plugin allows users with limited access to escalate privileges on shared hosting environments.
An improper access control vulnerability in the Widget Factory Joomla Content Editor allows unauthorized users to perform restricted actions.
Splunk Enterprise and Cloud Platform contain an authentication bypass vulnerability in a PostgreSQL sidecar service, allowing unauthenticated users to create or truncate arbitrary files.
Cisco Catalyst SD-WAN Manager contains an arbitrary file write vulnerability in its web UI, allowing authenticated remote attackers to escalate privileges to root.
The BetterDocs Pro plugin for WordPress contains a Local File Inclusion vulnerability in the doc_style parameter, allowing unauthenticated attackers to execute arbitrary PHP code on the server.
A PROXY protocol v1 implementation flaw in ProxySQL allows unauthenticated attackers to spoof source IP addresses, resulting in ACL and routing bypasses.
FileRise is vulnerable to path traversal via the shared-folder upload endpoint, allowing an attacker with a valid upload link to overwrite system files and achieve administrator account takeover.
An improper authentication vulnerability in Microsoft Azure Active Directory enables unauthenticated attackers to escalate privileges over a network.
An execution with unnecessary privileges vulnerability in Azure Synapse allows authenticated attackers to escalate privileges over a network.
JetBrains Hub contains an authentication bypass vulnerability via direct database access that allows unauthorized administrative control.
Improper input validation in AVer PTC series cameras allows remote, unauthenticated attackers to execute arbitrary code via crafted web requests.
JetBrains Hub is susceptible to privilege escalation by allowing the attachment of unauthorized authentication details to user accounts.
A heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute arbitrary code locally.
A heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute arbitrary code locally.
A heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute arbitrary code locally.
A heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute arbitrary code locally.
A use-after-free vulnerability in the WebShare component of Google Chrome on Windows allows for potential exploitation.
Microsoft Edge contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to perform spoofing attacks over a network.
A type confusion vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code locally on an affected system.
A type confusion vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code locally on an affected system.
A vulnerability exists within the Content Server component of Oracle WebCenter Content that may allow an attacker to compromise the integrity and availability of the system.
Oracle Data Integrator contains a vulnerability in its Market Place component that may allow for unauthorized system interaction or compromise.
A high-severity vulnerability exists within the Console component of the Oracle WebLogic Server, potentially allowing for unauthorized system interaction.
A high-severity vulnerability within the Siebel Cloud Manager component of Oracle Siebel CRM may permit unauthorized access or manipulation of critical CRM functions.
An inappropriate implementation vulnerability in the WebView component of Google Chrome on Android may allow for unauthorized behavior by malicious applications.
A race condition vulnerability exists within the Safe Browsing component of Google Chrome for macOS, potentially allowing for memory corruption or bypass of security features.
A race condition within the Google Chrome Updater for macOS could allow an attacker to interfere with the update process, potentially leading to unauthorized operations.
The SP Movie Database component for Joomla! contains a security vulnerability that could potentially be leveraged to compromise the integrity of the application.
Microsoft 365 Copilot's Business Chat is vulnerable to an open redirect, which can be leveraged by an unauthorized attacker to facilitate privilege escalation over a network.
A memory safety vulnerability in the Linux kernel ksmbd module allows out-of-bounds writes during compound SMB requests, potentially leading to system crashes or arbitrary code execution.
A flaw in the Linux kernel SMB client allows for improper validation of DACL pointers, potentially leading to security descriptor corruption.
A slab-out-of-bounds read vulnerability exists in the Linux kernel's t7xx WWAN driver when handling modem messages.
A vulnerability in the Linux kernel's mac80211 subsystem occurs when MLO connection preparation fails.
An insecure default resource initialization in GitHub Copilot and Visual Studio Code allows unauthenticated attackers to perform information disclosure over a network.
A critical security flaw in an unspecified router allows unauthenticated local network users to gain administrative control and modify operational settings.
The Linux kernel ksmbd module fails to properly validate ACE sizes in smb_check_perm_dacl, allowing for buffer boundary violations when processing access control lists.
A security vulnerability in the Joomla NextGen Editor extension allows for unauthorized access or potential compromise of the CMS environment.
A high-severity vulnerability in the Joomla Survey Force Deluxe extension may allow unauthenticated attackers to compromise the web application.
A security vulnerability exists in the Joomla OSDownloads extension. The specific technical details of the flaw are currently limited.
An authenticated privilege escalation vulnerability exists in F5 BIG-IP via the iControl SOAP interface, allowing administrators to create unauthorized SNMP configuration objects.
The David Lingren Media Library Assistant plugin is vulnerable to blind SQL injection, allowing attackers to manipulate database queries.
A security vulnerability affects the Joomla! vBizz component, potentially exposing the site to unauthorized actions or data compromise.
Capgo versions prior to 12 are affected by a security vulnerability requiring immediate attention from administrators.
A path traversal vulnerability in Microsoft SQL Server allows an authorized attacker to execute arbitrary code over the network.
A use-after-free vulnerability in the Networking HTTP component could potentially lead to arbitrary code execution or system instability.
A security vulnerability exists in the SAP nanobot personal AI assistant. The specific technical nature of the flaw is currently undisclosed by the vendor.
An authentication bypass vulnerability in F5 BIG-IP Appliance mode allows administrators to circumvent existing system restrictions.
A denial-of-service (DoS) vulnerability exists in the 10G iSCSI interface of the Hitachi Virtual Storage Platform, potentially allowing an attacker to disrupt storage availability.
Capgo versions prior to 12 contain a critical security vulnerability that requires immediate remediation.
A vulnerability exists in the Joomla My Projects 2 component, which may allow for unauthorized actions or information disclosure within the affected Joomla environment.
A vulnerability exists in the Joomla User Bench 1 component, which may allow for unauthorized actions or security bypasses within the affected Joomla environment.
The JB Visa component for Joomla contains a high-severity vulnerability that may allow for unauthorized system interaction.
The Quiz Deluxe component for Joomla contains a high-severity vulnerability that may lead to unauthorized system access or data exposure.
The RPC Responsive Portfolio component for Joomla contains a high-severity vulnerability that may lead to unauthorized system access or data compromise.
A vulnerability exists within the Joomla! Component Price Alert 3, potentially allowing for unauthorized exploitation of the system.
The Joomla! Component Bargain Product VM3 contains a security vulnerability that requires immediate attention to prevent unauthorized system exploitation.
The Joomla! Component Ajax Quiz is susceptible to a security vulnerability that could potentially allow for unauthorized access or system manipulation.
The FocalPoint Pro and Free components for Joomla! contain a security vulnerability that may expose the application to unauthorized access or potential compromise.
The Calendar Planner component for Joomla! is susceptible to a security vulnerability that may facilitate unauthorized access or malicious activity within the web environment.