Critical vulnerabilities, curated daily for security professionals
Friday's disclosures center on developer and infrastructure platforms, led by two CVSS 10 vulnerabilities in Apache Kvrocks (CVE-2026-46752) and Flowise (CVE-2025-71338), alongside critical flaws in Cursor, Dell Wyse Management Suite, and ToolJet. The brief includes 25 critical CVEs, up 4% from the prior day's 24, and 42 high-priority CVEs, down 35% from 65. Dell Wyse Management Suite (CVE-2026-41120, CVSS 9.8) and the paired Cursor IDE vulnerabilities (CVE-2026-50548 and CVE-2026-50549, CVSS 9.3) extend exposure into endpoint management and developer workstations. Remote code execution and authentication bypass dominate the critical set, with affected products spanning data stores, low-code platforms, IoT/camera systems from GeoVision, and edge networking. Vendor patch availability is currently reported at 0%, so organizations should prioritize compensating controls, network segmentation, and access restrictions for exposed instances.
Immediate action: Prioritize Apache Kvrocks, Flowise, Dell Wyse Management Suite, and Cursor IDE deployments, restricting network access to these services and isolating developer and management systems until fixes ship. With patch availability at 0% for critical issues, apply segmentation, authentication hardening, and monitoring as interim mitigations, and accelerate remediation for the actively exploited Ubiquiti UniFi OS, Cisco Unified CM, and PTC Windchill vulnerabilities.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
The Lantronix EDS5000 contains a code injection vulnerability that is currently being actively exploited in the wild.
An improper input validation flaw in Ubiquiti UniFi OS enables network-adjacent attackers to execute arbitrary commands on the underlying system.
A path traversal vulnerability in Ubiquiti UniFi OS allows network-adjacent attackers to read sensitive system files and potentially compromise user accounts.
An improper access control vulnerability in Ubiquiti UniFi OS devices allows network-adjacent attackers to modify system configurations without authorization.
PTC Windchill and FlexPLM are vulnerable to improper input validation, allowing for potential exploitation. This vulnerability is confirmed as actively exploited in the wild.
A server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager allows unauthenticated remote attackers to perform arbitrary file operations and escalate privileges to root.
A sandbox escape vulnerability in the Cursor AI code editor allows malicious agents to write arbitrary files outside the workspace, leading to non-sandboxed Remote Code Execution.
A path canonicalization flaw in the Cursor AI code editor allows malicious agents to bypass sandbox restrictions and write arbitrary files, facilitating Remote Code Execution.
Dell Wyse Management Suite is vulnerable to an improper data handling issue, allowing a low-privileged remote attacker to achieve Remote Code Execution.
An authenticated builder can overwrite marketplace plugins with arbitrary server-side JavaScript, leading to RCE and supply-chain compromise within ToolJet instances.
A heap overflow vulnerability exists within the cjson library of Apache Kvrocks, which could lead to memory corruption or arbitrary code execution.
Apache Kvrocks version 2.8.0 contains a vulnerability involving the improper handling of permissions, which could lead to unauthorized privilege escalation.
An unauthenticated path traversal vulnerability in the Flowise document-store loader allows attackers to write arbitrary files to the filesystem, facilitating remote code execution.
A critical vulnerability in the MarketingFire Widget Options plugin allows contributor-level users to execute arbitrary code on the server.
An unauthenticated stack-based buffer overflow in the thttpd component of GeoVision GV-LPC2011/2211 allows remote attackers to execute arbitrary code via crafted HTTP requests.
An unauthenticated stack-based buffer overflow in the ssvr component of GeoVision GV-LPC2011/2211 allows remote attackers to execute arbitrary code via crafted RTSP requests.
An unauthenticated stack-based buffer overflow in the ssvr component of GeoVision GV-LPC2011/2211 allows remote attackers to execute arbitrary code via crafted RTSP Digest authentication fields.
A stack-based buffer overflow in GeoVision GV-LPC2011/2211 allows remote, unauthenticated attackers to execute arbitrary code via crafted login data.
Flowise contains an arbitrary file read and write vulnerability due to missing validation on input parameters, allowing unauthenticated attackers to achieve remote code execution.
Flowise contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, allowing unauthenticated attackers to execute arbitrary OS commands.
Flowise contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint, allowing attackers to achieve remote code execution via path traversal.
An authentication bypass vulnerability in the Flowise /api/v1/account/register endpoint allows unauthenticated attackers to create unauthorized administrative accounts.
File Browser contains a pre-authentication command injection vulnerability in the Hook Authentication feature, allowing unauthenticated remote code execution via shell metacharacter injection.
File Browser is vulnerable to an authentication bypass via forged HTTP headers when configured with proxy authentication, allowing unauthenticated attackers to impersonate any user, including admins.
The EVoke CSMS platform contains a critical vulnerability where WebSocket endpoints lack authentication, allowing attackers to impersonate charging stations and gain unauthorized system access.
The MDTF plugin for WordPress contains an unauthenticated SQL injection vulnerability in versions 1.3.7 and earlier, allowing remote attackers to execute arbitrary database commands.
Premmerce Wishlist for WooCommerce contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries.
RTKLIB contains an out-of-bounds write vulnerability in the decode_type1033 function, allowing potential arbitrary code execution via crafted RTCM3 streams.
