Critical Watch

An unauthenticated SQL injection in the Unlimited Elements for Elementor plugin - installed on a very large number of WordPress sites - lets any remote attacker read database contents with a public exploit already available, making it the broadest-reach, lowest-barrier risk on the list.

Unauthenticated stored XSS in the WP Ultimate Review plugin lets any visitor plant script via the public review form that executes in an administrator's browser, enabling session/account takeover of WordPress sites, with a public POC and active threat-actor interest.

A TOTP replay flaw in the widely deployed WP 2FA plugin lets an attacker who has a victim's password reuse a captured one-time code to defeat multi-factor authentication, directly undermining a security control many organizations rely on, and has a public exploit.

An unauthenticated attacker can permanently break page rendering on WordPress sites running WP Ultimate Review by submitting crafted review content, a public-POC denial-of-service that takes affected sites offline with a single request.

Stored XSS in the Kubio AI Page Builder plugin allows a low-privileged contributor to save a javascript: URI payload that runs in other users' browsers, a public-POC vector for privilege escalation and admin compromise across many WordPress installs.

An unauthenticated, remote stack-based buffer overflow (CVSS 9.3) in the Boa web server of widely-deployed Tenda XPON gateways with public exploit code and known-actor interest - exactly the SOHO-edge RCE profile that Mirai-style botnets mass-exploit into internet-wide campaigns.

A critical (CVSS 9.4) format-string flaw with a public PoC yields arbitrary command execution on ASUS routers, a massive consumer/SMB install base, turning any compromised or default-credential admin session into full device takeover and a persistent network foothold.

An unauthenticated shortcode-injection bug in The Events Calendar WordPress plugin (millions of installs) has a public exploit and active threat-actor interest, letting remote attackers execute arbitrary registered shortcodes against a huge population of public-facing sites.

All in One SEO is installed on millions of WordPress sites, and this unauthenticated shortcode-injection bypass (public PoC) lets remote attackers smuggle executable shortcodes into content, making it a broad, easily-scanned attack surface across the web.

An unauthenticated remote buffer overflow with public exploit code in Tenda AC9 routers enables memory corruption and likely remote code execution on a popular home/SMB device class routinely conscripted into botnets.

Self-hosted Bitwarden Server (a widely deployed password manager) has an authentication bypass that lets an SSO-provisionable user mint a victim-scoped access token - directly exposing stored credential vaults - and it has a public POC, a patch, and active threat-actor interest.

ASUS routers are extremely common in homes and small offices, and this flaw lets an authenticated admin re-enable Telnet via leftover debug code to gain root RCE, giving attackers full control of edge devices that are frequent initial-access and botnet targets.

Toptech TMS7/TopHat fuel-terminal automation software has a CVSS 10.0 flaw where any unauthenticated, network-reachable attacker can dump arbitrary database tables with a single POST, and it is already being tracked against known actors - a serious risk for energy/fuel critical-infrastructure operators.

The same Toptech terminal-management platform allows unauthenticated arbitrary PHP file upload and execution (no server-side file-type validation), yielding full pre-auth RCE on critical fuel-distribution systems where known threat actors are active.

Netcore NAP930 devices have an unauthenticated OS command injection (CVSS 9.3) with a public exploit via the network_tools CGI, letting remote attackers fully compromise exposed devices with no credentials required.

The npm 'decompress' package is pulled into countless Node.js build pipelines as a transitive dependency, and this symlink-based path traversal lets a crafted archive write files outside the extraction directory (zip-slip) with a public POC, threat-intel chatter, and a patch already out - teams must bump the dependency now.

mall4j's PUT /user/updatePwd endpoint lets an unauthenticated remote attacker reset any storefront account's password with a published exploit, enabling trivial mass account takeover on any deployment of this popular open-source e-commerce platform.

The mypresta Google Merchant Center Feed (gmfeed) module for the widely-used PrestaShop e-commerce platform allows unauthenticated attackers to control the filename/path/content written by feed.php, giving a direct webshell-drop path to full site compromise - and it carries both a public POC and active threat-intel signals.

Netcore/Netis NR289-GE routers (a brand with a large real-world installed base, especially in Asia) are exposed to unauthenticated OS command injection via the ntp_ip parameter in /set_ntp_server_ip.cgi with a public exploit, giving attackers full remote root over edge devices for botnet/pivot use.

Lantronix G520-series firmware disables OPKG signature verification in its boot-time 'stock done' routine, letting attackers push forged software packages as authentic - a firmware supply-chain/persistence risk on legitimately deployed industrial device-networking gateways from an established vendor.

Unauthenticated, network-triggerable memory overflow in Citrix NetScaler ADC/Gateway - an internet-facing enterprise access appliance with a history of mass exploitation (Citrix Bleed) and named threat actors already circling - makes this the single most urgent patch for any org running NetScaler at the edge.

Stored XSS in the widely deployed GitLab CE/EE merge-request diff viewer lets any authenticated user run JavaScript in other users' sessions, threatening source-code theft and account/CI compromise across the many development orgs that self-host GitLab, and a patch plus active-threat signals make prompt updating essential.

Unauthenticated remote OS command injection in Netcore NR289-GE routers has public exploit code and known-actor/malware activity, making these edge devices prime targets for Mirai-style botnet recruitment and network pivoting that SOCs should block and hunt for.

An authentication bypass giving unauthenticated attackers full control of Seetong T8108/T8116/T8232 IP cameras, with public exploit and active threat activity, is a classic mass-exploitation surveillance-device takeover risk feeding botnets and enabling internal-network footholds.

Unauthenticated OS command injection in the Netcore NBR200V2 web management interface has a public exploit and known-actor interest, so exposed units face immediate remote takeover and conscription into botnets - worth blocking and monitoring even though the install base is consumer-grade.