Critical vulnerability archive

Ajax Load More1 vulnerability on this pageMax CVSS 10.0Priority 30KEV 0

CVE-2026-61991 · Ajax Load More AjaxLoadMore Cache

WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

CVSS 10.0

frappe1 vulnerability on this pageMax CVSS 9.9Priority 30KEV 0

CVE-2026-119145 · frappe frappe

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

CVSS 9.9

IBM4 vulnerabilities on this pageMax CVSS 9.9Priority 30KEV 0

CVE-2026-107327 · IBM Langflow OSS

Langflow OSS is affected by multiple vulnerabilities

CVSS 9.9

CVE-2026-107328 · IBM Langflow OSS

Langflow OSS is affected by multiple vulnerabilities

CVSS 9.9

CVE-2026-104339 · IBM Langflow OSS

Langflow OSS is affected by multiple vulnerabilities

CVSS 9.8

CVE-2026-93680 · IBM Langflow OSS

Langflow OSS is affected by multiple vulnerabilities

CVSS 9.8

Progress Software6 vulnerabilities on this pageMax CVSS 10.0Priority 30KEV 0

CVE-2026-84295 · Progress Software WS_FTP Server

Improper Authentication in Progress WS_FTP Server

CVSS 10.0

CVE-2026-90868 · Progress Software WS_FTP Server

OS Command Injection in Progress WS_FTP Server

CVSS 9.9

CVE-2026-90863 · Progress Software WS_FTP Server

Privilege Escalation via Missing Authorization in WS_FTP Manager

CVSS 9.1

CVE-2026-90864 · Progress Software WS_FTP Server

Host Administrator Path Containment Bypass in Progress WS_FTP Server

CVSS 9.1

CVE-2026-90865 · Progress Software WS_FTP Server

Command Injection via FTP Notification Variables in Progress WS_FTP Server

CVSS 9.0

CVE-2026-90866 · Progress Software WS_FTP Server

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

CVSS 9.1

Dahua1 vulnerability on this pageMax CVSS 9.8Priority 29KEV 0

CVE-2025-31704 · Dahua Intelligent Connection Center

Dahua Intelligent Connection Center command injection

CVSS 9.8

Gravity Forms1 vulnerability on this pageMax CVSS 9.8Priority 29KEV 0

CVE-2026-103039 · Gravity Forms Gravity Forms

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

CVSS 9.8

ThemeREX24 vulnerabilities on this pageMax CVSS 9.8Priority 29KEV 0

CVE-2026-54856 · ThemeREX RexCoin

WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-54857 · ThemeREX Quirky

WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-54858 · ThemeREX Printy

WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-54859 · ThemeREX Preservation

WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-54860 · ThemeREX Ozisti

WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-61997 · ThemeREX Legal Stone

WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-61998 · ThemeREX Le Truffe

WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62001 · ThemeREX Marcell

WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62002 · ThemeREX Meals & Wheels

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62003 · ThemeREX Mission

WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62004 · ThemeREX Motorix

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62005 · ThemeREX Muzicon

WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62006 · ThemeREX Nuts

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62008 · ThemeREX Orpheus

WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62009 · ThemeREX Filmax

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62010 · ThemeREX Avventure

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62011 · ThemeREX Bonbon

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62012 · ThemeREX Coinpress

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62013 · ThemeREX Edge Decor

WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62014 · ThemeREX EmojiNation

WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62015 · ThemeREX Gamezone

WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62016 · ThemeREX Gamic

WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62017 · ThemeREX Good Homes

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-62018 · ThemeREX Gunslinger

WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

CVSS 9.8

Von Eyal Fitoussi1 vulnerability on this pageMax CVSS 9.8Priority 29KEV 0

CVE-2026-61992 · Von Eyal Fitoussi GEO my WordPress

WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

CVSS 9.8

Zoho Flow1 vulnerability on this pageMax CVSS 9.8Priority 29KEV 0

CVE-2026-62131 · Zoho Flow Zoho Flow

WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

CVSS 9.8

monkeytypegame1 vulnerability on this pageMax CVSS 9.3Priority 28KEV 0

CVE-2026-118762 · monkeytypegame monkeytype

Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

CVSS 9.3

OpenText1 vulnerability on this pageMax CVSS 9.2Priority 28KEV 0

CVE-2026-112256 · OpenText Advanced Authentication Server

Logon bypass (trust of attacker-controlled completed-methods list)

CVSS 9.2

randombit1 vulnerability on this pageMax CVSS 9.2Priority 28KEV 0

CVE-2026-118769 · randombit botan

Botan: Integer overflow when reporting block size in FFI can cause memory corruption

CVSS 9.2

RT-Labs1 vulnerability on this pageMax CVSS 9.3Priority 28KEV 0

CVE-2026-111732 · RT-Labs P-Net

Out-of-bounds write when parsing AR Vendor Block requests

CVSS 9.3

ServiceNow1 vulnerability on this pageMax CVSS 9.4Priority 28KEV 0

CVE-2026-103093 · ServiceNow ServiceNow AI Platform

Sandbox Escape via Table Rotation in ServiceNow AI Platform

CVSS 9.4

Teltonika Networks1 vulnerability on this pageMax CVSS 9.4Priority 28KEV 0

CVE-2026-82104 · Teltonika Networks RUT

API permission bypass via logic bug

CVSS 9.4

Veeam1 vulnerability on this pageMax CVSS 9.3Priority 28KEV 0

CVE-2023-22793 · Veeam Management Pack for Microsoft System Center

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization E…

CVSS 9.3

docat-org1 vulnerability on this pageMax CVSS 9.1Priority 27KEV 0

CVE-2026-61645 · docat-org docat

Docat has Arbitrary File Upload exists in Upload API

CVSS 9.1

socfortress1 vulnerability on this pageMax CVSS 9.0Priority 27KEV 0

CVE-2026-61707 · socfortress CoPilot

SOCFortress CoPilot: Stored case-report template injection permits backend code execution

CVSS 9.0

zitadel1 vulnerability on this pageMax CVSS 9.1Priority 27KEV 0

CVE-2026-119128 · zitadel zitadel

ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

CVSS 9.1

The archive.