CVEs rated critical severity.
Astron Agent prior to 1.1.2 runs workflow code-node code through LocalExecutor with complete Python builtins and no sandbox, letting an authenticated low-privilege tenant execute code as root in the core-workflow container, bypass tenant isolation…
CVE-2026-94134 is an insecure-by-default flaw in the Apache Airflow SSH provider hook: unless host_key is configured or no_host_key_check is explicitly set to false, SSH and SFTP connections accept any server key, letting a machine-in-the-middle…
x64dbg-MCP Server prior to 1.1 exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default (ports 9094/9095), letting any unauthenticated network client execute arbitrary x64dbg commands, attach…
CVE-2026-111472 is a critical SQL injection (CWE-89, CVSS 9.3) in TSG Profleet, reachable via a GET request to /cgi-bin/index.php using the 'Identificación' parameter, allowing attackers to retrieve, create, update and delete database data without…
CVE-2026-94388 is a critical blind SQL injection vulnerability in the Green Popups WordPress plugin (halfdata-green-popups), affecting all versions before 7.6.3. With a CVSS 3.1 score of 9.3, an unauthenticated remote attacker can exploit it…
Sunshine Photo Cart for WordPress (all versions up to and including 3.7.4) deserializes untrusted input, letting unauthenticated attackers inject a PHP object via the public favorites page and trigger it by viewing images in…
Maximum-severity (CVSS 10.0) code injection flaw in the The Grid WordPress plugin by Theme-one, allowing unauthenticated command injection and remote code execution in all versions through 2.8.1. Discovered by Rafie Muhammad via the Patchstack…
Critical (CVSS 9.8) unauthenticated privilege escalation in the My Calendar WordPress plugin through 3.8.7: the unsanitized mcs GET parameter enables shortcode injection that reaches call_user_func(), letting attackers overwrite Administrator user ID 1's credentials and…
Critical unauthenticated arbitrary file upload (CWE-434, CVSS 9.8) in the Mang Board WordPress plugin through 2.4.4: the mbw_file_upload function validates extensions only on file_name while the stored name derives from image_path, enabling potentially executable…
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB when backslash escaping is enabled (NO_BACKSLASH_ESCAPES absent) and request data reaches inline-literal query paths, because single-quote doubling ignores backslash escapes. Fixed in 4.2.0; CVSS 9.8 CRITICAL.