the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

2,506critical tracked/82new today/39known-exploited/1exploit available/2,506critical tracked/82new today/39known-exploited/1exploit available/2,506critical tracked/82new today/39known-exploited/1exploit available/2,506critical tracked/82new today/39known-exploited/1exploit available/

Spiking now

what’s blowing up

CVE-2023-35078Critical· 9.8

CVE-2023-35078 is a critical authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that lets unauthenticated attackers access restricted functions or data. It has a CVSS score of 9.8 and is known exploitation. CISA advises applying vendor-provided mitigations or discontinuing use of the product if mitigations are not available.

added to CISA KEV
100% likely to be exploited

CVE-2025-53770Critical· 9.8

Microsoft SharePoint Server is vulnerable to a critical deserialization flaw that lets attackers run arbitrary code over the network. The flaw affects on‑premises SharePoint Server 2016 and 2019, and any public‑facing instances that are no longer supported. Microsoft is testing a fix, but users should apply the mitigations outlined by CISA and disconnect unsupported servers.

added to CISA KEV
100% likely to be exploited

CVE-2024-23692Critical· 9.8

Rejetto HTTP File Server up to version 2.3m contains a critical template injection flaw that lets attackers run arbitrary commands on the server. The vulnerability is remote, requires no authentication or user interaction, and is no longer supported by the vendor.

added to CISA KEV
99% likely to be exploited

The feed (latest)

2,506 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2026-90562

LangBot versions before 4.10.11 generate password recovery keys with only 24 bits of entropy and expose an unauthenticated reset‑password endpoint without rate limiting. This allows attackers who know the administrator’s email to brute‑force the recovery key and reset the admin password. The result is full administrative access to the system.

Critical· 9.2

published 5h agodeletes in 45d

CVE-2026-90561

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 have a stored cross‑site scripting flaw in the content manager’s WYSIWYG preview component. The component fails to strip script tags from rich‑text fields, allowing an Author‑role user to embed malicious scripts that run when the preview pane is expanded. This can lead to account takeover by privileged users such as Editors or Super Admins.

Critical· 9.3

published 5h agodeletes in 45d

CVE-2026-90647

ASE/Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 for Windows have a flaw that lets a network attacker bypass TLS certificate checks in the IEC 60870-5-104 client. This flaw can be used to intercept or alter protected communications. The issue is critical because it undermines the security of the entire communication channel.

Critical· 9.1

published 17h agodeletes in 45d

CVE-2026-90558

sngrep 1.8.4 contains a stack buffer overflow in its SIP header formatting routines. Attackers can send SIP packets with oversized Call-ID or other header fields to overflow the stack, causing crashes or arbitrary code execution. The flaw is critical because it can be triggered remotely without authentication or user interaction.

Critical· 9.3

published 22h agodeletes in 45d

CVE-2026-78159

The Events Calendar plugin for WordPress is vulnerable to remote code execution in all versions up to and including 6.17.3. An attacker can inject malicious code by submitting a specially crafted comment that contains a wp:legacy-widget block, which is processed when the event page is rendered. This flaw allows unauthenticated attackers to run arbitrary code on the server.

Critical· 9.8<1% likely

published 1d agodeletes in 44d

CVE-2026-78006

The Events Calendar plugin for WordPress is vulnerable to remote code execution in all versions up to 6.17.4. The flaw lies in the is_safe_widget_instance function, which can be bypassed to inject code. Unauthenticated attackers can run arbitrary code if comments are enabled on events.

Critical· 9.8<1% likely

published 1d agodeletes in 44d

CVE-2026-85681

The WP Component WordPress plugin up to version 2.2.4 allows unauthenticated users to overwrite any site option because it lacks capability or nonce checks. This can lead to a full site takeover, including enabling registration with administrator privileges. The vulnerability is critical with a CVSS score of 9.8.

Critical· 9.8<1% likely

published 1d agodeletes in 45d

CVE-2026-84171

The piclect WordPress plugin version 1.0 lets anyone upload files without checking their type or name, allowing attackers to place malicious files on the server. This can lead to arbitrary code execution and full compromise of the site. The vulnerability is rated critical.

Critical· 9.8<1% likely

published 1d agodeletes in 45d

CVE-2026-82845

The Masteriyo LMS WordPress plugin before version 3.4.1 can deserialize user‑supplied data, allowing attackers to inject PHP objects that can write files or execute code on the server. This flaw can be triggered even by users with minimal privileges.

Critical· 9.9<1% likelyfix available

published 1d agodeletes in 30d

CVE-2026-81402

The DS Ad Rotator WordPress plugin up to version 0.8 has a serious flaw that lets anyone upload any file, including PHP scripts, to the site without permission. This can let attackers run code on the server.

Critical· 9.8<1% likely

published 1d agodeletes in 45d

CVE-2026-77006

The WebTotem Backups WordPress plugin (up to version 1.0.1) fails to validate file paths, ignore user permissions, and bypass CSRF checks, allowing any logged‑in user to delete arbitrary files on the server. This flaw can lead to a complete takeover of the site.

Critical· 9.6<1% likely

published 1d agodeletes in 45d

CVE-2026-77005

This critical vulnerability (CVE-2026-77005) affects the CODE MONKEYS WordPress plugin (version 1.0.1 and earlier) because it fails to validate user-supplied file paths before deletion and does not properly verify user permissions. Any authenticated user—including low-privilege accounts like subscribers—can exploit this flaw to delete arbitrary files on the server, potentially resulting in full site compromise.

Critical· 9.6<1% likely

published 1d agodeletes in 45d

CVE-2026-75800

The Frontegg SAML SSO WordPress plugin up to version 1.0.1 does not verify the signature or issuer of SAML responses, allowing attackers to log in as any user, including administrators, and create arbitrary accounts. This flaw lets unauthenticated users gain full control of the site. The vulnerability is critical with a CVSS score of 9.8.

Critical· 9.8<1% likely

published 1d agodeletes in 45d

CVE-2026-87719

GitLab Enterprise Edition had a flaw that let an authenticated user with Duo Chat access retrieve sensitive configuration data and credentials via a crafted GraphQL request. The bug could be triggered without user interaction and could compromise confidentiality, integrity, and availability. The issue has been fixed in newer releases.

Critical· 9.9<1% likelyfix available

published 2d agodeletes in 29d

CVE-2026-85706

GitLab had a critical flaw that let unauthenticated users read any file on the server. The issue was fixed in certain versions. Users should upgrade to the patched releases.

Critical· 101% likelyexploitedfix available

published 2d agodeletes in 29d

CVE-2026-90456

A bundled inventory‑management component ships with an example configuration file that contains a fixed, publicly known administrative password. If a deployment copies this file into active use without running the setup routine that regenerates credentials, the component’s admin interface becomes accessible to anyone who knows the default password.

Critical· 9.2<1% likely

published 2d agodeletes in 44d

CVE-2026-89713

A race condition in the Linux NFS server can let an attacker truncate append‑only files, potentially causing data loss or corruption. The flaw occurs when a client changes file size without proper permission checks, allowing a concurrent append to bypass security checks. The issue has been fixed in the kernel.

Critical· 9.1<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89712

A critical bug in the Linux kernel’s NFS server could let an attacker trigger a use‑after‑free, potentially enabling arbitrary code execution. The flaw occurs when the kernel walks a list of source mounts while releasing a lock, allowing a concurrent thread to free an item that the walk still references. The issue has been fixed in a kernel patch.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d