Critical vulnerabilities, curated daily for security professionals
Saturday's disclosures concentrate on open-source web platforms and developer tooling, with maximum-severity flaws in Budibase, Kestra, and OpenProject leading the set. The brief covers 31 critical CVEs, up 24% from the prior day's 25, and 60 high-priority CVEs, a 43% increase from 42. CVE-2026-54350 (CVSS 10) in Budibase and CVE-2026-53576 and CVE-2026-49869 (both CVSS 10) in Kestra represent unauthenticated remote code execution risks, while CVE-2026-46386 (CVSS 9.9) and CVE-2026-52780 (CVSS 9.6) affect OpenProject. WordPress ecosystem plugins including BuddyBoss and Uncanny Automator Pro add further critical exposure, and six CVEs across Ubiquiti UniFi OS, Cisco Unified CM, PTC Windchill, and Lantronix EDS5000 carry confirmed exploitation. Vendor patches were not yet reflected at disclosure time, so teams should prioritize compensating controls and monitor vendor advisories for fixes on internet-facing deployments.
Immediate action: Prioritize self-hosted web platforms — Budibase, Kestra, and OpenProject — along with WordPress sites running BuddyBoss or Uncanny Automator Pro, and the actively exploited Ubiquiti UniFi OS and Cisco Unified CM deployments. With vendor fixes not yet reflected for the critical issues, restrict external access, apply available workarounds, and watch vendor advisories so patches can be deployed as soon as they ship.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
The Lantronix EDS5000 contains a code injection vulnerability that is currently being actively exploited in the wild.
An improper input validation flaw in Ubiquiti UniFi OS enables network-adjacent attackers to execute arbitrary commands on the underlying system.
A path traversal vulnerability in Ubiquiti UniFi OS allows network-adjacent attackers to read sensitive system files and potentially compromise user accounts.
An improper access control vulnerability in Ubiquiti UniFi OS devices allows network-adjacent attackers to modify system configurations without authorization.
PTC Windchill and FlexPLM are vulnerable to improper input validation, allowing for potential exploitation. This vulnerability is confirmed as actively exploited in the wild.
A server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager allows unauthenticated remote attackers to perform arbitrary file operations and escalate privileges to root.
An unauthenticated injection vulnerability in Budibase allows remote attackers to read or modify arbitrary documents in connected databases via maliciously crafted query parameters.
A default, insecure secret key configuration in the official OpenProject Docker image allows authenticated users to achieve remote code execution via Marshal-deserialization of cookies.
An improper path validation vulnerability in the Budibase PWA upload process allows authenticated builders to perform arbitrary file reads on the server.
A PHP Object Injection vulnerability exists in the Buddyboss Platform plugin that may allow unauthenticated or low-privileged attackers to execute arbitrary code.
A PHP Object Injection vulnerability in Uncanny Automator Pro allows attackers to execute arbitrary code via malicious serialized input.
An authentication bypass vulnerability in Kestra allows unauthenticated attackers to execute arbitrary code as root by manipulating API requests.
The Invoice Generator plugin for WordPress is vulnerable to unauthenticated privilege escalation, allowing attackers to modify arbitrary user accounts and hijack administrator sessions.
Kestra contains an authentication bypass vulnerability due to an improper path validation, allowing unauthenticated attackers to execute arbitrary workflows and achieve Remote Code Execution.
OpenProject is vulnerable to cache store poisoning, which can be leveraged by attackers to achieve Remote Code Execution on the host system.
The mise development tool manager improperly processes .tool-versions files using the Tera template engine, allowing unauthenticated remote attackers to achieve arbitrary command execution.
Daktronics VFC-DMP-5000 firmware contains a directory traversal vulnerability, allowing remote users to escape intended directories and enumerate arbitrary file system paths.
OpenProject contains a SQL injection vulnerability in the timestamps functionality, allowing authenticated attackers to execute arbitrary SQL queries via the timestamps parameter.
A critical unauthenticated privilege escalation vulnerability exists in the Easy Elements for Elementor plugin, allowing attackers to elevate their access level without authorization.
A critical unauthenticated privilege escalation vulnerability in the Paytium plugin allows remote attackers to gain unauthorized administrative privileges.
A critical unauthenticated privilege escalation vulnerability in Dokan Pro allows attackers to bypass security controls and obtain administrative access.
A server-side template injection vulnerability in the Genshi template engine allows remote attackers to execute arbitrary code via crafted template expressions.
An unauthenticated SQL injection vulnerability in the JetBooking plugin for WordPress allows remote attackers to execute arbitrary SQL queries and access sensitive database information.