The pynetdicom library's qrscp application is vulnerable to arbitrary file writes via an unsanitized DICOM dataset instance in the C-STORE handler.
YMC Filter is vulnerable to SQL injection, allowing unauthenticated attackers to execute arbitrary SQL commands via specially crafted input.
OMGF Pro contains an unrestricted file upload vulnerability that allows an attacker to upload malicious files, potentially leading to remote code execution.
The EventPrime WordPress plugin is susceptible to PHP Object Injection, allowing authenticated subscribers to execute arbitrary code.
NEC ExpressUpdate Agent for Windows contains an access control deficiency that may allow for unauthorized system-level operations.
A security vulnerability exists in the Shenzhen Setracker2 Android application that may allow for unauthorized access or data compromise.
The Email Address Encoder WordPress plugin contains an unspecified vulnerability prior to version 1.
Apache Shiro, when used with the shiro-guice module, is susceptible to an authentication bypass via a specially crafted HTTP request.
A heap buffer overflow vulnerability exists in the wolfSSL library during the processing of DTLS 1.x packets, potentially leading to arbitrary code execution.
A security vulnerability in the wolfSSL library may allow for unauthorized access or system compromise, requiring immediate attention from security administrators.
A Remote Code Execution vulnerability exists in the Post Snippets plugin, allowing authenticated contributors to execute arbitrary code on the underlying server.
An out-of-bounds write vulnerability in the Renesas TSIP TLS 1 implementation can lead to memory corruption or arbitrary code execution.
The wolfSSL library incorrectly accepts un-negotiated Raw Public Keys in place of expected X.509 certificates, leading to authentication bypass.
A vulnerability exists in the wolfSSL library that requires immediate investigation and remediation to ensure cryptographic integrity.
A flaw in wolfSSL_PKCS7_verify() causes it to incorrectly return success for degenerate PKCS#7 objects lacking a signer.
An insufficiently protected credentials vulnerability in Schneider Electric EasyLogic T150 allows unauthenticated access to sensitive system information.
A security flaw exists within the Red Hat build of Apicurio Registry 3 that may lead to unauthorized system impacts.
WSO2 API Manager contains a vulnerability in its message flow component that fails to properly validate user-controlled input within WS-Addressing headers.
A vulnerability in APIExperts Square for WooCommerce allows for the unauthorized retrieval of sensitive information embedded within sent data.
The DICOM Web Viewer Framework contains a server-side request forgery vulnerability due to improper validation of URL parameters in the DICOMWebProxy and DICOMJSON data sources.
A SQL injection vulnerability exists in the SALESmanago & Leadoo plugin, allowing authenticated subscribers to execute arbitrary SQL commands via the application.
A SQL injection vulnerability in the WC Vendors Marketplace plugin allows authenticated subscribers to execute arbitrary database queries.
This vulnerability represents a security bypass affecting the fix for CVE-2026-34916 in Revive Adserver.
A security vulnerability has been identified in the thc-hydra authentication cracking tool, affecting all versions up to and including version 9.
A critical security vulnerability has been disclosed affecting the Maxun software prior to version 0.
A vulnerability exists in Seahub prior to version 13 that may allow for unauthorized system impact.
A high-severity security vulnerability has been identified in the pnpm package manager.
A security vulnerability has been discovered in the pnpm package manager requiring immediate attention.
A stored cross-site scripting (XSS) vulnerability in the pretix PDF editor allows execution of malicious HTML content when viewing ticket or badge layouts.
A critical vulnerability in the File Browser interface allows for potential unauthorized file manipulation and system access within the defined directory structure.
A NULL pointer dereference vulnerability in Schneider PowerLogic™ P7 devices can lead to a denial-of-service condition when processing malformed network requests.
A format string vulnerability exists in the vlsvr component of GeoVision GV-LPC2011 and GV-LPC2211, allowing for potential unauthenticated remote code execution.
An OS command injection vulnerability exists in Schneider PowerLogic P7 devices that allows authenticated users to execute arbitrary commands with elevated privileges.
A security vulnerability has been identified in the Huly Platform, necessitating immediate investigation and remediation by system administrators.
NewsBlur prior to version 14 contains a vulnerability that may allow for unauthorized system access or data manipulation.
Horner Automation Cscape versions prior to 10 are vulnerable to a high-severity security flaw potentially allowing unauthorized access.
AzeoTech DAQFactory version 21 contains a security vulnerability that may allow for unauthorized access or system impact.
A security vulnerability exists in the File Browser management interface that could potentially allow unauthorized file manipulation or system access.
A vulnerability in the Vim text editor may allow for arbitrary code execution or unauthorized system access when processing maliciously crafted files.
A cryptographic flaw in Silicon Labs SiSDK for EFR32xG27 chips results in predictable keys, potentially undermining device security and encryption.
Flowise versions prior to 3 contain a security vulnerability that requires immediate attention from administrators.
ToolJet, an open-source platform for building internal tools and AI agents, is impacted by a high-severity security vulnerability.
The filebrowser interface, used for managing files, contains a high-severity vulnerability that requires immediate remediation.
Flowise versions prior to 3 are susceptible to a security vulnerability that may expose the application to unauthorized access or manipulation.
The picklescan library through version 0 contains a security vulnerability that may allow for malicious code execution through compromised pickle files.