the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

2,497critical tracked/74new today/39known-exploited/1exploit available/2,497critical tracked/74new today/39known-exploited/1exploit available/2,497critical tracked/74new today/39known-exploited/1exploit available/2,497critical tracked/74new today/39known-exploited/1exploit available/

The feed (latest)

2,497 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2026-62103

A critical vulnerability allows attackers to inject PHP objects into the Everest Forms plugin without authentication. This flaw can lead to arbitrary code execution and compromise the entire site. The issue affects all versions up to and including 3.6.0.

Critical· 9.8<1% likely

published 2d agodeletes in 44d

CVE-2026-54072

Authorizer is an open‑source authentication and authorization server. Before version 2.2.1, its /authorize endpoint accepted any redirect_uri, allowing attackers to receive access, ID, and refresh tokens via a malicious redirect. The issue is fixed in v2.2.1 and later.

Critical· 9.3<1% likelyfix available

published 2d agodeletes in 29d

CVE-2026-82617

Apache OpenNLP’s built‑in email and URL regex patterns can be exploited with crafted text to trigger catastrophic backtracking or stack overflows. This causes the application to consume excessive CPU or crash a thread, effectively denying service. The issue is present in OpenNLP versions 2.0.0‑2.5.11 and 3.0.0‑M1‑M5.

Critical· 10<1% likelyfix available

published 2d agodeletes in 29d

CVE-2026-72710

SPIP before version 4.4.18 is vulnerable to remote code execution via the editer_objet action. Attackers can inject PHP code that will run when the cron job queue processes. The flaw allows arbitrary code execution on the server.

Critical· 9.3<1% likelyfix available

published 2d agodeletes in 28d

CVE-2026-72709

SPIP versions before 4.4.18 have a missing authorization check that lets anyone who can guess a valid HMAC‑SHA256 nonce reset any user’s password. Because the check is missing, attackers can take over any account, including the administrator, without needing to log in. The flaw is easy to exploit over HTTP.

Critical· 9.3<1% likely

published 2d agodeletes in 43d

CVE-2026-54047

Laci Synchroni, a decentralized mod and appearance sync server for Dalamud, had a flaw in its OAuth2 login that let users edit a local config file to impersonate any other user. The server failed to verify that the UID in the config matched the authenticated identity, allowing attackers to take over accounts. The issue was fixed in version 1.2.3.

Critical· 9.2<1% likelyfix available

published 2d agodeletes in 28d

CVE-2026-3869

This vulnerability is an incorrect implementation of an authentication algorithm in PLCs. It can allow attackers to bypass authentication and gain unauthorized access, potentially compromising the device’s confidentiality, integrity, and availability.

Critical· 9.2<1% likely

published 2d agodeletes in 43d

CVE-2026-89010

WAVLINK WN535M1 and WN535M3 routers with firmware before M35M1_V250922 are vulnerable to an unauthenticated OS command injection. By sending specially crafted filenames to the sync_server daemon on TCP port 13136, an attacker can run arbitrary commands as root. The flaw stems from unsanitized input being passed to a shell via system().

Critical· 9.33% likely

published 2d agodeletes in 43d

CVE-2026-87988

Mistral Vibe has a flaw that lets attackers read or write any file on the server, ignoring workspace boundaries. The bug is caused by missing path validation for commands that are always allowed. Because the attacker can access critical files, the vulnerability is rated as critical.

Critical· 10<1% likely

published 2d agodeletes in 43d

100

CVE-2026-87987

An arbitrary code execution flaw in Mistral Vibe lets attackers bypass command permission checks by inserting environment variable assignments before allowlisted commands. These assignments are ignored during inspection, allowing attacker‑controlled variables to trigger code execution without user approval.

Critical· 10<1% likely

published 2d agodeletes in 43d

101

CVE-2026-87986

An attacker can run arbitrary commands on a system running Mistral Vibe by exploiting a flaw that lets them bypass command permission checks. The vulnerability allows the attacker to inject shell commands that the parser ignores, leading to full code execution. No public exploit or patch is currently available.

Critical· 10<1% likely

published 2d agodeletes in 43d

102

CVE-2026-87985

An attacker can run any code on a system that uses Mistral Vibe by sending specially crafted ANSI‑C quoted arguments. The vulnerability lets the attacker bypass normal command permission checks, allowing them to execute arbitrary commands without approval.

Critical· 10<1% likely

published 2d agodeletes in 43d

103

CVE-2026-87984

An arbitrary file write vulnerability exists in Mistral Vibe version 1.3.4. It allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations bypass permission checks, enabling otherwise allowlisted commands to write to any path the Vibe process can access.

Critical· 9.3<1% likely

published 2d agodeletes in 43d

104

CVE-2026-87983

Mistral Vibe has a critical arbitrary file-read vulnerability introduced in version 2.6.0. Because quotation marks are not handled correctly during path validation, an attacker can use quoted absolute paths in allowlisted shell commands to bypass workspace restrictions and read files outside the active workspace without approval.

Critical· 9.2<1% likely

published 2d agodeletes in 43d

105

CVE-2026-38056

A local privilege escalation flaw in the iDirect iQ200 VSAT terminal allows a low‑privilege user to gain full administrative control. The vulnerability exists in firmware 23.0.1.0 and can be triggered without additional credentials. It threatens the primary communications link on offshore rigs, vessels, and remote sites.

Critical· 9.4<1% likely

published 2d agodeletes in 43d

106

CVE-2026-89212

Akana API Platform has a critical flaw that lets attackers exploit XML external entity processing to read sensitive data. The issue affects several older versions and has been patched in the latest release. Users should update immediately.

Critical· 9.2<1% likelyfix available

published 2d agodeletes in 28d

107

CVE-2026-71644

A critical flaw in the Robotics-STAR-Lab (SYSU STAR Group) RACER Tested software allows an attacker to disrupt safe flight paths and potentially cause UAV collisions. The vulnerability stems from a missing default case in a finite‑state machine that stops publishing swarm trajectories when a drone enters the IDLE state. It can be triggered remotely over the network without any user interaction.

Critical· 9.8<1% likely

published 2d agodeletes in 43d

108

CVE-2026-84390

Fortinet FortiMonitorOnSight software versions 7.2.0‑7.2.2 and 7.2.4‑7.2.7 contain a flaw where sensitive information is embedded in the source code. This can lead to improper access control, potentially allowing attackers to gain unauthorized access. The vulnerability is critical because it requires no authentication and can compromise confidentiality, integrity, and availability.

Critical· 9.8<1% likely

published 2d agodeletes in 43d