Critical Watch

Unauthenticated RCE via arbitrary PHP upload in the Drag and Drop File Upload addon for Elementor Forms (WordPress) affects the massive Elementor ecosystem, and with a public exploit plus known-actor threat intel it is a prime target for opportunistic mass web-shell campaigns.

SAML assertion forgery (CWE-347) in HPE IceWall lets a low-privileged attacker impersonate any user across federated SSO, directly threatening enterprise identity infrastructure and enabling silent lateral access to every connected application.

Unauthenticated-nonce RCE in SPIP CMS (all versions before 4.4.18) exposes a widely deployed CMS used by many public-sector and media sites to full server takeover via cron-table injection, with a public exploit and patch already available for urgent triage.

PHP object injection RCE in FileRun before 2026.3.0 is backed by active known-actor/malware threat intel and endangers a common self-hosted enterprise file-sharing platform, letting attackers with DB write access pivot to full code execution on document stores.

Command-injection RCE in the OmniRoute AI gateway (≤3.8.49) via the custom-agent API is being actively exploited by known actors and matters because AI gateways sit in the sensitive path between apps and models, making container-level RCE a high-value foothold.

The miniOrange 2FA plugin is installed on a large number of WordPress sites, and this unauthenticated CVSS-10 flaw lets any visitor delete arbitrary wp_options entries - instantly breaking authentication, disabling security controls, or knocking the site offline - with a public exploit already available.

Open WebUI is one of the most widely deployed self-hosted LLM front-ends in enterprises, and this stored XSS (with reporting of known actors/malware) allows an authenticated user to run JavaScript at the app origin and fully take over other users' accounts.

FileRun is a popular self-hosted file-sharing/management platform, and this OS command injection - exploitable by any authenticated user with mere upload permission and flagged with active threat-intel - yields root-level code execution on the server via malicious filenames.

Netis NX10 routers are widely deployed internet-facing consumer/SMB devices, and this trivially exploitable unauthenticated flaw lets a remote attacker retrieve the admin password from the 'sysinfo' endpoint with no session, enabling full device takeover and network pivoting.

The Loops & Logic WordPress plugin exposes all user records - emails and role assignments - plus site configuration to any unauthenticated attacker across every version before 4.3.0, providing a ready-made reconnaissance and account-targeting primitive with a public exploit.

FFmpeg is embedded in a vast range of servers, media pipelines, and applications, so this crafted-media-file heap corruption with potential RCE (pre-8.1) represents enormous transitive exposure that most teams don't even realize they're running.

This authenticated-RCE in the FireBox WooCommerce Popup Builder plugin (≤3.1.10) is flagged with threat intel on known actors/malware, meaning WooCommerce store owners face active exploitation to run arbitrary PHP on their servers.

The ELEX WooCommerce Request a Quote plugin (before 2.4.1) has an unauthenticated SQL injection with a public PoC, letting anyone dump WordPress/WooCommerce databases (including customer data and hashes) with zero credentials across many e-commerce sites.

The out-of-bounds write in Samsung's Keymaster TrustZone trustlet threatens the cryptographic key security of a huge Android device fleet, and TEE compromise undermines device attestation and disk/key protections at scale.

The Quentn WP plugin (before 1.2.15) exposes an unauthenticated SQL injection with a public exploit, allowing credential-free extraction of arbitrary database contents from affected WordPress sites.