CVSS 10 Archives • Page 2 of 2 • Daily CyberSecurity

NocoBase Critical Alert: Sandbox Escape Grants Attackers Root Access

NocoBase Critical Alert: Sandbox Escape Grants Attackers Root Access

Do Son April 1, 2026

NocoBase patches a CVSS 10.0 RCE vulnerability (CVE-2026-34156). A simple console object bypasses the sandbox for root access. Update to 2.0.28 now!

Instant Hijack: Critical 10.0 CVSS File Browser Flaw Grants Automatic Admin Rights File Browser Vulnerability CVE-2026-32760

Instant Hijack: Critical 10.0 CVSS File Browser Flaw Grants Automatic Admin Rights

Do Son March 17, 2026

A critical 10.0 CVSS logic flaw in File Browser (CVE-2026-32760) grants unauthenticated users automatic admin rights upon signup. Update to 2.62.0 now.

Critical 10.0 CVSS SandboxJS Flaw Grants Complete Remote Code Execution SandboxJS Escape Host Object Poisoning SandboxJS Vulnerability CVE-2026-26954

SandboxJS Escape Host Object Poisoning SandboxJS Vulnerability CVE-2026-26954

Critical 10.0 CVSS SandboxJS Flaw Grants Complete Remote Code Execution

Do Son March 16, 2026

Critical 10.0 CVSS flaw in SandboxJS (CVE-2026-26954) allows attackers to escape the sandbox and achieve Remote Code Execution. Patch to version 0.8.34 now.

Winter CMS Urgently Patches Critical 10.0 CVSS Privilege Escalation Flaw Winter CMS Vulnerability CVE-2026-27591

Winter CMS Urgently Patches Critical 10.0 CVSS Privilege Escalation Flaw

Do Son March 13, 2026

Winter CMS urgently patches a critical 10.0 CVSS privilege escalation flaw (CVE-2026-27591) allowing low-level backend users to gain full system control.

Urgent Patch Required: HPE AutoPass License Server Hits Maximum Severity Risk HPE AutoPass Vulnerability, CVE-2026-23600 CVE-2024-22442 - HPE vulnerability HPE Storage Vulnerability CVE-2026-23594

Urgent Patch Required: HPE AutoPass License Server Hits Maximum Severity Risk

Do Son March 3, 2026

HPE warns of a critical CVSS 10.0 vulnerability (CVE-2026-23600) in AutoPass License Server. Remote attackers can bypass authentication. Patch to 9.19 now!

CVE-2026-23830: Critical SandboxJS Flaw (CVSS 10) Allows Total Sandbox Escape

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

CVE-2026-23830: Critical SandboxJS Flaw (CVSS 10) Allows Total Sandbox Escape

Do Son January 29, 2026

CVSS 10 flaw CVE-2026-23830 in SandboxJS allows RCE via unpatched Async functions. Attackers bypass all limits. Update to v0.8.26 immediately.

Total Takeover: Critical CVSS 10 Flaw Found in Oracle Fusion Middleware Oracle breach Oracle Fusion Middleware CVE-2026-21962

Total Takeover: Critical CVSS 10 Flaw Found in Oracle Fusion Middleware

Do Son January 21, 2026

Oracle patches CVE-2026-21962 (CVSS 10) in Fusion Middleware. This critical flaw allows unauthenticated server takeover. Update immediately.

One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA Cal.com Vulnerability CVE-2026-23478 Cal.com Auth Bypass, TOTP Logic Flaw

Cal.com Vulnerability CVE-2026-23478 Cal.com Auth Bypass, TOTP Logic Flaw

One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA

Do Son January 15, 2026

Critical Cal.com flaw (CVE-2026-23478) allows full account takeover via a single API call. CVSS 10.0. Update self-hosted instances to v6.0.7 immediately.

Siemens Issues Critical Alert for Maximum 10.0 Vulnerability in Industrial Systems Siemens Edge Vulnerability CVE-2025-40805 CVE-2024-32741 - CVE-2025-27494 Siemens, Industrial Edge, CVE-2024-54092

Siemens Edge Vulnerability CVE-2025-40805 CVE-2024-32741 - CVE-2025-27494 Siemens, Industrial Edge, CVE-2024-54092

Siemens Issues Critical Alert for Maximum 10.0 Vulnerability in Industrial Systems

Do Son January 14, 2026

Urgent: Siemens Edge flaw CVE-2025-40805 (CVSS 10) allows remote account takeover. Update SIMATIC & IOT2050 devices immediately to secure ops.

CVE-2025-64095: Critical CVSS 10.0 Flaw in DNN Platform Allows Unauthenticated Website Overwrite CVE-2025-64095 Site Takeover DNN Software, XSS, vulnerability

CVE-2025-64095 Site Takeover DNN Software, XSS, vulnerability

CVE-2025-64095: Critical CVSS 10.0 Flaw in DNN Platform Allows Unauthenticated Website Overwrite

Do Son October 31, 2025

Urgent! DNN Platform has a Critical CVSS 10.0 flaw allowing unauthenticated users to overwrite files, leading to site defacement & XSS. Update to 10.1.1.

Arista Patches Critical Vulnerability in CloudVision ZTP With CVSS 10 Score CloudVision ZTP, CVE-2025-0505

Arista Patches Critical Vulnerability in CloudVision ZTP With CVSS 10 Score

Do Son May 10, 2025

Arista patches CVE-2025-0505, a CVSS 10 flaw in CloudVision ZTP that allows admin privilege escalation—on-premise users urged to upgrade.

Arista Fixes Critical CloudVision Portal Vulnerability with CVSS 10 Score Arista CloudVision, CVE-2024-11186

Arista Fixes Critical CloudVision Portal Vulnerability with CVSS 10 Score

Do Son May 9, 2025

Critical CVE-2024-11186 in Arista CloudVision Portal allows authenticated users broader network actions. Patch or mitigate now.

Microsoft Patches Four Critical Azure and Power Apps Vulnerabilities, Including CVSS 10 Privilege Escalation Smart App Control blocking Armoury Crate, ROG Ally Defender false positive 2026 Microsoft Zero-Day, Cloud Files UAF Microsoft Access end of life CVE-2025-21298 Azure Vulnerabilities

Smart App Control blocking Armoury Crate, ROG Ally Defender false positive 2026 Microsoft Zero-Day, Cloud Files UAF Microsoft Access end of life CVE-2025-21298 Azure Vulnerabilities

Microsoft Patches Four Critical Azure and Power Apps Vulnerabilities, Including CVSS 10 Privilege Escalation

Do Son May 9, 2025

Microsoft patched critical Azure & Power Apps security flaws before exploitation. No user action needed. Stay informed on cloud security.

Erlang/OTP CVE-2025-32433 (CVSS 10): Critical SSH Flaw Allows Unauthenticated RCE Erlang/OTP, remote code execution

Erlang/OTP CVE-2025-32433 (CVSS 10): Critical SSH Flaw Allows Unauthenticated RCE

Do Son April 17, 2025

CVE-2025-32433 in Erlang/OTP SSH server enables unauthenticated RCE. Patch now to prevent full system compromise across all affected versions.