the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

1,681critical tracked/48new today/31known-exploited/0exploit available/1,681critical tracked/48new today/31known-exploited/0exploit available/1,681critical tracked/48new today/31known-exploited/0exploit available/1,681critical tracked/48new today/31known-exploited/0exploit available/

The feed (latest)

1,681 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

361

CVE-2026-63359

The Appriss Insights (Equifax) VINE application lets an unauthenticated attacker send a crafted request that bypasses the login page. This allows the attacker to read other users’ credentials, take over accounts, access sensitive personal data, and dump the database.

Critical· 9.3<1% likely

published 9d agodeletes in 37d

362

CVE-2026-47670

DbGate database manager versions 7.1.8 and earlier allow authenticated users to run arbitrary operating‑system commands as root. The flaw is triggered by an unsanitized functionName parameter in the /runners/load-reader endpoint. A patch is available in version 7.1.9.

Critical· 9.42% likelyfix available

published 9d agodeletes in 22d

363

CVE-2026-47669

DbGate database manager versions 7.1.8 and earlier allow an attacker to extract a malicious ZIP file that writes files anywhere on the host system. The flaw is caused by missing path validation in the unzipDirectory function. In the default Docker deployment, the application runs as root and accepts unauthenticated login, so any nearby attacker can exploit it.

Critical· 9.3<1% likelyfix available

published 9d agodeletes in 22d

364

CVE-2026-6516

A critical vulnerability allows attackers to run arbitrary code on Zohocorp ManageEngine ADAudit Plus servers without authentication. The flaw lies in the agent API and can be exploited remotely. It affects all versions prior to 8606.

Critical· 105% likely

published 9d agodeletes in 37d

365

CVE-2026-65701

A path‑traversal flaw in SoftVC VITS’s full‑song inference server lets anyone send a POST request to /wav2wav and read or write any file on the host. By supplying a crafted audio_path value, an attacker can exfiltrate sensitive data or overwrite files on the server.

Critical· 9.3<1% likely

published 9d agodeletes in 37d

366

CVE-2026-65700

h2oGPT versions up to 0.2.1 have a path‑traversal flaw in the OpenAI‑compatible files API. By sending traversal sequences in the bearer token, an unauthenticated attacker can read, write, or delete any file the server can access. This can lead to remote code execution if the attacker writes malicious code to startup hooks or other application files.

Critical· 9.31% likely

published 9d agodeletes in 37d

367

CVE-2026-47752

Tugtainer, a self‑hosted tool that automates Docker container updates, has a critical flaw in its notification template feature. Versions before 1.30.2 render user‑supplied templates with an unsandboxed Jinja2 environment, letting any authenticated user run arbitrary OS commands as root inside the container. The issue is fixed in Tugtainer 1.30.2.

Critical· 9.9<1% likelyfix available

published 9d agodeletes in 22d

368

CVE-2026-47668

DbGate, a cross‑platform database manager, has a critical flaw that lets attackers run arbitrary code on the server by sending a specially crafted JSON script. The vulnerability exists in versions 7.1.8 and earlier and is fixed in 7.1.9. It can be exploited remotely without authentication.

Critical· 104% likelyfix available

published 9d agodeletes in 22d

369

CVE-2026-65761

A Joomla extension called Easy Store (versions 1.0.0‑2.0.1) contains an unauthenticated SQL injection flaw. Attackers can manipulate order parameters to read the entire database, including user credentials and session data. The vulnerability is critical because it can be exploited without authentication.

Critical· 9.3<1% likely

published 9d agodeletes in 37d

370

CVE-2026-65760

A Joomla extension called Easy Store (versions 1.0.0 to 2.0.1) can expose order and customer details to any logged‑in user because it lacks proper access checks.

Critical· 9.2<1% likely

published 9d agodeletes in 37d

371

CVE-2026-15617

Logto does not normalize email and identifier strings when performing principal lookups, which allows attackers to use case or Unicode variations to create colliding identities. This flaw can lead to unauthorized access to accounts and is rated critical with a CVSS base score of 9.1. No known exploitation or public exploit is reported, and the provided data does not list any affected products.

Critical· 9.1<1% likely

published 9d agodeletes in 41d

372

CVE-2026-15616

Logto does not enforce locally configured multi‑factor authentication (MFA) during single sign‑on (SSO) authentication. This flaw lets attackers bypass the second‑factor requirement and gain unauthorized access to user accounts. The vulnerability is critical because it can be exploited remotely without any user interaction.

Critical· 9.1<1% likely

published 9d agodeletes in 41d

373

CVE-2026-15612

Logto, an OpenID Connect implementation, has a flaw that lets attackers bypass nonce validation when the nonce claim is missing from the ID token. This allows replay of authentication tokens, effectively breaking session binding. The issue is rated critical due to its high impact on confidentiality and integrity.

Critical· 9.1<1% likely

published 9d agodeletes in 41d

374

CVE-2026-15611

Logto’s SSO account‑linking feature does not verify the email address of the identity provider. This allows an attacker to create a fake identity at a permissive IdP using a victim’s email and then link that identity to the victim’s Logto account, giving the attacker unauthorized access. The flaw is critical because it can compromise any user account without authentication.

Critical· 9.1<1% likely

published 9d agodeletes in 41d

375

CVE-2026-65689

Syncfusion Standalone Report Designer

Bold Reports Standalone Report Designer versions before 14.1.12 contain a path‑traversal flaw that lets attackers read any file on the server. The weakness is in the DataHub module and can expose credentials, giving attackers full control of the application. It is critical because it requires no authentication and can be exploited remotely.

Critical· 9.3<1% likelyfix available

published 9d agodeletes in 23d

376

CVE-2026-65688

Syncfusion Standalone Report Designer

Bold Reports Standalone Report Designer versions before 14.1.12 have a path‑traversal flaw in their font processing that lets attackers read any file on the server. The bug is limited to the DataHub module added in Bold Reports 6.3, so earlier releases are safe.

Critical· 9.3<1% likely

published 9d agodeletes in 37d

377

CVE-2026-65687

Syncfusion Standalone Report Designer

Bold Reports Standalone Report Designer versions before 14.1.12 contain a path‑traversal flaw in SVG processing that lets attackers read any file on the server. The flaw can expose sensitive data, including credentials, and give attackers full control of the application. It affects the DataHub module introduced in Bold Reports 6.3.

Critical· 9.3<1% likelyfix available

published 9d agodeletes in 23d

378

CVE-2026-65907

A critical flaw in JetBrains TeamCity allows attackers to run arbitrary code on the server by manipulating Git VCS roots. The vulnerability exists in versions before 2026.1.2 and 2025.11.6. It can be fixed by upgrading to a newer release.

Critical· 9.1<1% likelyfix available

published 9d agodeletes in 22d