Critical Watch

Stored XSS in GitLab CE/EE's analytics dashboard (CVSS 8.7, public POC, tied to known threat actors) lets a low-privilege user run JavaScript in other users' sessions on one of the most widely deployed DevOps platforms, enabling account/session takeover across engineering teams.

GitLab CE/EE branch-protection bypass (CVSS 8.5, public POC) lets developer-role users run CI/CD pipelines on protected branches they can't push to, a direct route to tampering with builds and deployment secrets in a core software-supply-chain tool.

Subscriber-level SQL injection in the Events Manager WordPress plugin (CVSS 8.1, public POC), installed on ~100k+ sites, gives any low-privilege registered user raw database access, exposing booking data and enabling full DB compromise on a huge install base.

Second-order SQL injection in Form Maker by 10Web (CVSS 8.1, public POC) is exploitable by any subscriber-level account on a very popular form plugin, letting attackers read or alter the entire WordPress database from a self-registered account.

Unauthenticated export-file disclosure in the Import WP plugin (CVSS 7.5, public POC, linked to known actors) lets any remote attacker download admin-generated export files - often containing user PII and site data - with zero credentials, an actively-abused data-breach vector.

SeaweedFS is a popular open-source distributed storage system, and this unauthenticated critical (9.3) SSRF with response read-back over the exposed VolumeServer gRPC port-already with a public POC and named threat actors-lets anyone reachable to that port pivot into internal services and exfiltrate data.

The Ezoic plugin is deployed on large numbers of ad-monetized WordPress sites, and this unauthenticated flaw lets any remote attacker trigger a full database export that harvests user password hashes and session tokens-with a public POC and active threat-intel signals making mass credential theft imminent.

The Link Factory WordPress plugin is a deliberate CVSS 10.0 backdoor with an operator-controlled REST API, so every site running it is already fully compromised-security teams must hunt for and remove it immediately rather than wait for a patch.

Total Upkeep is a widely-installed WordPress backup plugin, and this unauthenticated flaw (public POC) exposes the backup authorization secret, letting attackers both exfiltrate full backup archives and trigger site-wide restores that overwrite the live site-a direct path to total takeover and data destruction.

Wallet for WooCommerce is used across the large WooCommerce e-commerce ecosystem, and this critical (9.1) business-logic bypass with a public POC lets any customer credit their wallet for less than they actually paid, causing direct and scalable financial loss to online stores.

Unauthenticated RCE (CVSS 10.0) in the Fabrik extension for Joomla with a 57% EPSS score and active threat-actor interest means any internet-facing Joomla site running Fabrik can be fully compromised without credentials.

Events Manager is a widely deployed WordPress plugin, and this flaw lets unauthenticated attackers reset passwords and promote themselves to Administrator (CVSS 9.8, public POC), giving instant full-site takeover.

Unauthenticated RCE (CVSS 9.8, public POC) in Product Input Fields for WooCommerce triggers under a default-blank configuration, exposing e-commerce stores to arbitrary PHP upload and server compromise.

Unauthenticated SQL injection in WP Directory Kit (CVSS 8.6, public POC, known-actor threat intel) lets remote attackers dump user credentials and sensitive data directly from the WordPress database.

Unauthenticated arbitrary PHP file upload in the Giftware WordPress plugin (CVSS 9.8, 22% EPSS, public exploit) yields straightforward remote code execution on affected web servers.

An out-of-bounds write in Microsoft .NET grants full local code execution and is flagged with active threat-actor/malware intelligence, putting the enormous population of Windows and cross-platform .NET application servers at immediate risk despite an available patch.

This local privilege-escalation flaw affects .NET 8/9/10 and Visual Studio 2022/2026 - near-ubiquitous across enterprise developer and server fleets - and carries known-actor threat intelligence, giving attackers a reliable path to elevate on already-breached hosts.

CyberPanel is a widely deployed hosting control panel (with a prior history of mass ransomware exploitation), and this authenticated command injection escalates any logged-in user to persistent root SSH access, making internet-facing panels prime targets.

Flowise, a popular open-source LLM/AI app-builder increasingly deployed in enterprises, exposes an unauthenticated file-download endpoint that was mistakenly whitelisted from auth - and it already has known-actor threat intelligence - allowing attackers to exfiltrate sensitive files and API keys.

The CheckView WordPress plugin's REST API authentication bypass lets a completely unauthenticated attacker create a new administrator account and fully take over the site, the classic mass-scannable WordPress attack that leads to widespread website compromise.

An unauthenticated, pre-auth SQL injection (CVSS 9.1) in the ProSolution WP Client WordPress plugin lets any remote attacker dump the entire site database, and the massive WordPress plugin install base combined with a public exploit makes mass-scanning and exploitation near-certain.

Command injection in CyberPanel 2.4.3 gives low-privileged users OS-level RCE on the host, and CyberPanel is an internet-facing hosting control panel with a documented history of mass ransomware exploitation, so any exposed instance is a high-value target.

Authenticated RCE in Cachet (≤2.4.1) via Blade/Twig template injection turns a widely deployed open-source status-page system into an arbitrary PHP execution point, and status pages are frequently public-facing with loosely managed low-privilege accounts.

The NTIOLib_KSFX.sys driver bundled with Kingston FURY CTRL enables local privilege escalation to SYSTEM, and this MSI-derived NTIOLib driver family is a well-known Bring-Your-Own-Vulnerable-Driver vector actively abused by ransomware and APT actors to disable EDR.

An authenticated arbitrary file read in CyberPanel 2.4.3's file manager (via symlink ZIP extraction) lets panel users escape their sandbox to read system files like credentials and keys, compounding the RCE exposure on the same widely deployed, internet-facing hosting platform.