the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

1,541critical tracked/149new today/23known-exploited/0exploit available/1,541critical tracked/149new today/23known-exploited/0exploit available/1,541critical tracked/149new today/23known-exploited/0exploit available/1,541critical tracked/149new today/23known-exploited/0exploit available/

The feed (latest)

1,541 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2026-51992

ClickHouse Server versions up to 26.3.9.8 contain a SQL injection flaw that allows a remote attacker to execute arbitrary code by using the create dictionaries function. The flaw can be exploited without authentication or user interaction.

Critical· 9.1

published 18h agodeletes in 45d

CVE-2026-67192

Xlight FTP Server versions before 3.9.5 contain a critical stack buffer overflow that can be triggered by unauthenticated attackers sending specially crafted SSH packets. The flaw allows attackers to overwrite stack memory and potentially execute arbitrary code before authentication. Upgrading to version 3.9.5 or later resolves the issue.

Critical· 9.2fix available

published 19h agodeletes in 30d

CVE-2026-67191

Xlight FTP Server versions before 3.9.5 contain a heap buffer overflow that can be triggered by sending a specially crafted SSH client identification string. The flaw allows attackers to write beyond a heap buffer before authentication, potentially enabling arbitrary code execution. The vulnerability is critical because it can be exploited remotely without any credentials.

Critical· 9.3

published 19h agodeletes in 45d

CVE-2026-60113

The vulnerability is a missing authentication flaw in the Space Link Extension interface of the AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface. It allows attackers to access seven unprotected API routes without credentials, enabling them to start or stop DSN sessions, retrieve telemetry, and inject frames. The flaw is critical because it can be exploited remotely without authentication.

Critical· 9.3fix available

published 19h agodeletes in 30d

CVE-2026-60112

The AIT GUI before version 2.5.1 allows anyone on the network to create a session without authentication and then send arbitrary spacecraft commands. This flaw lets an attacker gain full control over the spacecraft’s command bus.

Critical· 9.3fix available

published 19h agodeletes in 30d

CVE-2026-54735

Prebid Server, an open‑source platform for real‑time ad auctions, had a critical flaw that let attackers trick the server into making requests to arbitrary internal URLs. The vulnerability was fixed in version 4.4.0. Users should update to that version or later.

Critical· 10fix available

published 19h agodeletes in 30d

CVE-2026-65888

A Joomla extension called Gridbox has a flaw that lets attackers log in as any user. The problem is in the socialLogin method and affects all versions older than 2.20.2. Updating the extension fixes the issue.

Critical· 10fix available

published 20h agodeletes in 30d

CVE-2026-65887

A Joomla extension called Gridbox, used in many websites, has a flaw that lets anyone reset any user’s password without authentication. The flaw exists in all versions older than 2.20.2. If exploited, an attacker could take over normal user accounts.

Critical· 10fix available

published 20h agodeletes in 30d

CVE-2026-65886

A security flaw in the Gridbox extension for Joomla allows unauthorized users to read sensitive files on the server. This vulnerability occurs because the photo viewer component does not properly restrict file access.

Critical· 9.2fix available

published 20h agodeletes in 30d

CVE-2026-9177

A critical flaw in Axway SecureTransport lets administrators inject and run arbitrary Java code when sending emails. The vulnerability is a server‑side template injection that can give an attacker full control of the host. It affects all versions before 5.5‑20260528.

Critical· 9.4fix available

published 21h agodeletes in 30d

CVE-2026-65890

A Joomla extension called Gridbox from balbooa.com has a serious SQL injection flaw that lets anyone run arbitrary database commands without logging in. The flaw exists in all versions before 2.20.2.

Critical· 9.2fix available

published 21h agodeletes in 30d

CVE-2026-65889

A Joomla extension from balbooa.com allows anyone to delete directories recursively without authentication. The flaw exists in versions earlier than 2.20.2. It can be exploited by attackers to remove site files and data.

Critical· 9.2

published 21h agodeletes in 45d

CVE-2026-65885

A Joomla extension called Gridbox from balbooa.com allows authenticated users to upload any file. If an attacker can create an account, they can use this flaw together with another vulnerability (CVE-2026-65884) to run code on the server. The flaw is serious because it requires only an authenticated user and can lead to full control of the site.

Critical· 9.4

published 22h agodeletes in 45d

CVE-2026-65884

A flaw in the Gridbox extension for Joomla lets anyone create an administrator account without logging in. The issue exists in versions before 2.20.2 and can be fixed by updating the extension.

Critical· 10fix available

published 22h agodeletes in 30d

CVE-2026-0667

This vulnerability allows attackers to exploit a flaw in the Modbus TCP protocol, potentially leading to arbitrary code execution, denial of service, and loss of confidentiality and integrity. It is rated critical due to its high impact and lack of mitigations.

Critical· 9.3

published 22h agodeletes in 45d

CVE-2026-65883

A Joomla extension called Aimy Captcha-Less Form Guard, versions 18.0 through 20.0, contains a flaw that lets attackers run arbitrary code on the server. By sending a specially crafted form field, a malicious user can inject PHP objects and execute commands. This could give an attacker full control of the affected website.

Critical· 10

published 1d agodeletes in 45d

CVE-2026-14900

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to remote code execution. Attackers can inject code via the orderDetails[*].originalValue field, which is passed to PHP eval() without proper sanitization. The vulnerability allows unauthenticated attackers to run arbitrary code on the server.

Critical· 9.8

published 1d agodeletes in 45d

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to a missing authorization flaw that lets attackers delete any post or page. The issue exists in all versions up to and including 3.8.0. It can be triggered by an unauthenticated user on any page that hosts a frontend submission form.

Critical· 9.1

published 1d agodeletes in 45d