Security updates today

Named products with a severity, updated in the last 24 hours. Known-exploited records are listed first.

40 records

Critical10.0invisioncommunity invisioncommunity Improper Neutralization of Special Elements Used in a Template EngineVuln · CVE-2025-47916 · invisioncommunity · Invision Power Board · CVE.org · FIRST EPSS · EUVD · PHPPatch nowKEVEPSS 84.19%May 16, 2025
Critical10.0vBulletin vBulletin Improper Protection of Alternate PathVuln · CVE-2025-48827 · vBulletin · vBulletin · CVE.org · FIRST EPSS · EUVD · PHP, vBulletinPatch nowKEVEPSS 75.84%May 26, 2025
Critical10.0WSO2 Multiple Products Path Traversal VulnerabilityVuln · CVE-2026-5430 · WSO2 · Multiple Products · CISA KEV · CVE.org · FIRST EPSS · WSO2Patch nowKEVEPSS 0.59%Aug 6, 2026
Critical10.0Cisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityVuln · CVE-2026-76460 · Cisco · Identity Services Engine · CISA KEV · Cisco Security Advisories · CVE.org · CiscoPatch nowKEVEPSS 14.03%Sep 16, 2026
Critical10.0GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityVuln · CVE-2026-85706 · GitLab · Community Edition and Enterprise Edition · CISA KEV · CVE.org · FIRST EPSS · GitLabPatch nowKEVEPSS 92.96%Sep 11, 2026
Critical10.0Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityVuln · CVE-2026-75650 · Adobe · Commerce and Magento · CISA KEV · CVE.org · FIRST EPSS · Adobe, MagentoPatch nowKEVEPSS 3.95%Sep 7, 2026
Critical10.0N-able N-central Static Code Injection VulnerabilityVuln · CVE-2026-86218 · N-able · N-central · CISA KEV · CVE.org · FIRST EPSS · N-ablePatch nowKEVEPSS 13.35%Sep 5, 2026
Critical10.0SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityVuln · CVE-2026-83548 · SonicWall · SMA1000 Appliances · CISA KEV · CVE.org · FIRST EPSS · SonicWallPatch nowKEVEPSS 8.04%Sep 1, 2026
Critical10.0Metabase SQL Injection VulnerabilityVuln · CVE-2026-72898 · Metabase · Metabase · CISA KEV · CVE.org · FIRST EPSS · MetabasePatch nowKEVEPSS 97.34%Aug 6, 2026
Critical10.0Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.Vuln · CVE-2026-94169 · code-projects · Employee Management System · CVE.org · FIRST EPSS · NIST NVDPatch nowKEVEPSS 0.98%Oct 16, 2026
Critical10.0Kestra OSS OS Command Injection VulnerabilityVuln · CVE-2026-49869 · Kestra · Kestra OSS · CISA KEV · CVE.org · FIRST EPSSPatch nowKEVEPSS 2.10%Jun 26, 2026
Critical10.0Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityVuln · CVE-2026-56291 · Balbooa · Forms · CISA KEV · CVE.org · FIRST EPSS · JoomlaPatch nowKEVEPSS 14.85%Jul 8, 2026
Critical10.0iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityVuln · CVE-2026-48939 · iCagenda · iCagenda · CISA KEV · CVE.org · FIRST EPSSPatch nowKEVEPSS 20.07%Jun 20, 2026
Critical10.0JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityVuln · CVE-2026-48908 · JoomShaper · SP Page Builder · CISA KEV · CVE.org · FIRST EPSSPatch nowKEVEPSS 88.51%Jun 15, 2026
Critical10.0Joomlack Page Builder Improper Access Control VulnerabilityVuln · CVE-2026-56290 · Joomlack · Page Builder · CISA KEV · CVE.org · FIRST EPSS · JoomlaPatch nowKEVEPSS 30.87%Jun 27, 2026
Critical10.0Adobe ColdFusion Path Traversal VulnerabilityVuln · CVE-2026-48282 · Adobe · ColdFusion · CISA KEV · CVE.org · FIRST EPSS · Adobe, ColdFusionPatch nowKEVEPSS 42.39%Jun 30, 2026
Critical10.0Widget Factory Joomla Content Editor Improper Access Control VulnerabilityVuln · CVE-2026-48907 · Widget Factory · Joomla Content Editor · CISA KEV · CVE.org · FIRST EPSS · JoomlaPatch nowKEVEPSS 16.19%Jun 5, 2026
Critical10.0LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityVuln · CVE-2026-48172 · litespeedtech · litespeed cpanel plugin · CISA KEV · CVE.org · FIRST EPSS · cPanel, LiteSpeedPatch nowKEVEPSS 1.01%May 20, 2026
Critical10.0Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files.Vuln · CVE-2026-45444 · WP Swings · Gift Cards For WooCommerce Pro · CVE.org · FIRST EPSS · NIST NVD · WordPressPatch nowKEVEPSS 0.52%May 20, 2026
Critical10.0Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business.Vuln · CVE-2026-41679 · paperclip · paperclipai · CVE.org · FIRST EPSS · Metasploit Modules · Node.jsPatch nowKEVEPSS 7.36%Apr 23, 2026
