Critical vulnerability archive — page 103

Adobe6 vulnerabilities on this pageMax CVSS 10.0Priority 97KEV 1

CVE-2026-71362 · Adobe Adobe Commerce

Adobe Commerce | Incorrect Authorization (CWE-863)

KEV · due 27 Sep EPSS 90%public exploit SSVC act CVSS 9.1

CVE-2026-48362 · Adobe ColdFusion 2025

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

EPSS 4%CVSS 10.0

CVE-2026-27302 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

EPSS 1%CVSS 10.0

CVE-2026-71398 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

EPSS 1%CVSS 10.0

CVE-2026-48381 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

EPSS 0.8%CVSS 9.0

CVE-2026-71384 · Adobe ColdFusion 2025

ColdFusion | Incorrect Authorization (CWE-863)

EPSS 0.5%CVSS 9.6

YesWiki1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2026-46670 · YesWiki yeswiki

YesWiki: Unauthenticated SQL Injection

EPSS 2%public exploit CVSS 9.8

harttle1 vulnerability on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2026-45618 · harttle liquidjs

LiquidJS is Vulnerable to Remote Code Execution

EPSS 0.8%public exploit CVSS 10.0

WWBN1 vulnerability on this pageMax CVSS 9.1Priority 51KEV 0

CVE-2026-72748 · WWBN AVideo

AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

EPSS 1%public exploit CVSS 9.1

lllyasviel1 vulnerability on this pageMax CVSS 9.3Priority 50KEV 0

CVE-2025-31114 · lllyasviel Fooocus

Fooocus webui vulnerable to Remote Code Execution

EPSS 0.9%public exploit CVSS 9.3

Arcadia Technology, LLC1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2026-13716 · Arcadia Technology, LLC Crafty Controller

Path Traversal: '.../...//' in Crafty Controller

EPSS 0.8%public exploit CVSS 9.1

truelockmc2 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2026-48056 · truelockmc streambert

Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler

EPSS 0.6%public exploit CVSS 10.0

CVE-2026-48046 · truelockmc streambert

Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler

EPSS 0.4%public exploit CVSS 9.3

baptisteArno2 vulnerabilities on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2026-47705 · baptisteArno typebot.io

TypeBot vulnerable to CSV injection in result export

EPSS 0.6%public exploit CVSS 9.6

CVE-2026-47702 · baptisteArno typebot.io

TypeBot API tokens stored in plaintext

EPSS 0.3%public exploit CVSS 9.1

papersgpt1 vulnerability on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2026-73032 · papersgpt papersgpt-for-zotero

PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()

EPSS 0.6%public exploit CVSS 9.6

twentyhq1 vulnerability on this pageMax CVSS 9.1Priority 48KEV 0

CVE-2026-73069 · twentyhq twenty

Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

EPSS 0.7%public exploit CVSS 9.1

zohocorp1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-12571 · zohocorp manageengine_ddi_central

Authentication Bypass Leading to Account Takeover

EPSS 3%CVSS 9.8

wg-easy1 vulnerability on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2026-72603 · wg-easy wg-easy

wg-easy wg-easy - OS Command Injection

EPSS 2%CVSS 9.9

Microsoft9 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2026-59124 · Microsoft Microsoft HPC Pack 2019

Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8

CVE-2026-62815 · Microsoft Windows 11 version 23H2

Microsoft QUIC Remote Code Execution Vulnerability

EPSS 1.0%CVSS 9.8

CVE-2026-62878 · Microsoft Windows Server 2012

Windows DNS Server Remote Code Execution Vulnerability

EPSS 1.0%CVSS 9.8

CVE-2026-62893 · Microsoft Windows Server 2012

Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

EPSS 1.0%CVSS 9.8

CVE-2026-65768 · Microsoft Microsoft Teams for Android

Microsoft Teams Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.8

CVE-2026-65791 · Microsoft Windows 10 Version 1607

Windows iSCSI Target Service Remote Code Execution Vulnerability

EPSS 1.0%CVSS 9.8

CVE-2026-57104 · Microsoft Azure Storage Explorer

Azure Storage Explorer Elevation of Privilege Vulnerability

EPSS 0.9%CVSS 9.6

CVE-2026-70306 · Microsoft Microsoft SharePoint Enterprise Server 2016

Microsoft Office SharePoint Spoofing Vulnerability

EPSS 1%CVSS 9.3

CVE-2026-50516 · Microsoft Azure Kubernetes Service

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

EPSS 0.8%CVSS 9.4

SAP_SE1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-58231 · SAP_SE SAP Commerce Cloud (Data Hub Adapter)

Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

EPSS 0.9%CVSS 10.0

Siemens1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-58115 · Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)

A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with…

EPSS 0.9%CVSS 10.0

Dassault Systèmes1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2026-17061 · Dassault Systèmes SIMULIA Execution Engine

Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026

EPSS 0.8%CVSS 10.0

n8n-io1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-72765 · n8n-io n8n

n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape

EPSS 0.9%CVSS 9.9

seaweedfs2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-72920 · seaweedfs seaweedfs

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

EPSS 0.8%CVSS 9.8

CVE-2026-73080 · seaweedfs seaweedfs

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

EPSS 0.5%CVSS 9.3

Chocobozzz2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-73211 · Chocobozzz PeerTube

PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

EPSS 0.7%CVSS 9.8

CVE-2026-73090 · Chocobozzz PeerTube

PeerTube: Cross-origin remote video takeover via Update activity

EPSS 0.4%CVSS 9.3

Commvault3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-13737 · Commvault Commvault Cloud

Command Restriction Bypass

EPSS 0.7%CVSS 9.8

CVE-2026-13738 · Commvault Commvault Cloud

Improper Authorization Validation

EPSS 0.7%CVSS 9.8

CVE-2026-13739 · Commvault Commvault Cloud

Server-Side Request Forgery (SSRF)

EPSS 0.5%CVSS 9.8

dromara1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-69102 · dromara MaxKey

MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

EPSS 0.6%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-69223 · Apache Software Foundation Apache Allura

Apache Allura: Server-side request forgery

EPSS 0.8%CVSS 9.1

e1071 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-72599 · e107 e107

e107 e107 - SQL Injection

EPSS 0.6%CVSS 9.8

Friendica1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-72550 · Friendica Friendica

Friendica Friendica - SQL Injection

EPSS 0.6%CVSS 9.8

Red Hat1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-10579 · Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25

Picketlink-federation: auth bypass in picketlink saml unsolicited-response

EPSS 0.4%CVSS 9.8

Stanford NLP1 vulnerability on this pageMax CVSS 9.2Priority 36KEV 0

CVE-2026-72742 · Stanford NLP DSPy

DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

EPSS 0.5%CVSS 9.2

intel1 vulnerability on this pageMax CVSS 10.0Priority 35KEV 0

CVE-2026-20702 · intel

Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure.

EPSS 0.3%CVSS 10.0

Rapid71 vulnerability on this pageMax CVSS 9.6Priority 35KEV 0

CVE-2026-18972 · Rapid7 Velociraptor

Velociraptor authenticated identity-spoofing vulnerability

EPSS 0.4%CVSS 9.6

MongoDB1 vulnerability on this pageMax CVSS 9.0Priority 33KEV 0

CVE-2026-18691 · MongoDB MongoDB Server

Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure

EPSS 0.4%CVSS 9.0

craftcms1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-72785 · craftcms cms

Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

EPSS 0.3%CVSS 9.3

Grafana1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-19516 · Grafana Grafana MCP Server

CVE-2026-19516 CVE Record

EPSS 0.3%CVSS 9.1

The archive.