Critical Watch

Citrix NetScaler ADC/Gateway is one of the most heavily targeted enterprise edge appliances (see the ongoing 'Citrix Bleed' exploitation history), and this unauthenticated remote memory-overflow/DoS already has known-actor threat intelligence, so exposed appliances need patching immediately.

wolfSSL is embedded in a vast number of IoT, industrial, and networking products, and this Raw Public Key authentication bypass lets a malicious or on-path server defeat TLS/DTLS peer verification, enabling MITM against countless downstream devices.

A second wolfSSL flaw (trust-peer-cert clone acceptance) similarly breaks TLS peer authentication in the same ubiquitous embedded library, so security teams with wolfSSL-based firmware must inventory and update given the public POC.

Sylius is a widely used PHP/Symfony e-commerce platform, and this unauthenticated payment-claim flaw lets attackers inflate orders after a smaller payment is captured, directly causing financial fraud for online merchants (patch available).

WordPress powers a large share of the web, and this unauthenticated stored XSS in the commercial Download Manager Pro plugin-with public POC and known-actor interest-can be mass-exploited to hijack admin sessions across many sites.

Citrix NetScaler ADC/Gateway - a top-targeted enterprise VPN/load-balancer appliance with known threat-actor interest - has an unauthenticated remote memory-overflow flaw that can crash or destabilize internet-facing gateways, and a patch (14.1-73.37/13.1-64.23) is available now.

This NetScaler ADC/Gateway predictable-value weakness (CWE-342) lets unauthenticated remote attackers forecast future values from observed ones, undermining integrity and availability on the same heavily-exploited edge appliance that SOCs must prioritize patching.

The Ad Inserter WordPress plugin has 1M+ active installs, and this flaw lets a low-privilege Subscriber inject content the plugin executes as PHP (RCE) or serves unescaped, giving mass-exploitation potential across a huge WordPress footprint with a public POC and available patch (2.8.19).

This NetScaler ADC/Gateway feature-policy bypass lets unauthenticated attackers evade URL-based policy enforcement (e.g., WAF/access controls) on the same widely deployed Citrix appliance, weakening the security controls organizations rely on at their network edge.

The WordPress File Manager, FileOrganizer, and File Manager Pro plugins - collectively installed on a very large number of sites - contain an unauthenticated stored XSS that runs arbitrary JavaScript in a logged-in administrator's session, enabling account/site takeover with a public POC and patches available.

Critical (CVSS 9.3) unauthenticated account takeover in X-SpringBoot ≤6.0 with a public exploit-verification codes are returned in HTTP responses, letting remote attackers log in as any user by knowing their phone/email, a trivially weaponizable flaw in a widely-forked Spring Boot admin scaffold.

Broken authorization in phpIPAM's REST API (CVSS 8.6, public POC) lets any API-authenticated user dump all privileged/admin user records via id='admins'/'all', exposing credentials in a network/IPAM tool commonly deployed across enterprise and ISP environments.

Brocade SANnav before 3.0.1a writes extension-switch IPsec pre-shared keys in cleartext to system logs (CVSS 8.4, public POC), leaking SAN encryption keys to any log-reader in the datacenter storage-fabric management platforms used by large enterprises.

Unauthenticated single-request DoS in Rejetto HFS2 ≤2.4.0 (CVSS 8.7, public POC) drives a serving thread into an infinite busy loop, and HFS-internet-exposed by many small orgs and previously hit by KEV-listed exploitation-makes this an easy, reliable takedown.

Unauthenticated CSRF in the MCP Server for WordPress plugin (all versions <1.8.2, CVSS 8.8, public POC + patch) can create a brand-new administrator account when a logged-in admin is lured to a malicious page, giving full site takeover on the WordPress ecosystem.

Unauthenticated privilege escalation (CVSS 9.8, public POC) in a WooCommerce/WordPress OTP-notification plugin lets any anonymous visitor register an admin-level account, and WordPress plugins are one of the most widely exploited attack surfaces on the internet.

Command injection in Brocade SANnav (before 3.0.1a) with a public POC gives network-adjacent attackers arbitrary Fibre Channel switch CLI execution and container manipulation, directly threatening the SAN/storage fabrics that underpin enterprise data centers.

X-SpringBoot ≤6.0 ships a hardcoded master login code (172839) in its database seed, enabling unauthenticated remote attackers with a public POC to authenticate as any user - a trivial, reliable full account-takeover on every default deployment.

Unauthenticated blind SQL injection in ClipBucket v5 (before 5.5.3-#182) with a public POC and patch lets remote attackers dump user credentials and admin password hashes from an internet-facing video CMS.

Stored XSS in Snipe-IT (before 8.7.0) - a very widely deployed open-source IT asset-management platform - is exploitable via uploaded XML files, carries threat-intel activity plus a public POC, and a patch is available to close the account/session-hijack risk.

Rejetto HFS is a widely deployed HTTP file server with a documented history of mass exploitation, and this CVSS 10.0 unauthenticated arbitrary file read/write/delete flaw in HFS2 ≤2.4.0 (with public POC) gives remote attackers full filesystem compromise of the host.

lwIP is embedded in a vast range of IoT devices, routers, and firmware, so this unauthenticated adjacent-network double-free-already tied to known actors-creates a broad supply-chain exposure to device crashes and memory-corruption/RCE across countless products.

Notepad++ is one of the most ubiquitous Windows editors in enterprises, and this stack buffer overflow in its plugin loader can yield arbitrary code execution, making malicious-plugin or supply-chain attacks a real endpoint-compromise risk for developer and admin workstations.

MCP Atlassian is a rapidly adopted Model Context Protocol connector bridging AI agents to Confluence/Jira, and this unauthenticated SSRF (fixed in 0.22.0, with public POC and active threat interest) lets remote attackers pivot the server into internal networks and cloud metadata services.

Softaculous Virtualizor is a widely used VPS/cloud control panel across hosting providers, and this unauthenticated flaw that rewrites any tenant's account balance (public POC, patched in 3.2.9 Patch 9) directly threatens billing integrity and multi-tenant trust at scale.