Critical Watch

Chatwoot is a widely self-hosted open-source customer engagement platform, and this unauthenticated ActiveStorage flaw (CWE-306) lets remote attackers abuse direct-uploads across tenants with a public exploit already available, so any internet-facing instance should be patched to 4.16.0 immediately.

Autel MaxiCharger EV charging stations are deployed across commercial and public charging infrastructure, and this critical (CVSS 9.5) OS command injection via the OCPP diagnostics URL gives a malicious or compromised backend full command execution on the charger, a serious OT/physical-safety risk with no firmware fix past V1.03.51.

Microweber is a broadly deployed PHP CMS, and this unauthenticated directory-traversal file read in ServeStaticFileContoller (CVSS 8.7, public exploit) lets remote attackers pull config and credential files from any exposed site, enabling rapid follow-on compromise.

D-Link DNS-320 NAS devices remain in wide use despite being end-of-life, and this unauthenticated arbitrary file upload to uploadify.php is exactly the class of flaw that IoT botnets mass-scan and weaponize, with no vendor patch coming for the affected firmware.

The Praison AI SEO WordPress plugin sits in the massively targeted WordPress ecosystem, and this unauthenticated broken-access-control bug (public exploit plus known-actor threat intel) lets attackers tamper with published post permalinks and plugin data, so admins should update to 5.0.7 before automated campaigns hit.

Unauthenticated OS command injection (CVSS 10.0, public exploit) in Autel MaxiCharger EV stations lets any remote attacker run arbitrary commands via the /test endpoint 'url' parameter, giving full takeover of internet-exposed charging infrastructure with no credentials required.

Hard-coded backdoor accounts (CVSS 10.0, public exploit) in Autel MaxiCharger EV stations hand remote attackers administrative control of the web management interface, and because the credentials are baked into firmware there is no configuration change that mitigates it until patched.

Unauthenticated SQL injection (threat-intel with known actors) in the bpost Shipping WooCommerce plugin lets attackers extract database contents during order submission on a huge base of WordPress e-commerce sites, exposing customer and credential data.

An unauthenticated file-upload flaw in the widely-installed 'Product Addons and Product Options' WordPress plugin lets attackers plant a stored malicious SVG for persistent XSS, and it is already tied to known actors/malware, making it a fast-moving mass-exploitation risk.

An OTP brute-force authentication bypass (known actors/malware) in the 'Social Login, Passkeys, Magic Link & Email OTP' WordPress plugin lets an unauthenticated attacker who knows a user's email log in as that account, directly undermining passwordless auth on many sites.

Unauthenticated attackers can gain root-level remote code execution on Autel MaxiCharger EV charging stations via a crafted request to a service on TCP 9002, turning publicly-networked EV charging infrastructure into fully compromised hosts with a public exploit already available.

The All-in-One WP Migration and Backup plugin has millions of active installs, and this unauthenticated path traversal lets network attackers write log files to arbitrary filesystem locations, giving a massive WordPress fleet an immediate, remotely-exploitable exposure.

Free Builder for Elementor is deployed across the huge Elementor WordPress ecosystem, and this unauthenticated stored XSS (with known-actor threat intel) lets attackers plant persistent payloads that execute in the admin dashboard to hijack administrator sessions.

SlimStat Analytics is a widely-used WordPress analytics plugin, and this unauthenticated stored XSS fires when an administrator opens the analytics reports, enabling admin-session takeover - and it is backed by active threat-actor intelligence.

The Bit Form WordPress plugin's unauthenticated arbitrary file read lets external attackers exfiltrate sensitive server files like wp-config.php (database credentials and secret keys), a credential-theft primitive already tied to known actors and a public exploit.