Critical Watch

Netty is one of the most ubiquitous Java networking libraries (underpinning gRPC, Spring, Elasticsearch, and countless enterprise services), so this memory-leak DoS in its Redis codec - with a public PoC and threat-intel activity - exposes a huge, hard-to-inventory swath of backend infrastructure.

This CRITICAL (9.8) payment-bypass in the widely deployed WP Events Manager plugin has a public exploit and known-actor interest, letting any authenticated user obtain paid bookings for free - a direct financial-fraud risk on a large WordPress install base.

The WP Maps plugin flaw lets a mere Subscriber-level user chain path traversal into PHP local file inclusion for full site compromise, and with a public PoC it turns low-privilege WordPress accounts into full RCE across many sites.

This unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' plugin (with public exploit and known-actor activity) silently exposes all the gated content and account data those sites rely on the plugin to protect, defeating its entire purpose.

The MStore API broken-object-level-authorization bug lets any low-privileged WordPress user read every WooCommerce order and customer PII, and with a public PoC plus threat-intel signals it's a mass privacy/GDPR breach vector across e-commerce sites.

The Subscriptions for WooCommerce plugin lets any authenticated Shop Manager install and activate arbitrary plugins via an unprotected AJAX action, giving full remote code execution and site takeover across the enormous WooCommerce ecosystem.

MStore API is a very widely-installed WordPress plugin powering mobile storefronts, and this flaw lets an unauthenticated attacker who merely knows a victim's phone number forge a login token to fully take over their account.

The Newsletters WordPress plugin exposes an unauthenticated SSRF that lets remote attackers force the server to hit arbitrary internal URLs, a classic pivot into internal services and cloud metadata endpoints on a large install base.

The popular Content Views WordPress plugin allows even low-privilege Subscriber accounts to run SQL injection against the WordPress database, exposing credentials and all site data with a public exploit available.

Stripe Payment Forms by WP Full Pay lets any unauthenticated visitor arbitrarily lower or zero-out a Stripe payment amount before checkout, enabling direct, automatable financial fraud against merchants using the plugin.

Unauthenticated remote code execution in Nuxt's server island feature affects a hugely popular Vue/Nitro web framework across a wide version range, letting network attackers run arbitrary code in the server process of countless production sites.

A heap-use-after-free in Ruby's json gem native extension - a default, near-ubiquitous dependency in Rails and virtually every Ruby web service - lets any unauthenticated attacker crash the process with a crafted JSON payload, enabling trivial remote DoS at massive scale.

Unauthenticated PHP Object Injection in the widely installed Ajax Search Lite WordPress plugin gives remote attackers a serialized-data sink that can chain into RCE via common POP gadgets, threatening a large population of public-facing WordPress sites.

A CVSS 10.0 unauthenticated arbitrary file deletion flaw in the Custom Fields WordPress plugin lets anyone delete wp-config.php and other critical files, leading to full site takeover with no credentials required.

Unauthenticated SQL injection in the Creative Mail WordPress plugin allows remote attackers to dump the entire WordPress database - including user credentials and PII - without any login, and it carries active threat-actor interest.

Unauthenticated remote code execution (CVSS 9.5, public POC, patch available) in Flowise - one of the most widely deployed open-source LLM/agent-builder platforms - where a Unicode homoglyph bypass escapes the Pyodide sandbox, exposing thousands of internet-facing instances to full server takeover.

Unauthenticated SQL injection in the WPCargo Track & Trace WordPress plugin (CVSS 9.1, WPScan-reported with public exploit) lets anonymous attackers dump the entire WordPress database, and WordPress plugin flaws like this are routinely mass-scanned and weaponized within days.

Account takeover in the popular 'OTP Login With Phone Number' WordPress plugin (CVSS 9.1, public POC) allows unauthenticated attackers to brute-force non-expiring, un-rate-limited login codes to seize any account including administrators, giving a direct path to full site compromise.

Stored XSS in Open WebUI 0.10.0-0.10.2 (CVSS 8.7, public POC), the most widely used self-hosted interface for local LLMs, lets any authenticated user inject persistent script via a crafted KaTeX math block, enabling session hijacking across all users of shared internal AI deployments.

Unauthenticated single-request denial of service in Milvus ≤2.6.22/3.0.0 (CVSS 8.7, public POC), a leading vector database underpinning many production RAG and AI-search pipelines, lets any attacker with access to port 9091 instantly crash core service components and take down dependent applications.

The Simple Membership plugin is installed on a very large number of WordPress sites, and this unauthenticated flaw lets attackers take over the primary administrator account, making it the highest-reach mass-exploitation risk in today's set.

The Webinfos WordPress plugin has an unauthenticated arbitrary file upload allowing any anonymous attacker to drop a PHP webshell, and it carries active threat-actor/malware intelligence indicating real-world exploitation for full site compromise.

ChamaWP's unauthenticated password-reset flaw enables complete admin account takeover of WordPress sites, is tied to known actors/malware, and has a patch available, so defenders must update immediately to close an actively targeted takeover vector.

GL.iNet GL-MT3000 routers are widely deployed for remote/VPN access and this unauthenticated command-injection (one of several in the same firmware) gives internet-reachable attackers root-level OS command execution, with threat intel confirming active abuse.

Puwell IP cameras can be fully taken over by unauthenticated attackers over the network, and internet-exposed cameras with active-actor intelligence are prime targets for Mirai-style botnet recruitment and network pivoting.