The wpDataTables plugin for WordPress contains an unauthenticated SQL injection vulnerability that enables remote attackers to manipulate database queries.
Real Estate 7 contains an unauthenticated SQL injection vulnerability in versions 3.5.9 and earlier, allowing remote attackers to manipulate database queries.
GeoDirectory versions 2.8.162 and earlier are susceptible to an unauthenticated SQL injection vulnerability, enabling database manipulation by remote attackers.
The Library Management System by Online Web Tutor is affected by an unauthenticated SQL injection vulnerability in versions 3.5.7 and earlier.
An unauthenticated SQL injection vulnerability exists in the Codemstory 워드프레스 결제 심플페이 plugin, allowing remote attackers to execute arbitrary database queries.
An unauthenticated SQL injection vulnerability in the Oooorgle Quotes llama plugin allows remote attackers to execute arbitrary SQL commands via unsanitized input parameters.
An unauthenticated SQL injection vulnerability in the Crocoblock JetSmartFilters plugin allows remote attackers to execute arbitrary SQL commands.
JetEngine versions 3.8.10.2 and earlier are vulnerable to an unauthenticated SQL injection, potentially allowing remote attackers to manipulate database queries.
The Advance Product Search plugin for WordPress is susceptible to an unauthenticated SQL injection vulnerability in versions 1.4.4 and earlier.
OpenProject contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated project administrators to hijack project folders and overwrite access control lists.
Booster for WooCommerce contains an arbitrary file upload vulnerability allowing unauthenticated remote code execution.
The Quform WordPress plugin is susceptible to an arbitrary file upload vulnerability exploitable by authenticated subscribers.
The Travel Booking WordPress plugin contains an arbitrary file upload vulnerability exploitable by authenticated subscribers.
A local file inclusion vulnerability in the Wolfram Cloud JVM initialization allows attackers to execute arbitrary code by manipulating shared temporary directories.
An insecure deserialization vulnerability in the OWASP ZAP ViewState add-on allows attackers to achieve arbitrary code execution via malicious serialized Java objects.
A PHP Object Injection vulnerability exists in the InspiryThemes RealHomes plugin for WordPress, potentially allowing authenticated subscribers to execute arbitrary code.
An integer overflow vulnerability in the Mojo component of Google Chrome could allow a remote attacker to trigger memory corruption.
Uncanny Automator contains an unauthenticated PHP Object Injection vulnerability in versions 7 and below, potentially allowing for remote code execution.
A security vulnerability exists in Dell Container Storage Modules (CSI PowerStore) version 2, potentially impacting the integrity of storage management operations.
Dell Display and Peripheral Manager (DDPM) for macOS versions prior to 2 contain a vulnerability that could lead to unauthorized system impacts.
The mise development tool manager contains a high-severity vulnerability potentially allowing for unauthorized system impact.
A vulnerability in the Blocksy Companion Pro WordPress plugin allows authenticated contributors to execute arbitrary code on the server.
The AVX2-optimized ML-KEM implementation in wolfSSL contains a comparison flaw during the decapsulation process that could lead to security compromises.
The FreeBSD KTLS receive path improperly decrypts records in place, leading to potential memory corruption due to unsafe mbuf modification.
The Teable v2 REST API lacks necessary permission metadata on ORPC endpoints, enabling authenticated users to bypass authorization controls.
A vulnerability exists in the KubeVirt migration proxy component of Red Hat OpenShift Virtualization that could lead to unauthorized system access.
A privilege escalation vulnerability in ThemeFusion's Fusion Builder allows users with Contributor roles to perform unauthorized actions.
A privilege escalation vulnerability in Abandoned Cart Pro for WooCommerce allows a subscriber-level user to escalate their privileges to administrative access.
A privilege escalation vulnerability in Frisbii Pay allows authenticated users with contributor-level access to escalate their permissions to administrative levels.
A SQL injection vulnerability in the Tourfic plugin allows authenticated subscriber-level users to execute arbitrary SQL commands against the database.
A SQL injection vulnerability in the wpForo Forum plugin allows authenticated contributors to execute arbitrary database queries.
A SQL injection vulnerability in the BestWebSoft Gallery plugin allows authenticated contributors to execute arbitrary database queries.
A SQL injection vulnerability in the WP Post Author plugin allows authenticated contributors to execute arbitrary database queries.
A SQL injection vulnerability exists in the Restaurant Menu by MotoPress plugin, allowing authenticated contributors to execute arbitrary SQL commands.
