Do Son CERT/CC warns of a Plane authorization bypass, CVE-2026-15342. It lets users reach other workspaces' files, and no patch exists yet.
unpatched
CVE-2026-61884 is a Tycon authentication bypass rated CVSS 9.8 in TPDIN-Monitor-WEB2. No vendor fix exists, so isolate the devices now.
CVE-2026-14890 is an unpatched SGLang vulnerability enabling unauthenticated remote code execution through pickle deserialization. Restrict access now.
A critical 9.8 CVSS vulnerability in PayU CommercePro for WordPress allows unauthenticated admin account takeover. No patch available, immediate removal advised.
Two unpatched CVSS 9.8 flaws in telecom gear enable remote code execution via buffer overflows, exposing critical infrastructure to attack.
Rapid7 found critical RCE flaws in MICI NetFax (versions < 3.0.1.0) via default credentials & command injection. Vendor refuses to patch, advising no internet exposure.