Operator board · critical.is

GitLab1 vulnerabilityMax CVSS 10.0Priority 99KEV 1

99

CVE-2026-97229

GitLab GitLab · Integer Overflow or Wraparound in GitLab

10.018%

KEVEXP

Ajax Load More1 vulnerabilityMax CVSS 10.0Priority 30KEV 0

30

CVE-2026-61991

Ajax Load More AjaxLoadMore Cache · WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

10.0–

frappe1 vulnerabilityMax CVSS 9.9Priority 30KEV 0

30

CVE-2026-119145

frappe frappe · Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

9.9–

IBM6 vulnerabilitiesMax CVSS 9.9Priority 30KEV 0

30

CVE-2026-107327

IBM Langflow OSS · Langflow OSS is affected by multiple vulnerabilities

9.9–

30

CVE-2026-107328

IBM Langflow OSS · Langflow OSS is affected by multiple vulnerabilities

9.9–

30

CVE-2026-107329

IBM Langflow OSS · Langflow OSS is affected by multiple vulnerabilities

9.9–

29

CVE-2026-104339

IBM Langflow OSS · Langflow OSS is affected by multiple vulnerabilities

9.8–

29

CVE-2026-110186

IBM Langflow OSS · Langflow OSS is affected by multiple vulnerabilities

9.8–

29

CVE-2026-93680

IBM Langflow OSS · Langflow OSS is affected by multiple vulnerabilities

9.8–

Progress Software6 vulnerabilitiesMax CVSS 10.0Priority 30KEV 0

30

CVE-2026-84295

Progress Software WS_FTP Server · Improper Authentication in Progress WS_FTP Server

10.0–

30

CVE-2026-90868

Progress Software WS_FTP Server · OS Command Injection in Progress WS_FTP Server

9.9–

27

CVE-2026-90863

Progress Software WS_FTP Server · Privilege Escalation via Missing Authorization in WS_FTP Manager

9.1–

27

CVE-2026-90864

Progress Software WS_FTP Server · Host Administrator Path Containment Bypass in Progress WS_FTP Server

9.1–

27

CVE-2026-90865

Progress Software WS_FTP Server · Command Injection via FTP Notification Variables in Progress WS_FTP Server

9.0–

27

CVE-2026-90866

Progress Software WS_FTP Server · Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

9.1–

Dahua1 vulnerabilityMax CVSS 9.8Priority 29KEV 0

29

CVE-2025-31704

Dahua Intelligent Connection Center · Dahua Intelligent Connection Center command injection

9.8–

Gravity Forms1 vulnerabilityMax CVSS 9.8Priority 29KEV 0

29

CVE-2026-103039

Gravity Forms Gravity Forms · Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

9.8–

ThemeREX24 vulnerabilitiesMax CVSS 9.8Priority 29KEV 0

29

CVE-2026-54856

ThemeREX RexCoin · WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-54857

ThemeREX Quirky · WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-54858

ThemeREX Printy · WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-54859

ThemeREX Preservation · WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-54860

ThemeREX Ozisti · WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-61997

ThemeREX Legal Stone · WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-61998

ThemeREX Le Truffe · WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62001

ThemeREX Marcell · WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62002

ThemeREX Meals & Wheels · WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62003

ThemeREX Mission · WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62004

ThemeREX Motorix · WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62005

ThemeREX Muzicon · WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62006

ThemeREX Nuts · WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62008

ThemeREX Orpheus · WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62009

ThemeREX Filmax · WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62010

ThemeREX Avventure · WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62011

ThemeREX Bonbon · WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62012

ThemeREX Coinpress · WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62013

ThemeREX Edge Decor · WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62014

ThemeREX EmojiNation · WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62015

ThemeREX Gamezone · WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62016

ThemeREX Gamic · WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62017

ThemeREX Good Homes · WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

9.8–

29

CVE-2026-62018

ThemeREX Gunslinger · WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

9.8–

Von Eyal Fitoussi1 vulnerabilityMax CVSS 9.8Priority 29KEV 0

29

CVE-2026-61992

Von Eyal Fitoussi GEO my WordPress · WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

9.8–

Yamaha Corporation1 vulnerabilityMax CVSS 9.8Priority 29KEV 0

29

CVE-2026-97854

Yamaha Corporation NWR100 · Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.

9.8–

Zoho Flow1 vulnerabilityMax CVSS 9.8Priority 29KEV 0

29

CVE-2026-62131

Zoho Flow Zoho Flow · WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

9.8–

agno-agi1 vulnerabilityMax CVSS 9.2Priority 28KEV 0

28

CVE-2026-119050

agno-agi agno · Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

9.2–

monkeytypegame1 vulnerabilityMax CVSS 9.3Priority 28KEV 0

28

CVE-2026-118762

monkeytypegame monkeytype · Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

9.3–

OpenText1 vulnerabilityMax CVSS 9.2Priority 28KEV 0

28

CVE-2026-112256

OpenText Advanced Authentication Server · Logon bypass (trust of attacker-controlled completed-methods list)

9.2–

randombit1 vulnerabilityMax CVSS 9.2Priority 28KEV 0

28

CVE-2026-118769

randombit botan · Botan: Integer overflow when reporting block size in FFI can cause memory corruption

9.2–

RT-Labs1 vulnerabilityMax CVSS 9.3Priority 28KEV 0

28

CVE-2026-111732

RT-Labs P-Net · Out-of-bounds write when parsing AR Vendor Block requests

9.3–

ServiceNow1 vulnerabilityMax CVSS 9.4Priority 28KEV 0

28

CVE-2026-103093

ServiceNow ServiceNow AI Platform · Sandbox Escape via Table Rotation in ServiceNow AI Platform

9.4–

StylemixThemes1 vulnerabilityMax CVSS 9.3Priority 28KEV 0

28

CVE-2026-115964

StylemixThemes Motors · WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability

9.3–

Teltonika Networks1 vulnerabilityMax CVSS 9.4Priority 28KEV 0

28

CVE-2026-82104

Teltonika Networks RUT · API permission bypass via logic bug

9.4–

Veeam1 vulnerabilityMax CVSS 9.3Priority 28KEV 0

28

CVE-2023-22793

Veeam Management Pack for Microsoft System Center · A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization E…

9.3–

docat-org1 vulnerabilityMax CVSS 9.1Priority 27KEV 0

27

CVE-2026-61645

docat-org docat · Docat has Arbitrary File Upload exists in Upload API

9.1–

socfortress1 vulnerabilityMax CVSS 9.0Priority 27KEV 0

27

CVE-2026-61707

socfortress CoPilot · SOCFortress CoPilot: Stored case-report template injection permits backend code execution

9.0–

zitadel1 vulnerabilityMax CVSS 9.1Priority 27KEV 0

27

CVE-2026-119128

zitadel zitadel · ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

9.1–

Today