Critical vulnerabilities, curated daily for security professionals
Thursday's disclosures center on developer and collaboration tooling, led by a maximum-severity flaw in Google Cloud's Gemini CLI (CVE-2026-12537, CVSS 10) and a cluster of critical issues in the SiYuan note platform. Analysts logged 24 critical CVEs, down 20% from the prior day's 30, alongside 65 high-priority CVEs, up 14% from 57. Named critical entries include CVE-2026-39948 (CVSS 9.3) in Cacti, CVE-2026-54158 (CVSS 9.9) in SiYuan, and CVE-2026-55454 (CVSS 9.9) in Appsmith. Self-hosted web applications and infrastructure tooling—Cacti, Rocket.Chat, and Appsmith—dominate the critical set, while two Chrome flaws (CVE-2026-13028 and CVE-2026-13032, both CVSS 9.6) extend exposure to browser endpoints. With no vendor patches reflected in the dataset yet and five CVEs under active exploitation, teams should prioritize inventory and compensating controls while awaiting fixes.
Immediate action: Prioritize internet-facing and developer tooling—Gemini CLI, Cacti, SiYuan, Rocket.Chat, and Appsmith—for immediate inventory and access restriction, and update Chrome endpoints as fixes ship. With no patches currently reflected for the critical set, apply network segmentation, restrict exposure, and monitor the actively exploited Splunk, Lantronix, and Ubiquiti products closely until vendor updates are available.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
Splunk Enterprise and Cloud Platform contain an authentication bypass vulnerability in a PostgreSQL sidecar service, allowing unauthenticated users to create or truncate arbitrary files.
The Lantronix EDS5000 contains a code injection vulnerability that is currently being actively exploited in the wild.
An improper input validation flaw in Ubiquiti UniFi OS enables network-adjacent attackers to execute arbitrary commands on the underlying system.
A path traversal vulnerability in Ubiquiti UniFi OS allows network-adjacent attackers to read sensitive system files and potentially compromise user accounts.
An improper access control vulnerability in Ubiquiti UniFi OS devices allows network-adjacent attackers to modify system configurations without authorization.
An SQL injection vulnerability in Cacti allows unauthenticated attackers to execute arbitrary database commands via the rfilter parameter in graph_view.php.
A stored cross-site scripting (XSS) vulnerability in the SiYuan Attribute View allows for remote code execution (RCE) within the Electron desktop client.
A use-after-free vulnerability in the WebGL component of Google Chrome on Android allows remote attackers to execute a sandbox escape via a malicious HTML page.
A critical use-after-free vulnerability in Google Chrome's WebGL component on Android allows remote attackers to perform a sandbox escape via crafted HTML content.
The SiYuan kernel HTTP server improperly trusts browser extension origins, allowing unauthenticated administrative API access and potential data exfiltration.
An OS command injection vulnerability in Google Gemini CLI allows unprivileged attackers to achieve host-level code execution during CI/CD processes.
A cross-site scripting (XSS) vulnerability in SiYuan's CSS snippet rendering allows attackers to execute arbitrary JavaScript, leading to remote code execution (RCE) on Electron desktop builds.
A critical XSS vulnerability in SiYuan's attribute-view cell renderer allows attackers to inject malicious scripts, leading to remote code execution on Electron desktop clients.
Rocket.Chat contains an authentication bypass vulnerability in its Apple OAuth flow, allowing attackers to forge JWTs and perform account takeovers.
The Appsmith platform contains a configuration flaw in the bundled Caddy reverse-proxy, allowing authenticated users to perform SSRF and achieve full reverse-proxy takeover.
The Cacti performance management framework is vulnerable to a pre-authentication SQL injection via an improperly validated input parameter in graph_view.php.
Feast contains an unsafe deserialization vulnerability that allows remote code execution via crafted gRPC requests to the registry server.
An unauthenticated attacker can inject MongoDB operators into the OAuth token endpoint to steal valid access tokens for arbitrary users, including administrators.
An unauthenticated attacker can use NoSQL injection in the CAS login handler to bypass authentication and hijack active user sessions, including administrative accounts.
A path traversal vulnerability in Gogs allows attackers to write files to arbitrary locations, enabling remote code execution via malicious Git hook configuration.
