Daily briefing · June 25, 2026
Three CVSS 10.0 Flaws Lead a Heavy Day: Apache Kvrocks, Flowise, and WordPress Under Fire
June 25, 2026 brought 434 new CVEs, including 21 criticals, with no confirmed active exploitation yet — but the severity profile demands immediate attention. Three vulnerabilities scored a perfect CVSS 10.0, targeting Apache Kvrocks, the Flowise AI platform, and a WordPress plugin, while Flowise alone accounts for four critical entries covering remote code execution, path traversal, and arbitrary file upload. Defenders managing these platforms should treat today's disclosures as urgent patching events.
Today’s brief
- Three CVSS 10.0 vulnerabilities disclosed today across Apache Kvrocks, Flowise, and the OMGF Pro WordPress plugin.
- Flowise dominates the day with four critical CVEs spanning RCE, path traversal, and unauthenticated file upload — patch to 3.0.6 or later immediately.
- Dell Wyse Management Suite and ToolJet also carry critical RCE flaws exploitable by low-privileged or authenticated users.
- No KEV-confirmed active exploitation yet, but the attack surface is wide and unauthenticated vectors lower the bar significantly.
21
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
A heap overflow in the cjson library's Lua integration within Apache Kvrocks (versions 2.0.4 through 2.15.0) scores a perfect 10.0 — this class of memory corruption flaw can enable arbitrary code execution on the server hosting the Redis-compatible database. Upgrade to 2.16.0 without delay.
2
Unauthenticated attackers can exploit unsanitized fileName parameters in Flowise's document-store endpoint to write arbitrary files — including overwriting package.json — and achieve remote code execution upon application restart. The unauthenticated attack vector makes this a critical priority for any internet-exposed Flowise instance.
3
The OMGF Pro WordPress plugin (through version 5.2.6) allows unrestricted upload of dangerous file types, giving unauthenticated or low-privilege attackers a straightforward path to plant malicious files and potentially execute code on the web server. Sites running this plugin should update or disable it immediately.
4
Widget Options for WordPress (versions up to 4.2.3) allows users with only Contributor-level access to achieve remote code execution, drastically lowering the privilege bar needed for a full server compromise on affected WordPress installations. Any multi-author or open-registration site is especially exposed.
5
Dell Wyse Management Suite versions prior to WMS 5.5 HF1 accept untrusted data mixed with trusted data, allowing a remote low-privileged attacker to escalate to remote code execution. Endpoint management platforms are high-value targets; exploitation here could affect entire managed device fleets.
6
Apache Kvrocks 2.8.0 improperly handles insufficient permissions, potentially allowing privilege escalation or unauthorized operations within the data store. Administrators pinned to this specific version must upgrade to 2.16.0, which resolves both Kvrocks vulnerabilities disclosed today.
7
Any authenticated ToolJet user with a free-tier builder role can overwrite a globally shared marketplace plugin with arbitrary JavaScript that runs server-side with full Node.js privileges, affecting all platform users. In multi-tenant or shared ToolJet deployments, this is effectively a supply-chain attack vector from within.
8
Flowise's Custom MCP feature executes OS commands by design, but prior to 3.0.6 it does so without sandboxing and without meaningful role-based access control — meaning any authenticated user can run arbitrary OS commands server-side. Default installations without authentication enforcement are fully exposed to unauthenticated exploitation.
9
In Flowise versions through 2.2.8, missing UUID validation on chatflowId and chatId parameters allows unauthenticated path traversal via the chatflows API endpoint, enabling arbitrary file read or access across the server filesystem. Sensitive configuration files, credentials, and internal data are all at risk.
10
Flowise through 2.2.4 exposes an unauthenticated file upload endpoint that, when local storage is configured, can be exploited via path traversal in chatId and chatflowId parameters to drop malicious files into arbitrary directories and achieve remote code execution. This is a low-complexity, high-impact vector requiring no credentials whatsoever.
Today’s recommendation: Prioritize immediate upgrades for Apache Kvrocks (to 2.16.0), Flowise (to 3.0.6 or later), Dell Wyse Management Suite (to WMS 5.5 HF1), and ToolJet (to 3.20.178-lts or later); for WordPress environments, update or deactivate Widget Options and OMGF Pro without waiting for a maintenance window. Where patching cannot be applied immediately, restrict network access to affected services and enforce authentication on all exposed API endpoints.
With multiple unauthenticated and low-privilege RCE vectors disclosed today, now is the moment to validate which of these platforms are reachable from your external or internal attack surface before threat actors do.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
August 9, 2026 — August 9 Quiet Day: IoT Command Injection Flaws and Brazilian Ransomware Wave Dominate the PictureAugust 8, 2026 — MSI Router Hit by Eight Critical Command Injection CVEs; WordPress AI Plugin Opens Admin BackdoorAugust 7, 2026 — Ten Critical CVEs Under Active Exploitation: SonicWall, WordPress, SharePoint, and More Under FireAugust 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress Stacksview full archive →