Critical Watch

GitLab CE/EE is ubiquitous in enterprise DevOps pipelines, and this CVSS 9.9 flaw lets an authenticated user achieve arbitrary code execution on the GitLab server via a crafted CI/CD regex, threatening the crown-jewel source code and build infrastructure of countless organizations (public POC, patch available).

Hard-coded credentials in HPE's Analytics and Location Engine give unauthenticated remote attackers direct admin and OS-level access, and with public exploit code plus known-actor interest this enterprise HPE/Aruba networking product is an easy remote foothold that demands immediate credential rotation or isolation.

The lwIP TCP/IP stack is embedded in a huge population of IoT and firmware devices, so this CVSS 9.3 out-of-bounds write in its MQTT client - where a malicious or spoofed broker can corrupt memory and gain code execution, and known actors are already tracking it - poses broad, hard-to-patch supply-chain risk across embedded fleets.

ManageEngine OpManager and Firewall Analyzer are widely deployed for enterprise network/security monitoring and are a repeat target of attackers, and this authenticated SQL injection (public POC, patch out) hands a low-privileged user full database access on a system that holds sensitive infrastructure data.

Softaculous Virtualizor is a common VPS/hosting control panel, and this unauthenticated PHP object-injection RCE lets remote attackers run commands as root, meaning one exploited panel (public POC, patch available) can compromise every hosted virtual machine beneath it.

Unauthenticated RCE in Softaculous Virtualizor (before 3.2.9 Patch 9), a VPS management panel deployed across many hosting providers, gives attackers root on the host AND every managed VPS with a public exploit already available - a single flaw that mass-compromises entire hosting fleets.

Unauthenticated stored XSS in the Ninja Forms WordPress plugin (3.15.3), installed on well over a million sites, lets any anonymous visitor plant script that fires in the admin's browser, and it carries public-exploit plus known-actor threat intel - a high-volume path to admin/session takeover across WordPress.

Authenticated code execution via unsafe deserialization in the widely-deployed Forminator Forms WordPress plugin (before 1.57.2.1) turns a forms-management user into full RCE on the web server, with public exploit and active threat-actor interest making patching urgent.

A crafted checkpoint image in CRI-O 1.34+ (and Red Hat OpenShift 4.17+) lets an authenticated Kubernetes user escalate a restored container's privileges, threatening cluster isolation on enterprise container platforms where any pod-create permission becomes a breakout vector.

Unauthenticated root RCE in D-Link DAP-1360 firmware 6.14 and earlier, reachable over the network with a public exploit and known-actor/malware activity, is prime botnet-recruitment fodder for the large installed base of EOL D-Link devices.

Telegram Desktop before 6.9.4 is deployed on millions of endpoints, and this patched HTML-export XSS turns any attacker-controlled inline-button caption into script that runs when a user opens an exported chat, making it a broadly relevant client-side risk across a typical workforce.

The Botiga Pro WordPress plugin (before 1.6.5) has an unauthenticated missing-authorization REST route (CVSS 9.8, public exploit) that lets any remote attacker rewrite site options and plant persistent front-end scripts - exactly the WordPress mass-exploitation pattern SOCs see scanned within days of disclosure.

The Web to Print Online Designer plugin (1.7.0-2.15.0) permits fully unauthenticated arbitrary file upload after leaking the protecting token, giving any visitor a direct path to webshell/RCE on the WordPress host - a high-value initial-access foothold with a working public exploit.

The D-Link DIR-868L pre-authentication stack overflow in /webfa_authentication.cgi (CVSS 9.3, public exploit) enables remote code execution on a very common home/SOHO router class that is a perennial target for botnet recruitment and network pivoting.

The Netcore NBR200V2 firmware-upgrade command injection carries a known-actor/malware threat-intel signal, indicating routers are being actively weaponized in the wild, so any org with these edge devices faces real ongoing compromise risk rather than a theoretical one.

The Welcomizer WordPress plugin (≤2.8.1) allows any Subscriber-level user to execute arbitrary PHP via the twiz_ajax_callback action, and with open registration common on WP sites this near-unauthenticated RCE gives full server takeover - backed by a public POC and active-threat intel.

VikRentItems (Vik/E4J family, widely deployed for rental/booking sites) has an unauthenticated SQL injection that lets remote attackers dump user credentials and booking records directly, with a public exploit and a patch already available for urgent updating.

Price Drop Alert for WooCommerce (≤1.1) exposes an unauthenticated AJAX SQL injection reachable by any visitor, threatening the large WooCommerce e-commerce ecosystem with database exfiltration of customer and order data - public POC plus known-actor threat intel.

iGMS Direct Booking (all versions before 2.0) lets any unauthenticated attacker inject persistent JavaScript into widget settings that executes in admin/visitor browsers, enabling session hijacking and site takeover - public POC, threat intel, and a patch available now.

VikBooking Hotel Booking Engine & PMS (<1.8.15) permits unauthenticated visitors to upload unrestricted files through the live-chat feature that render as stored XSS, exposing hotel/PMS operators to admin account compromise - public POC, active-threat signals, and a fix released.

Ultimate Member is one of the most widely deployed WordPress membership plugins (hundreds of thousands of sites), and this unauthenticated stored XSS (PR:N, public POC) lets an attacker self-register and plant JavaScript that runs in an administrator's session, enabling full site takeover across a huge install base.

The TOTOLINK A3002MU router has an unauthenticated remote stack-based buffer overflow (formWlWds) with a public POC, and TOTOLINK consumer routers are a routine target for Mirai-style botnets, making mass exploitation for RCE and device conscription a realistic near-term threat.

The Login with QR WordPress plugin has a CVSS 9.8 unauthenticated authentication bypass with a public exploit that lets anyone log in as any administrator, giving instant full control of every affected site with no credentials.

AF Companion for WordPress allows an authenticated low-privilege 'store-management' user to upload arbitrary PHP via an unrestricted import feature (CVSS 9.1, public POC), yielding server-side remote code execution on the hosting webserver - patch is available and should be applied immediately.

The Moxa TN-4500B industrial Ethernet switches have a pre-authentication DoS via an over-long web-login username (public POC), which matters to OT/ICS operators because a remote unauthenticated attacker can knock critical rail/transport network switches offline.