An authenticated Remote Code Execution vulnerability in Gogs allows users to inject malicious commands via crafted branch names during the merge rebase operation.
Rclone’s remote control daemon (rcd) allows unauthenticated Remote Code Execution by processing malicious GET/HEAD requests that trigger local command execution during backend initialization.
A broken authentication vulnerability in Capgo allows attackers to generate arbitrary, unauthorized API keys, leading to unauthorized access to protected endpoints.
Ghost is vulnerable to cache poisoning via the x-ghost-preview header, allowing unauthenticated attackers to manipulate frontend responses and potentially hijack staff accounts.
Rocket.Chat's SAML implementation fails to validate signatures when no IdP certificate is configured, allowing unauthenticated attackers to bypass authentication.
Marlin firmware contains an out-of-bounds write vulnerability in the M421 G-code handler, allowing attackers to corrupt memory and cause a denial of service.
A flawed administrator existence check in the FOSSBilling guest API allows unauthenticated attackers to create new administrator accounts, leading to full system compromise.
Cacti versions 1.2.30 and prior contain an unauthenticated Local File Inclusion (LFI) vulnerability via the graph_theme parameter, potentially allowing unauthorized file access.
A SQL injection vulnerability exists in Cacti versions 1.2.30 and prior, where the rfilter parameter is unsafely concatenated into an RLIKE clause, reachable by unauthenticated users.
The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection, potentially allowing remote code execution.
A critical vulnerability exists in the Jenkins External Workspace Manager Plugin, potentially allowing for unauthorized access or system compromise.
A use-after-free vulnerability in the Digital Credentials component of Google Chrome on Mac allows for potential memory corruption or arbitrary code execution.
A use-after-free vulnerability exists in the FileSystem component of Google Chrome prior to version 149, potentially allowing arbitrary code execution.
A use-after-free vulnerability in the Blink rendering engine of Google Chrome prior to version 149 may allow for arbitrary code execution.
A use-after-free vulnerability in the Bluetooth component of Google Chrome on macOS prior to version 149 could allow for arbitrary code execution.
A use-after-free vulnerability exists in the Blink rendering engine of Google Chrome, potentially allowing for arbitrary code execution or system instability.
A use-after-free vulnerability in the Autofill component of Google Chrome on Windows may allow attackers to trigger memory corruption and execute arbitrary code.
An out-of-bounds read and write vulnerability in the Blink InterestGroups component of Google Chrome could lead to memory corruption and potential code execution.
A race condition vulnerability exists within the DevTools component of Google Chrome, potentially allowing for unauthorized exploitation.
Apple M1 GPUs fail to clear register file data between compute shader dispatches, potentially allowing data leakage between processes.
A critical security vulnerability has been identified in the Jenkins Script Security Plugin, potentially allowing for unauthorized script execution.
A vulnerability in the Jenkins OWASP ZAP Plugin may allow attackers to exploit security testing configurations to gain unauthorized access or execute code.
A SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup allows remote code execution.
A SQL injection vulnerability in the NVBURASDevice component of Quest NetVault Backup enables remote code execution.
A SQL injection vulnerability in the NVBUDeviceDrive component of Quest NetVault Backup facilitates remote code execution.
Quest NetVault Backup is vulnerable to a SQL injection flaw within the NVBURemovableMedia component, potentially allowing for remote code execution.
Quest NetVault Backup contains a SQL injection vulnerability in the NVBULibraryPort component, which may enable remote code execution by an attacker.
Quest NetVault Backup is susceptible to a SQL injection vulnerability within the NVBULibrarySlot component, which could allow an attacker to perform remote code execution.
A SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup allows remote attackers to potentially execute arbitrary code.
A command injection vulnerability in the NVBULogDaemon component of Quest NetVault Backup enables remote attackers to execute arbitrary system commands.
A file upload command injection vulnerability in the Unraid web server allows remote attackers to execute arbitrary commands by uploading malicious files.
Unraid Web Server is vulnerable to remote code execution via command injection in the ToggleState function.
NSD is vulnerable to a heap overflow during AXFR zone transfers when processing maliciously crafted SVCB resource records.
The Mistune Python Markdown parser is susceptible to a vulnerability that may allow for remote code execution or cross-site scripting depending on the implementation.
