Critical Watch

A CVSS 9.8 SQL-injection-to-RCE in AzuraCast's backup-restore flow, a very widely self-hosted radio/streaming platform, with a public exploit means any exposed instance can be fully compromised.

Authenticated SQL injection in ISPConfig's Remote API lets a single low-privilege API user read or destroy data across ALL hosted tenants, making it a high-value target on the many shared-hosting providers running this control panel.

Stored XSS in Froxlor's DNS editor auto-executes in an admin's browser and carries threat-intel signals of known actors, letting any low-privilege hosting customer hijack the panel administrator on this popular hosting control panel.

A privilege-escalation flaw in Netflix Lemur lets any authenticated user mint a rogue sub-CA off an internal root, directly undermining the PKI trust chain that security teams rely on-and it is tagged with active threat intel.

Second-order UNION-based SQL injection in Froxlor (pre-2.3.8) with a patch and known-actor threat intel gives an admin-level attacker full database read/write, compounding the DNS XSS risk on the same widely deployed hosting panel.

GitLab CE/EE is deployed by a huge number of organizations for source code and CI/CD, and this flaw lets unauthenticated attackers bypass CSRF protections to trigger state-changing GraphQL mutations via GET requests across all deployments, putting core DevOps infrastructure at risk.

Netty is one of the most widely embedded Java networking libraries, and this unauthenticated OutOfMemoryError DoS in its SCTP handler-already tied to known threat actors-can crash any exposed JVM service built on the affected transport.

MLflow is a popular ML lifecycle platform in enterprise data-science environments, and this pre-3.15.0 flaw lets any authenticated user anchor a model version to another user's artifact directory and exfiltrate their private model artifacts, exposing sensitive intellectual property.

The Extra Product Options Builder plugin runs on large numbers of WooCommerce storefronts, and this unauthenticated endpoint lets attackers retrieve customer-uploaded files, exposing potentially sensitive personal data at scale with active threat-actor interest.

SureForms by Brainstorm Force is installed on many WordPress sites, and this unauthenticated resource-exhaustion flaw lets remote attackers flood the entry system to lock out administrators and take down form functionality with a patched-but-widely-unpatched footprint.

Unauthenticated, pre-auth RCE via a trivial strcpy overflow in Wavlink consumer routers has a public exploit, known-actor activity, and NO available patch, making these internet-facing devices immediate botnet/foothold fodder that teams must firewall or replace now.

The WPvivid backup plugin path traversal lets an attacker drop a plugin-generated log file into the web root - an effective webshell-write primitive - on a widely installed WordPress backup tool with a public exploit and known-actor interest.

All-in-One WP Migration is installed on millions of WordPress sites, and this flaw lets a subsite admin execute arbitrary PHP across an entire multisite network, turning a limited account into full network compromise on a hugely popular plugin.

Glances is a broadly deployed Python system-monitoring tool, and this command-injection flaw (public exploit, known-actor activity, patched in 4.5.6) gives a local unprivileged user arbitrary shell execution on any host running it with action templates.

vm2 is embedded as a sandbox in countless Node.js applications and serverless platforms, and this DoS bypass - with a public exploit and known-actor interest - lets sandboxed code crash the host, so teams should confirm they're on 3.11.6+ or migrated off this deprecated library.

Unauthenticated OS command injection running as root on Haiwell IoT Cloud HMI Gateways is the only candidate with active threat-actor/malware intel, and internet-exposed ICS/OT gateways are prime targets for disruptive attacks.

A CVSS 10.0 unauthenticated RCE chain in MindsDB's Minds Platform lets any network-reachable attacker run OS commands, and MindsDB is a widely adopted open-source AI/ML layer increasingly deployed inside enterprises.

A CVSS 9.3 unauthenticated session/authentication bypass with a public exploit for EFM ipTIME A3004T routers matters because ipTIME dominates consumer/SMB networking in some regions, giving attackers full web-management takeover at scale.

Authenticated SQL injection affecting all versions of AppFlowy Cloud (a popular open-source Notion alternative) enables full database exfiltration, putting hosted knowledge-base and collaboration data at risk.

Authenticated persistent RCE via an eval-based custom-tag flaw in ImpressCMS lets a compromised admin account plant PHP that runs on every frontend page load, turning any CMS admin breach into full, durable server compromise.

File Browser is one of the most widely deployed self-hosted file-management web apps, and this flaw lets an attacker reuse any previously valid JWT indefinitely to regain authenticated access despite logout - a patch exists and known actors are already tracking it.

The same broadly-deployed File Browser software allows a low-privileged 'Create-only' user to delete arbitrary files outside their scope via a TUS upload race, giving attackers a destructive data-loss primitive on internet-exposed instances with confirmed threat-actor interest.

Tenda W20E routers have a massive consumer/SOHO install base, and this unauthenticated-adjacent stack overflow (IPMacBindRule) yields likely RCE with a public POC and active-actor interest, making these devices prime targets for Mirai-style botnet recruitment.

The widely-sold Tenda AC1206 exposes remote code execution through a crafted guest-WiFi config request (set_wl_guest_iplist) with a public exploit and known-actor tracking, the classic pattern for mass router compromise and residential-proxy/botnet abuse.

Hard-coded SSH credentials span nearly every firmware version (V21-V27) of Tenda CH/CP/TX3 cameras, giving any attacker permanent shell access to a large fleet of internet-facing IoT cameras that cannot be remediated without a firmware fix.