Critical Watch

GitLab CE/EE is deployed across a huge number of organizations, and this flaw lets a low-privileged Developer-role user reach unauthorized internal information across nearly all versions, making it a broad, immediately patchable exposure for most engineering teams.

The kube-logging Logging operator (Fluentd) is common in Kubernetes clusters, and this CVSS 9.9 config-injection flaw lets a namespace-scoped tenant break out to remote code execution in shared logging infrastructure-a serious multi-tenant cluster compromise vector with public exploit and known-actor interest.

swagger-typescript-api is widely pulled into JavaScript/TypeScript build pipelines, so this supply-chain flaw-where a malicious OpenAPI spec executes attacker code at module load in any developer or CI system that generates a client-can compromise developer machines and build servers at scale.

Zitadel is a growing enterprise identity platform, and this authorization flaw lets any authenticated user retrieve their own plaintext email/phone verification codes and self-verify contact details they don't control, undermining account-recovery and trust flows that gate access to downstream systems.

The MCP Ruby SDK underpins increasingly deployed AI/agent tooling, and this session-hijacking flaw lets an attacker holding a valid session ID execute tools/call requests in a victim's session, exposing agent integrations to unauthorized tool execution with a public exploit available.

GitLab CE/EE is a ubiquitous DevOps platform, and this actively-exploited flaw lets any authenticated user tamper with another user's CI/CD pipeline configuration-a direct path to poisoning builds and compromising the software supply chain across a huge install base.

The Streamit WordPress theme has an unauthenticated remote code execution bug (CVSS 9.8) with a public exploit and known threat-actor activity, giving attackers full server takeover on any of the many WordPress sites running it.

The OAuth2 Ruby gem (ruby-oauth/oauth2) is a widely-embedded authentication dependency, and this bearer-token leak can expose credentials that grant attackers access to protected APIs and user accounts across countless Ruby applications.

The WP Media Folder Addon plugin (all versions through 4.1.6) lets unauthenticated attackers read local files and pivot via SSRF, exposing secrets and internal services on many WordPress deployments with a public exploit already circulating.

swagger-typescript-api is a popular npm code generator, and this code-injection flaw means a malicious OpenAPI spec can execute arbitrary code in developer/CI environments that consume it-a realistic supply-chain compromise vector for teams auto-generating API clients.

Unauthenticated attackers can register as administrators on WordPress sites using the MemberGlut plugin, leading to complete site takeover; actively exploited with public exploit code available.

Unauthenticated password reset allows account takeover in the TrueBooker WordPress plugin, enabling full site compromise; active exploitation observed with public PoC.

Remote code execution in FacturaONE for WooCommerce lets unauthenticated attackers write arbitrary files and take over e-commerce servers; actively exploited with public exploit available.

Hardcoded credentials in Realtyna Organic IDX and WPL Real Estate plugins allow unauthenticated file upload and remote code execution on thousands of real estate websites.

Unauthenticated access to all REST API routes in BookingPress Appointment Booking Pro exposes sensitive customer data and allows modification of bookings; widely deployed and patch available.

MainWP Child plugin on WordPress allows unauthenticated account hijacking, including administrator accounts, with known active exploitation, putting all child sites managed by MainWP at immediate risk of full compromise.

The Custom Fields Account Registration for WooCommerce plugin allows any unauthenticated user to elevate to administrator during sign-up, enabling complete site takeover on WooCommerce stores with open registration and active exploitation reported.

The 微信二维码登陆 (WeChat QR login) WordPress plugin contains an unauthenticated authentication bypass to any user, including admins, with publicly available exploit code and active threat actor use, endangering WordPress sites using this popular login method.

Fluent Forms Pro Add On for WordPress has an authenticated PHP object injection exploitable by subscribers that can lead to remote code execution, affecting many sites that allow user registration, with confirmed active exploitation.

Printcart Designer for WooCommerce permits unauthenticated server-side request forgery and local file read, allowing attackers to exfiltrate sensitive cloud metadata and internal files from e-commerce sites with known active attacks.

Redis RCE via malicious RESTORE command allows authenticated attackers to execute code on widely-used in-memory data stores, enabling data theft or lateral movement.

sysPass password manager missing authorization permits API token holders to overwrite passwords and delete accounts, compromising entire credential vaults with public exploit available.

CAFEHAUS API for WordPress allows unauthenticated password reset on any account via missing authorization, leading to complete site takeover for any affected WordPress installation.

Paid Membership Plugin for WordPress enables unauthenticated registration with elevated roles, allowing attackers to gain Editor/Author access and compromise websites.

NLTK local code injection affects millions of Python environments used for research and data science, potentially enabling code execution if an attacker can trigger the collocations module.