Critical vulnerability archive — page 107

Apple1 vulnerability on this pageMax CVSS 9.8Priority 95KEV 1

CVE-2026-65400 · Apple macOS

Apple macOS Improper Authentication Vulnerability

KEV · due 21 Aug EPSS 2%public exploit SSVC act CVSS 9.8

WGDashboard3 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2026-15733 · WGDashboard WGDashboard

WGDashboard Remote Code Execution vulnerability

EPSS 10%public exploit CVSS 9.8

CVE-2026-15734 · WGDashboard WGDashboard

WGDashboard Server-Side Template Injection vulnerability

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-15732 · WGDashboard WGDashboard

WGDashboard Server-Side Request Forgery Vulnerability

EPSS 0.6%public exploit CVSS 9.8

Unknown3 vulnerabilities on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2026-14812 · Unknown Premium SEO

Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)

EPSS 0.8%public exploit CVSS 10.0

CVE-2026-11976 · Unknown MonsterInsights Pro

MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

EPSS 0.5%public exploit CVSS 10.0

CVE-2026-17032 · Unknown google-maps-easy-pro

Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

EPSS 0.5%public exploit CVSS 9.8

open-reception4 vulnerabilities on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2026-48085 · open-reception appointment-booking-software

OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-48087 · open-reception appointment-booking-software

OpenReception: WebAuthn passkey injection allows account takeover

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-48086 · open-reception appointment-booking-software

OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

EPSS 0.4%public exploit CVSS 9.9

CVE-2026-48088 · open-reception appointment-booking-software

OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

EPSS 0.4%public exploit CVSS 9.4

FlowiseAI1 vulnerability on this pageMax CVSS 9.9Priority 48KEV 0

CVE-2026-67622 · FlowiseAI Flowise

Flowise 3.1.4 IDOR in OpenAI Assistants Integration

EPSS 0.5%public exploit CVSS 9.9

Microsoft10 vulnerabilities on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-56162 · Microsoft Azure SQL Database

Azure SQL Database Elevation of Privilege Vulnerability

EPSS 0.9%CVSS 10.0

CVE-2026-59115 · Microsoft Microsoft Entra Provisioning Service

Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

EPSS 1%CVSS 9.9

CVE-2026-50481 · Microsoft Azure Active Directory

Azure Active Directory Elevation of Privilege Vulnerability

EPSS 0.8%CVSS 9.9

CVE-2026-62830 · Microsoft Azure SRE Agent

Azure SRE Agent Elevation of Privilege Vulnerability

EPSS 0.8%CVSS 9.9

CVE-2026-65667 · Microsoft Microsoft Teams

Microsoft Teams Elevation of Privilege Vulnerability

EPSS 0.8%CVSS 10.0

CVE-2026-62836 · Microsoft Azure SQL Managed Instance

Azure SQL Managed Instance Elevation of Privilege Vulnerability

EPSS 0.6%CVSS 10.0

CVE-2026-68823 · Microsoft Azure Confidential Ledger

Azure Confidential Ledger Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.1

CVE-2026-56161 · Microsoft Azure Logic Apps

Azure Logic Apps Information Disclosure Vulnerability

EPSS 0.7%CVSS 9.6

CVE-2026-59118 · Microsoft Copilot Cowork

Copilot Cowork Elevation of Privilege Vulnerability

EPSS 0.7%CVSS 9.3

CVE-2026-62896 · Microsoft Microsoft Teams

Microsoft Teams Elevation of Privilege Vulnerability

EPSS 0.7%CVSS 9.6

DataLinkDC1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-70558 · DataLinkDC Dinky

Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token

EPSS 0.8%CVSS 9.8

Contiki-NG1 vulnerability on this pageMax CVSS 9.2Priority 40KEV 0

CVE-2026-5857 · Contiki-NG Contiki-NG

Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments

EPSS 0.9%CVSS 9.2

traefik1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2026-71324 · traefik traefik

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

EPSS 1%CVSS 9.1

AncoraThemes2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-65577 · AncoraThemes Advice

WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65578 · AncoraThemes Agora

WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Axiomthemes2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-65579 · axiomthemes Agricola

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65581 · Axiomthemes AI ANN

WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Brandexponents1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-66665 · Brandexponents Type Hub

WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

Shabti Kaplan1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-66662 · Shabti Kaplan Frontend Admin by DynamiApps

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

WebAppick1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-66709 · WebAppick CTX Feed

WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability

EPSS 0.8%CVSS 9.1

Efstratios Goudelis2 vulnerabilities on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-53984 · Efstratios Goudelis Ground Station

Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

EPSS 0.7%CVSS 9.1

CVE-2026-53983 · Efstratios Goudelis Ground Station

Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

EPSS 0.6%CVSS 9.2

ggml-org3 vulnerabilities on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-43629 · ggml-org llama.cpp

llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore

EPSS 0.7%CVSS 9.2

CVE-2026-43631 · ggml-org llama.cpp

llama.cpp b7492–b9060 Use-After-Free RCE via llama-server

EPSS 0.6%CVSS 9.2

CVE-2026-43632 · ggml-org llama.cpp

llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints

EPSS 0.5%CVSS 9.2

WSO22 vulnerabilities on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-3418 · WSO2 WSO2 API Manager

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

EPSS 0.8%CVSS 9.1

CVE-2025-14561 · WSO2 WSO2 API Manager

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

EPSS 0.4%CVSS 9.0

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-34191 · Apache Software Foundation Apache Portable Runtime Utility

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

EPSS 0.6%CVSS 9.1

CVE-2026-32327 · Apache Software Foundation Apache Portable Runtime Utility

Apache Portable Runtime Utility: apr-util XML stack recursion crash

EPSS 0.5%CVSS 9.1

Google7 vulnerabilities on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2026-19166 · Google Chrome

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox…

EPSS 0.4%CVSS 9.6

CVE-2026-19157 · Google Chrome

Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandb…

EPSS 0.4%CVSS 9.6

CVE-2026-19149 · Google Chrome

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escap…

EPSS 0.3%CVSS 9.6

CVE-2026-19164 · Google Chrome

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially pe…

EPSS 0.3%CVSS 9.6

CVE-2026-19170 · Google Chrome

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox es…

EPSS 0.3%CVSS 9.6

CVE-2026-19171 · Google Chrome

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox es…

EPSS 0.3%CVSS 9.6

CVE-2026-19175 · Google Chrome

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via…

EPSS 0.3%CVSS 9.6

nickboss1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-66447 · nickboss WordPress File Upload

WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Sophos1 vulnerability on this pageMax CVSS 9.3Priority 29KEV 0

CVE-2026-18367 · Sophos Sophos Endpoint for macOS

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than versio…

EPSS 0.2%CVSS 9.3

The archive.