Critical10.0Ubiquiti UniFi OS Improper Input Validation VulnerabilityVuln · CVE-2026-34910 · ui · unifi os server · CISA KEV · CVE.org · FIRST EPSS · UbiquitiPatch nowKEVEPSS 45.77%May 21, 2026
Critical10.0Ubiquiti UniFi OS Path Traversal VulnerabilityVuln · CVE-2026-34909 · ui · unifi os server · CISA KEV · CVE.org · FIRST EPSS · UbiquitiPatch nowKEVEPSS 1.79%May 21, 2026
Critical10.0Ubiquiti UniFi OS Improper Access Control VulnerabilityVuln · CVE-2026-34908 · ui · unifi os server · CISA KEV · CVE.org · FIRST EPSS · UbiquitiPatch nowKEVEPSS 15.21%May 21, 2026
Critical10.0WWBN AVideo is an open source video platform.Vuln · CVE-2026-33478 · wwbn · avideo · CVE.org · FIRST EPSS · NIST NVDPatch nowKEVEPSS 11.24%Mar 23, 2026
Critical10.0Improper Access ControlVuln · CVE-2026-31843 · goodoneuz · pay-uz · CVE.org · FIRST EPSS · NIST NVDPatch nowKEVEPSS 1.17%Apr 16, 2026
Critical10.0CtrlPanel is open-source billing software for hosting providers.Vuln · CVE-2026-34234 · Ctrlpanel-gg · panel · CVE.org · FIRST EPSS · NIST NVDPatch nowKEVEPSS 4.54%May 19, 2026
Critical10.0Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityVuln · CVE-2026-21962 · Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in · CISA KEV · CVE.org · FIRST EPSS · Oracle, WebLogicPatch nowKEVEPSS 73.19%Jan 20, 2026
Critical10.0Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityVuln · CVE-2026-22769 · Dell · RecoverPoint for Virtual Machines (RP4VMs) · CISA KEV · CVE.org · FIRST EPSSPatch nowKEVEPSS 13.53%Feb 17, 2026
Critical10.0Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityVuln · CVE-2026-20079 · Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management · CISA KEV · Cisco Security Advisories · CVE.org · CiscoPatch nowKEVEPSS 88.18%Mar 4, 2026
Critical10.0Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityVuln · CVE-2026-16812 · Arista · VeloCloud Orchestrator · CISA KEV · CVE.org · FIRST EPSS · AristaPatch nowKEVEPSS 1.00%Jul 27, 2026
Critical10.0SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityVuln · CVE-2026-15409 · SonicWall · SMA1000 Appliances · CISA KEV · CVE.org · FIRST EPSS · SonicWallPatch nowKEVEPSS 6.79%Jul 14, 2026
Critical10.0Ivanti Sentry OS Command Injection VulnerabilityVuln · CVE-2026-10520 · Ivanti · Sentry · CISA KEV · CVE.org · FIRST EPSS · IvantiPatch nowKEVEPSS 99.91%Jun 9, 2026
Critical10.0Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityVuln · CVE-2026-20182 · Cisco · Catalyst SD-WAN · CISA KEV · CVE.org · FIRST EPSS · CiscoPatch nowKEVEPSS 91.82%May 14, 2026
Critical10.0Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data VulnerabilityVuln · CVE-2026-20131 · Cisco · Secure Firewall Management Center (FMC) · CISA KEV · CVE.org · FIRST EPSS · CiscoPatch nowKEVEPSS 43.17%Mar 4, 2026
Critical10.0Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityVuln · CVE-2026-20127 · Cisco · Catalyst SD-WAN Controller and Manager · CISA KEV · CVE.org · FIRST EPSS · CiscoPatch nowKEVEPSS 88.48%Feb 25, 2026
Critical10.0Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityVuln · CVE-2025-32975 · Quest · KACE Systems Management Appliance (SMA) · CISA KEV · CVE.org · FIRST EPSSPatch nowKEVEPSS 2.49%Jun 24, 2025
Critical10.0Craft CMS Code Injection VulnerabilityVuln · CVE-2025-32432 · craftcms · CMS · CISA KEV · CVE.org · FIRST EPSS · Craft CMSPatch nowKEVEPSS 99.79%Apr 18, 2025
Critical10.0SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityVuln · CVE-2025-52691 · SmarterTools · SmarterMail · CISA KEV · CVE.org · FIRST EPSS · SmarterMailPatch nowKEVEPSS 85.66%Dec 28, 2025
Critical10.0Meta React Server Components Remote Code Execution VulnerabilityVuln · CVE-2025-55182 · Meta · React Server Components · CISA KEV · CVE.org · FIRST EPSSPatch nowKEVEPSS 99.80%Dec 3, 2025
Critical10.0Adobe Experience Manager Forms Code Execution VulnerabilityVuln · CVE-2025-54253 · Adobe · Experience Manager (AEM) Forms · CISA KEV · CVE.org · FIRST EPSS · AdobePatch nowKEVEPSS 88.26%Aug 5, 2025