the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

1,546critical tracked/147new today/23known-exploited/0exploit available/1,546critical tracked/147new today/23known-exploited/0exploit available/1,546critical tracked/147new today/23known-exploited/0exploit available/1,546critical tracked/147new today/23known-exploited/0exploit available/

The feed (latest)

1,546 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2026-67174

Pivotick, a graph visualization library, has a critical DOM-based cross‑site scripting flaw that lets attackers inject malicious HTML or SVG into its user interface. The vulnerability arises when untrusted data is rendered as HTML or inserted as an icon without proper sanitization. A vendor patch replaces unsafe innerHTML usage with textContent and sanitizes SVG icons.

Critical· 9.2<1% likelyfix available

published 2d agodeletes in 29d

CVE-2026-66713

Apache Axis2/Java versions up to 2.0.0 contain a critical flaw that lets an attacker run arbitrary code by sending a crafted serialized Java object to the clustering channel when Tribes clustering is enabled. The vulnerability stems from unsafe deserialization of untrusted data. Upgrading to 2.0.1 removes the clustering feature and fixes the issue.

Critical· 9.81% likelyfix available

published 2d agodeletes in 29d

CVE-2026-51260

A bug in the ESP32-audioI2S library (version 3.4.5) causes an unsafe memory copy that can overflow the heap. The overflow can be triggered remotely and may crash the device or allow an attacker to run arbitrary code. The flaw exists in the AudioBuffer::writeSpace() function.

Critical· 9.4<1% likely

published 2d agodeletes in 44d

CVE-2026-51259

CVE-2026-51259 is a critical vulnerability (CVSS 9.8) affecting schreibfaul1 ESP32-audioI2S version 3.4.5. An unchecked unsigned integer overflow in buffer size calculation causes an undersized PSRAM buffer allocation, which can lead to heap out-of-bounds access, memory corruption, denial of service, and potential code execution during normal audio operations. No known exploitation or public exploit is reported, and no official fix is documented in the provided sources.

Critical· 9.8<1% likely

published 2d agodeletes in 44d

CVE-2026-51252

The vulnerability is a buffer overflow in the MP3Decoder::UnpackSFMPEG1 function of schreibfaul1's ESP32-audioI2S library version 3.4.5. It allows an attacker to send specially crafted MP3 metadata that overflows a buffer, potentially leading to arbitrary code execution or denial of service. The flaw is due to missing input validation.

Critical· 9.8<1% likely

published 2d agodeletes in 44d

CVE-2026-65880

A Joomla extension called Balbooa Forms is vulnerable to unauthenticated remote code execution. The flaw allows attackers to run arbitrary code by submitting a form that includes the signature field type. The vulnerability exists in all versions older than 2.4.3.

Critical· 10<1% likelyfix available

published 2d agodeletes in 28d

CVE-2026-16462

A critical vulnerability in PROCON-WEB SCADA allows attackers to run arbitrary SQL commands via the 'GetGridData' endpoint without authentication.

Critical· 9.3<1% likely

published 2d agodeletes in 43d

CVE-2026-11841

An attacker can read and write sensitive files on the device through the AppEngine Fileaccess over HTTP because the system does not enforce authentication. The exposed directories include device parameter files and the custom application directory, allowing attackers to change settings, passwords, or run arbitrary Lua code. This flaw can lead to serious compromise of the device.

Critical· 9.4<1% likely

published 2d agodeletes in 43d

CVE-2026-15014

The SMS Alert – SMS & OTP for WooCommerce plugin is vulnerable to an authentication bypass that lets attackers take over any WordPress account whose phone number is known. By completing an OTP verification on a phone they control and then submitting a registration with the victim’s phone number, an attacker can be logged in as that user. The flaw exists in all plugin versions up to 3.9.7.

Critical· 9.8<1% likely

published 2d agodeletes in 43d

CVE-2026-11756

The vulnerability allows an attacker to run arbitrary code on a system that runs the Station Launcher App in the 3DEXPERIENCE platform. It is triggered by deserializing untrusted data and does not require any user interaction or authentication. The flaw is present in releases from R2023x up to R2026x.

Critical· 10<1% likely

published 2d agodeletes in 43d

CVE-2026-14545

A flaw in the TrueBooker WordPress plugin lets anyone on the internet reset any user’s password without authentication. By using the front‑end password‑reset feature, an attacker can take over administrator accounts and control the entire site. The issue exists in all versions before 1.2.4.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 29d

CVE-2021-32088

Quest KACE Systems Deployment Appliance (SMA) 11.0.273 contains a critical flaw that lets attackers bypass API rate limiting by removing the kboxid cookie. This allows unlimited requests to the API, potentially leading to denial of service or brute‑force attacks. The vulnerability is rated CVSS 9.8.

Critical· 9.8<1% likely

published 3d agodeletes in 44d

CVE-2021-32086

CVE-2021-32086 is a critical vulnerability in Quest KACE Systems Deployment Appliance 11.0.273 where a hardcoded symmetric encryption key is used to protect secrets in MySQL databases. This key is not unique per installation, allowing attackers with access to the database or backups to decrypt secrets and potentially escalate privileges or access other systems.

Critical· 9.8<1% likely

published 3d agodeletes in 44d

CVE-2021-32084

A critical flaw in Quest KACE Systems Deployment Appliance 11.0.273 allows attackers who know valid credentials or API keys to access the appliance through unrestricted API endpoints, even if the web console is IP‑restricted. This can give full control over the environment.

Critical· 9.8<1% likely

published 3d agodeletes in 44d

CVE-2026-66824

A critical cross‑site scripting flaw exists in the capture tree visualization page of an application. The flaw allows an attacker to inject malicious code that runs in the browser of anyone viewing the affected page.

Critical· 9.2<1% likelyfix available

published 3d agodeletes in 28d

CVE-2026-64775

Apple Ipados +5 more

A critical memory initialization flaw in Apple’s operating systems can let an app cause the system to crash. The issue is fixed in recent OS releases. Users should update to the latest version to protect their devices.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 29d

CVE-2026-64774

Apple Ipados +4 more

This vulnerability is an integer overflow in Apple operating systems that could let a remote attacker crash applications or corrupt memory. It was fixed in recent OS releases. Users should update to the latest version.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 29d

CVE-2026-64772

Apple Ipados +4 more

A critical vulnerability (CVE‑2026‑64772) allows a remote attacker to write data beyond the intended memory bounds in Apple operating systems. This can cause applications to crash or corrupt memory, potentially leading to denial‑of‑service or more severe exploits. The flaw is fixed in newer releases of iOS, iPadOS, macOS, tvOS, and visionOS.

Critical· 9.8<1% likelyfix available

published 3d agodeletes in 29d