Critical vulnerability archive — page 2

D-Link1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-118579 · D-Link DIR-505

D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

EPSS 0.8%public exploit CVSS 9.8

fearlessgeekmedia1 vulnerability on this pageMax CVSS 9.4Priority 47KEV 0

CVE-2026-63190 · fearlessgeekmedia FearlessCMS

FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

EPSS 0.5%public exploit CVSS 9.4

EISGE1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-118477 · EISGE Kalifast

KaliFast Project Management Platform ei_git_repo_url OS Command Injection

EPSS 1%CVSS 9.8

Dell7 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-103780 · Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…

EPSS 0.8%CVSS 9.8

CVE-2026-86400 · Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…

EPSS 0.9%CVSS 9.8

CVE-2026-86384 · Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…

EPSS 0.5%CVSS 9.8

CVE-2026-103792 · Dell PowerProtect Data Domain Management Center

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

EPSS 0.4%CVSS 9.6

CVE-2026-86397 · Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…

EPSS 0.3%CVSS 9.8

CVE-2026-103799 · Dell PowerProtect Data Domain Management Center

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

EPSS 0.3%CVSS 9.6

CVE-2026-90717 · Dell PowerProtect Data Domain Management Center

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

EPSS 0.2%CVSS 9.1

Eclipse Foundation1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-114278 · Eclipse Foundation Eclipse Che

Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

EPSS 0.9%CVSS 9.8

kleor1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-109218 · kleor Contact Manager

Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

EPSS 0.6%CVSS 9.8

SignalK1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-118690 · SignalK signalk-server

Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

EPSS 0.7%CVSS 9.8

topluyo1 vulnerability on this pageMax CVSS 9.6Priority 40KEV 0

CVE-2026-115904 · topluyo App

Topluyo Desktop for Linux has an OS Command Injection issue

EPSS 0.7%CVSS 9.6

xwikisas1 vulnerability on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-44179 · xwikisas xwiki-pro-macros

XWiki Pro Macros: excerpt-include title and content injection executes code

EPSS 0.7%CVSS 9.9

Apereo Foundation1 vulnerability on this pageMax CVSS 9.4Priority 39KEV 0

CVE-2026-66088 · Apereo Foundation openEQUELLA

Unrestricted Command Execution via system.execute

EPSS 0.7%CVSS 9.4

artbees1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-106013 · artbees Jupiter X Core

Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

EPSS 0.6%CVSS 9.8

guruteam1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-109516 · guruteam Bot for Telegram on WooCommerce

Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token

EPSS 0.6%CVSS 9.8

mitre3 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-107058 · mitre

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder servi…

public exploit CVSS 9.8

CVE-2026-107015 · mitre

Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note…

public exploit CVSS 9.1

CVE-2026-107032 · mitre

Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component…

public exploit CVSS 9.1

Unknown5 vulnerabilities on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-103688 · Unknown Checkout Files Upload for WooCommerce

Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload

EPSS 0.6%CVSS 9.8

CVE-2026-113617 · Unknown Automated Import Products to Cart

Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal

EPSS 0.2%CVSS 9.9

CVE-2026-115245 · Unknown Chat AI with Dispatcher

Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload

EPSS 0.2%CVSS 9.8

CVE-2026-103693 · Unknown Frontend Dashboard

Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection

EPSS 0.2%CVSS 9.0

CVE-2026-113616 · Unknown LogixFast Auth

LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset

EPSS 0.1%CVSS 9.8

WWBN2 vulnerabilities on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-61564 · WWBN AVideo-Encoder

AVideo-Encoder: unauthenticated installer PHP code injection

EPSS 0.5%CVSS 10.0

CVE-2026-61567 · WWBN AVideo-Encoder

AVideo-Encoder: unauthenticated command execution through streamer login trust

EPSS 0.5%CVSS 10.0

frangoteam1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-42922 · frangoteam Frangoteam

A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).

EPSS 0.5%CVSS 9.8

Juniper Networks2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-103406 · Juniper Networks Session Smart Conductor

Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

EPSS 0.5%CVSS 9.8

CVE-2026-103409 · Juniper Networks Session Smart Router

Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

EPSS 0.3%CVSS 9.8

Pie Register1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-84999 · Pie Register Pie Register Premium

Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler

EPSS 0.5%CVSS 9.8

Radius Synergies1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-114358 · Radius Synergies Radius Xenia M2M Platform

SQL Injection Vulnerability in Radius Xenia M2M Platform

EPSS 0.5%CVSS 9.3

Sophos1 vulnerability on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2026-118633 · Sophos SG UTM

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) af…

EPSS 0.6%CVSS 9.2

Wing Soft Technology1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2026-105420 · Wing Soft Technology Wing FTP Server

Path Traversal in Wing WFTP Server leading to Remote Code Execution

EPSS 0.5%CVSS 9.4

Ultimate Member1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-115968 · Ultimate Member Ultimate Member

WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

HCL Software1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-67074 · HCL Software BigFix AEX

HCL BigFix AEX is affected by multiple security vulnerabilities.

EPSS 0.5%CVSS 9.1

labstack1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-118264 · labstack echo

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

EPSS 0.4%CVSS 9.1

Tactis1 vulnerability on this pageMax CVSS 9.4Priority 35KEV 0

CVE-2026-112197 · Tactis NoviGest Desktop App

Missing Authentication for Critical Function in Tactis' NoviGest Desktop App

EPSS 0.4%CVSS 9.4

EagleCloud1 vulnerability on this pageMax CVSS 9.4Priority 34KEV 0

CVE-2026-104383 · EagleCloud Aquila

Code injection in EagleCloud Aquila on-premises version

EPSS 0.4%CVSS 9.4

ggml-org1 vulnerability on this pageMax CVSS 9.2Priority 34KEV 0

CVE-2026-118375 · ggml-org llama.cpp

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

EPSS 0.4%CVSS 9.2

Aman1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2026-111411 · Aman FunnelKit Automations

WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

Crowd Favorite1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-115607 · Crowd Favorite DXP ToolKit

WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

EPSS 0.2%CVSS 9.3

Futurum Software1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2026-14571 · Futurum Software Futurum Software User Authentication Module

SQL injection (SQLi) in the user authentication module of Futurum Software

EPSS 0.3%CVSS 9.1

IBM2 vulnerabilities on this pageMax CVSS 9.9Priority 30KEV 0

CVE-2026-107329 · IBM Langflow OSS

Langflow OSS is affected by multiple vulnerabilities

CVSS 9.9

CVE-2026-110186 · IBM Langflow OSS

Langflow OSS is affected by multiple vulnerabilities

CVSS 9.8

Red Hat1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2026-117574 · Red Hat Red Hat OpenShift AI (RHOAI)

Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

EPSS 0.2%CVSS 9.1

Yamaha Corporation1 vulnerability on this pageMax CVSS 9.8Priority 29KEV 0

CVE-2026-97854 · Yamaha Corporation NWR100

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.

CVSS 9.8

agno-agi1 vulnerability on this pageMax CVSS 9.2Priority 28KEV 0

CVE-2026-119050 · agno-agi agno

Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

CVSS 9.2

StylemixThemes1 vulnerability on this pageMax CVSS 9.3Priority 28KEV 0

CVE-2026-115964 · StylemixThemes Motors

WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability

CVSS 9.3

The archive.