the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

1,872critical tracked/166new today/55known-exploited/0exploit available/1,872critical tracked/166new today/55known-exploited/0exploit available/1,872critical tracked/166new today/55known-exploited/0exploit available/1,872critical tracked/166new today/55known-exploited/0exploit available/

The feed (latest)

1,872 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

1243

CVE-2025-53209

CVE-2025-53209 is a critical privilege assignment flaw in Themeisle Masteriyo LMS PRO that allows an attacker to escalate privileges. It affects all versions of the plugin up to and including 2.20.0 and carries a CVSS v3.1 base score of 9.8. No known exploitation or public exploit is reported, and no official fix is documented in the provided sources.

Critical· 9.8<1% likely

published Jun 2, 2026deletes in 33d

1244

CVE-2026-8206

The Kirki plugin for WordPress (versions 6.0.0 through 6.0.6) contains a flaw that lets an unauthenticated attacker hijack any user's account by manipulating the password‑reset process with an arbitrary email address. This privilege‑escalation vulnerability can lead to full compromise of confidentiality, integrity, and availability on affected sites, earning a CVSS v3.1 base score of 9.8 (Critical). No official patch or CISA KEV action is documented in the provided sources.

Critical· 9.81% likely

published Jun 2, 2026deletes in 33d

1245

CVE-2026-25879

CVE-2026-25879 is a critical vulnerability in Langroid's SQLChatAgent (versions <0.63.0) that allows attackers to execute arbitrary code on a database host via prompt injection. The flaw arises when the agent executes untrusted SQL generated by an LLM, especially if the database role has elevated privileges. A fix exists in version 0.63.0, which restricts SQL operations to safe queries by default.

Critical· 9.8<1% likelyfix available

published Jun 1, 2026deletes in 17d

1246

CVE-2026-40965

Cloud Foundry UAA versions v76.12.0 through v78.12.0 expose EC private keys via the /token_keys endpoint, allowing attackers to forge JWT tokens. The flaw only affects deployments using elliptic‑curve keys for JWT signing; RSA configurations are safe. Upgrading to a fixed version removes the exposure.

Critical· 10<1% likelyfix available

published Jun 1, 2026deletes in 20d

1247

CVE-2018-25427

Arm Whois 3.11 contains a flaw that allows an attacker to run unauthorized commands on a system. This happens when the software receives an input that is too large in the IP address or domain fields.

Critical· 9.3<1% likely

published Jun 1, 2026deletes in 32d

1248

CVE-2026-9319

Ibm Websphere Application Server

CVE-2026-9319 is a critical remote code execution vulnerability (CVSS 9) affecting IBM WebSphere Application Server 9.0 and 8.5. It occurs when untrusted data is deserialized via JAX-WS endpoints with WS-Security, allowing attackers to execute arbitrary code. The vulnerability falls under CWE-502.

Critical· 9<1% likely

published Jun 1, 2026deletes in 32d

1249

CVE-2026-9311

Ibm Websphere Application Server

IBM WebSphere Application Server versions 8.5 and 9.0 have a critical flaw that lets attackers run arbitrary code on the server without authentication. The vulnerability is caused by bypassing security controls, allowing remote attackers to take full control of the affected system.

Critical· 9<1% likely

published Jun 1, 2026deletes in 32d

1250

CVE-2026-8644

Ibm Websphere Application Server

IBM WebSphere Application Server 9.0 and 8.5 can be tricked into believing a user is someone else, allowing attackers to impersonate legitimate users.

Critical· 9.1<1% likely

published Jun 1, 2026deletes in 32d

1251

CVE-2026-49121

Amd Aiter

The vulnerability is in AMD's AI Tensor Engine for ROCm (AITER) version 0.1.14 and earlier. An unauthenticated attacker can send a malicious pickle payload to a ZMQ SUB socket, causing the inference worker process to execute arbitrary code on every remote reader worker. This could let attackers take full control of the affected system.

Critical· 9.21% likely

published Jun 1, 2026deletes in 32d

1252

CVE-2026-0072

Google Android Xr

A missing permission check in Android’s InputMethodManagerService allows a local attacker to gain higher privileges on the device. The flaw can be exploited without any user interaction and does not require additional execution rights.

Critical· 10<1% likely

published Jun 1, 2026deletes in 32d

1253

CVE-2026-45132

CloudPirates Open Source Helm Charts had a flaw in its GitHub Actions workflow that exposed sensitive credentials to fork-controlled code. The issue was fixed in commit fcf9302. Users should update to the patched version to prevent credential leakage.

Critical· 10<1% likelyfix available

published Jun 1, 2026deletes in 20d

1254

CVE-2026-45131

CloudPirates Open Source Helm Charts had a critical vulnerability that allowed attackers to run arbitrary code in a privileged GitHub Actions workflow when merging pull requests from forks. The flaw exposed repository secrets such as Docker Hub credentials. The issue was fixed by commit fcf9302.

Critical· 10<1% likelyfix available

published Jun 1, 2026deletes in 20d

1255

CVE-2026-44211

Cline Cline

Cline versions 2.13.0 and earlier contain a cross-origin WebSocket hijack vulnerability in their Kanban servers. An attacker can exploit this flaw to hijack WebSocket connections, leading to high impacts on confidentiality, integrity, and availability. No official patches are currently available.

Critical· 9.6<1% likely

published Jun 1, 2026deletes in 32d

1256

CVE-2026-42672

A security flaw in the Wp Directory Kit plugin allows attackers to perform a 'Blind SQL Injection.' This means an attacker can send malicious commands to the database that the application processes improperly.

Critical· 9.3<1% likely

published Jun 1, 2026deletes in 32d

1257

CVE-2026-8931

A critical remote code execution flaw affects Disig Web Signer versions 2.0.3 through 2.5.3, allowing attackers to run arbitrary code. The vulnerability has a CVSS base score of 9.4. No official fix or known exploitation is documented in the provided sources.

Critical· 9.4<1% likely

published Jun 1, 2026deletes in 32d

1258

CVE-2026-48879

Sergey AIWU contains a critical flaw that lets attackers gain higher privileges without authentication. The issue exists in all versions up to 1.4.17. It can give attackers full control over the affected system.

Critical· 9.8<1% likely

published Jun 1, 2026deletes in 32d

1259

CVE-2026-48866

Gravity Forms, a WordPress plugin, has a path traversal flaw that lets attackers read files outside the intended directory. Versions up to 2.10.0.1 are affected. The flaw can be exploited over the network without needing special permissions.

Critical· 9.6<1% likely

published Jun 1, 2026deletes in 32d

1260

CVE-2026-42682

A critical missing authorization flaw in the Tomdever wpForo Forum lets attackers bypass access controls and gain powerful privileges. The issue is present in all releases up to version 3.0.6.

Critical· 9.1<1% likelyfix available

published Jun 1, 2026deletes in 20d