An SQL injection vulnerability in the WP Job Portal plugin allows authenticated contributors to execute arbitrary database queries.
The Contest Gallery plugin is affected by an authenticated SQL injection vulnerability, permitting contributors to run unauthorized SQL queries.
A SQL injection vulnerability in the Zip Recipes plugin for WordPress allows authenticated contributors to execute arbitrary database queries.
A SQL injection vulnerability in the Groundhogg WordPress plugin allows authenticated sales representatives to execute arbitrary database queries.
A heap-based buffer overflow vulnerability in the vtkDICOMItem::NewDataElement function of the vtk-dicom library can lead to arbitrary code execution.
A high-severity vulnerability exists in the Cudy LT300 router, potentially allowing unauthorized system access.
A high-severity vulnerability has been identified in OpenProject, a web-based project management platform, potentially leading to unauthorized data access.
A high-severity security vulnerability has been discovered in the Pagekit CMS, which could potentially lead to unauthorized access or site compromise.
This vulnerability is an unauthenticated Cross-Site Request Forgery (CSRF) flaw affecting the Eagle Booking plugin.
An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in the Paid Memberships Pro - Add Member From Admin plugin.
A security vulnerability has been identified in the Kestra open-source orchestration platform.
RustFS, a distributed object storage system, contains a vulnerability that may lead to significant security compromise.
BitFire Security versions 5 and below contain multiple unauthenticated vulnerabilities that allow for potential system compromise.
The Budibase low-code platform contains a vulnerability that may expose the system to unauthorized access or manipulation.
A security vulnerability in the AutoGPT workflow automation platform may expose continuous artificial intelligence agents to unauthorized manipulation.
A broken access control vulnerability in the devLXDInstancePatchHandler component of Canonical LXD allows unauthorized storage volume access between guests.
An unauthenticated broken access control vulnerability in the MailChimp Block plugin allows unauthorized users to perform sensitive actions without appropriate permissions.
A security vulnerability in the Budibase low-code platform may allow for unauthorized access or execution of administrative functions.
A high-severity security vulnerability has been identified in the Budibase low-code platform that requires immediate attention from system administrators.
A high-severity vulnerability exists within the RustFS distributed object storage system that necessitates immediate security patching.
A high-severity vulnerability has been disclosed in the OpenProject web-based project management software, requiring urgent administrative intervention.
An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in the Child Theme Wizard plugin, allowing unauthorized actions to be performed on behalf of a victim.
Daktronics VFC-DMP-5000 devices utilize default administrative credentials with weak authentication controls, posing a significant risk of unauthorized access.
The extract-zip library fails to validate symlink targets during the extraction of zip archives, potentially leading to arbitrary file system access.
Tribulant Newsletters plugin is vulnerable to a broken access control issue, potentially allowing unauthorized subscriber data manipulation.
A security flaw has been identified in the Red Hat build of Keycloak, potentially impacting authentication or authorization mechanisms.
A security vulnerability exists in HTMLy CMS through version 3, which may allow for unauthorized system access or information disclosure.
A vulnerability in socat versions 1 may allow for unauthorized access or system compromise due to improper handling of network connections.
A flaw in the Red Hat Keycloak Policy Enforcer allows for improper access control, potentially bypassing security constraints during authentication processes.
A missing authorization vulnerability in Royal Plugins' Royal MCP allows attackers to exploit incorrectly configured access control settings.
A critical Local File Inclusion (LFI) vulnerability exists in the MDTF plugin, allowing unauthenticated attackers to read sensitive files on the host server.
A security vulnerability has been identified in the LibreChat AI interface, requiring urgent review of the vendor's security updates to mitigate potential unauthorized access.
A security vulnerability in the Notepad++ text editor requires immediate attention to prevent potential exploitation of the application environment.
A security vulnerability has been identified in the Notepad++ source code editor that may require immediate attention from system administrators.
A high-severity security vulnerability has been identified in the Notepad++ source code editor that requires prompt remediation.
A critical memory vulnerability in the Imagination Graphics DDK allows improper GPU commands to trigger out-of-bounds memory access.
A security vulnerability has been identified in the SeaweedFS distributed storage system that may allow unauthorized access or impact system integrity.
A security vulnerability in the Glances cross-platform monitoring tool could potentially be leveraged by remote attackers to compromise system monitoring integrity.
An additional security vulnerability has been identified in the Glances monitoring tool that may permit unauthorized system-level interactions.
A security vulnerability has been identified in the Glances system monitoring tool that may allow unauthorized access or system compromise.