Critical Watch

Angular's Server-Side Rendering is deployed across a huge number of enterprise web apps, and this unauthenticated HttpTransferCache poisoning flaw-with a patch and active threat-actor interest-lets attackers serve malicious cached responses to legitimate users at scale.

OpenEMR is one of the most widely deployed open-source electronic health record systems in clinics worldwide, and this CVSS 9.4 chain gives an admin-level attacker PHP RCE as the web server, exposing large volumes of regulated patient data.

Flowise is a rapidly growing low-code LLM orchestration platform now common in AI deployments, and this patched flaw lets any API-key holder escape the NodeVM sandbox for root-level RCE, with known actors already weaponizing it.

The cluster of five GL.iNet GL-MT3000 command-injection CVEs with threat-intel signals indicates an active campaign, and this unauthenticated network-reachable RCE turns exposed routers into a foothold or botnet node with no credentials required.

Puwell IP cameras expose an undocumented DebugShell on TCP 34567 that grants unauthenticated root RCE, exactly the mass-exploitable IoT weakness that Mirai-class botnets sweep for, so any internet-facing units should be isolated immediately given no patch is noted.

Prototype pollution in axios-one of the most ubiquitous npm HTTP clients in existence-lets attackers silently reroute plaintext HTTP traffic through a proxy and steal Authorization headers and Basic-auth credentials, so nearly any Node.js service or app in the environment could be leaking secrets.

OpenEMR (through 8.2.0), a widely deployed open-source electronic health record system, has a public-exploit OAuth2 password-grant flaw that fully bypasses MFA for any account, exposing protected patient health data across healthcare organizations.

Unauthenticated SQL injection in the Link Library WordPress plugin (before 7.9.3) has public exploit code and known-actor interest, letting remote attackers dump the database of any of the many WordPress sites running this plugin-patch immediately.

The Super Store Finder WordPress plugin (through 7.8) allows unauthenticated remote SQL injection via an AJAX action with a public exploit, enabling full database extraction from e-commerce sites that use this common store-locator plugin.

A privilege-escalation flaw in the 'Import and export users and customers' WordPress plugin (before 2.4.2) lets a low-privilege user mint a full administrator and hijack existing admin accounts, turning a minor foothold into complete site takeover on a broadly installed plugin.

Thumbor is a widely deployed open-source image-processing service, and this unauthenticated SSRF bypass defeats its primary ALLOWED_SOURCES allowlist, letting attackers pivot to internal hosts and cloud metadata endpoints (e.g., 169.254.169.254) to steal credentials.

The miniOrange 2FA plugin protects a large number of WordPress sites, and a complete 2FA bypass lets any attacker who already has a stolen password fully authenticate as an administrator, negating the exact protection the plugin was installed to provide.

JS Help Desk's total absence of authorization on its front-end request dispatcher allows unauthenticated arbitrary file upload across all versions, a classic path to dropping a web shell and achieving remote code execution on the host.

REDAXO CMS RCE via an extension-blocklist bypass (shell.php.any.jpg) gives any backend user with media-upload rights full code execution, turning a low-privilege content account into a complete server compromise.

This CRITICAL (CVSS 9.8) flaw in the ShopMonitor.io plugin allows unauthenticated administrator account takeover by hijacking outgoing email (including password resets), and it carries active threat-intel signals indicating known actors are already leveraging it.

OpenCost before 1.121.0 exposes an unauthenticated GET /helmValues endpoint that leaks cloud provider secrets and allows admin auth bypass, putting the many Kubernetes clusters running this CNCF cost-monitoring tool at risk of full cloud credential theft.

An unauthenticated SQL injection in the widely-installed Online Scheduling and Appointment Booking WordPress plugin (before 27.8) lets attackers dump WordPress user password hashes, and with a public POC and WordPress's massive footprint this is prime mass-scanning bait.

A heap buffer over-read in MZ Automation's libiec61850 (before 1.6.2), one of the most widely embedded open-source IEC 61850 stacks in power-grid substations, lets an unauthenticated adjacent attacker crash MMS services across many OT/SCADA products that ship this library.

SSRF plus local file inclusion in Leantime 3.6.2 lets authenticated attackers on this popular self-hosted project-management platform read arbitrary server files and pivot internally, with a public exploit already available.

An SSRF filter bypass in the dssrf npm library (<=1.0.3) defeats is_url_safe() via a userinfo-prefixed URL, meaning any downstream application depending on it for SSRF protection is silently exposed-a supply-chain risk with a public POC.

An integer overflow leading to an unauthenticated remote out-of-bounds heap write in open62541 - one of the most widely embedded open-source OPC UA C libraries in industrial products - carries arbitrary-code-execution potential against a huge, hard-to-inventory fleet of exposed ICS servers.

This is the only CRITICAL (CVSS 9.0) with a public exploit - an unauthenticated PHP object injection in a WordPress plugin that chains to full remote code execution - making internet-facing WordPress hosts an immediate priority to identify and patch.

An unauthenticated remote DoS that crashes IEC 61850/MMS server processes with a single crafted TCP/102 connection affects all libiec61850 versions before 1.6.2, a library pervasive in power-grid and substation automation where process crashes have real operational-safety consequences (patch is available now).

A companion open62541 flaw lets an unauthenticated attacker read sensitive process memory from OPC UA servers, enabling credential/secret disclosure across the same broad industrial deployment base, so teams already assessing open62541 should treat it as part of the same patching sweep.

An unauthenticated stored XSS in the Frontend Admin by DynamiApps WordPress plugin - a plugin with a substantial install base - has a public POC and lets any visitor persistently inject script to hijack admin sessions, and a fixed version (3.29.9) is available to deploy immediately.