A vulnerability in the NSD name server software fails to properly enforce client certificate authentication when a provide-xfr is configured with a tls-auth-name.
A security vulnerability has been identified in the concurrent-ruby library for Ruby, potentially impacting applications relying on these concurrency tools.
An OS command injection vulnerability exists in the Rapid7 InsightConnect Sed Plugin, allowing authenticated attackers to execute arbitrary system commands via the expression parameter.
Quest NetVault Backup is vulnerable to a cross-site scripting (XSS) flaw in the viewclient component that facilitates authentication bypass.
Quest NetVault Backup contains a cross-site scripting (XSS) vulnerability in the addclient3 function that permits authentication bypass.
The Appsmith platform, used for building internal tools and admin panels, contains a critical security vulnerability requiring immediate attention.
Gogs is vulnerable to a security flaw that could allow for unauthorized actions or system compromise.
A security flaw in the Gogs self-hosted Git service may lead to significant operational risks.
Jellyfin is susceptible to a security vulnerability that could impact the integrity of self-hosted media server deployments.
A vulnerability exists in the Jellyfin media server that may allow for unauthorized access or system compromise.
A high-severity vulnerability has been identified in the Warp agentic development environment that may impact user security.
An additional high-severity vulnerability has been disclosed in the Warp agentic development environment.
Warp, an agentic development environment, contains a high-severity vulnerability that may allow for unauthorized access or system manipulation.
Mailerup contains a missing authentication vulnerability in the RegisterView function, potentially allowing unauthenticated access to critical account registration processes.
Capgo versions prior to 12 are affected by a high-severity vulnerability that requires immediate attention to maintain system security.
A vulnerability exists in the NLnet Labs NSD software, potentially allowing for significant service disruption or unauthorized control.
GitLab EE is affected by a security vulnerability requiring immediate remediation to prevent unauthorized system access.
A high-severity vulnerability has been identified in the SiYuan personal knowledge management system that may compromise user data integrity.
A high-severity security vulnerability has been identified in the Rocket.Chat communication platform, necessitating immediate administrative review.
A security vulnerability has been identified in the Gogs self-hosted Git service that requires immediate administrative attention to prevent potential system compromise.
A critical security vulnerability has been identified in the Mastodon social network server, necessitating prompt remediation to protect instance integrity.
A security vulnerability has been identified in Capgo prior to version 12, requiring immediate updates to secure the platform.
GitLab EE contains a security vulnerability in versions 19 and later that necessitates an immediate update.
A security vulnerability has been identified in the Cacti performance and fault management framework that requires immediate attention from system administrators.
A security vulnerability has been identified in Mastodon, a social network server based on ActivityPub, which could potentially expose the platform to unauthorized manipulation.
A security vulnerability has been identified in the Warp agentic development environment, requiring swift action to protect developer workstations and environments.
A security vulnerability exists in Rocket.Chat that could potentially allow for unauthorized access or system compromise.
A security vulnerability in the Gogs self-hosted Git service may allow for unauthorized access or manipulation of repository data.
A vulnerability in the OpenColorIO framework may allow for unauthorized actions during the processing of color management data.
Gogs, an open-source self-hosted Git service, contains a high-severity vulnerability that may allow for unauthorized access or system compromise.
Docling, a tool for document processing and AI integration, contains a high-severity vulnerability that could be leveraged to compromise document parsing workflows.
OpenText Access Manager is vulnerable to a reflected Cross-Site Scripting (XSS) attack due to improper neutralization of user-supplied input during web page generation.
A vulnerability exists in Supabase Capgo prior to version 12 that may allow for unauthorized system impact.
A security vulnerability in n8n versions before 2 allows for potential unauthorized access or system compromise.
A security vulnerability has been identified in Rocket.Chat that may permit unauthorized access or impact the integrity of the communication platform.
A security vulnerability exists in the Gogs self-hosted Git service that may allow for unauthorized access or system compromise.
A security vulnerability has been identified in the Warp agentic development environment that may impact user security and system integrity.
A security vulnerability in ProFTPD allows for potential unauthorized actions, necessitating immediate review and patching.
A security vulnerability exists in Picklescan before version 0, potentially allowing for malicious code execution during the scanning of untrusted pickle files.
A security vulnerability exists in Picklescan before version 0, which may lead to arbitrary code execution when processing crafted input files.