Critical vulnerability archive — page 108

WSO23 vulnerabilities on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2026-5430 · WSO2 WSO2 Universal Gateway

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

KEV · due 27 Sep EPSS 22%public exploit SSVC act CVSS 10.0

CVE-2025-15039 · WSO2 WSO2 Identity Server

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

EPSS 0.7%CVSS 9.4

CVE-2026-1728 · WSO2 WSO2 API Manager

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

EPSS 0.5%CVSS 9.8

MervinPraison1 vulnerability on this pageMax CVSS 10.0Priority 55KEV 0

CVE-2026-48168 · MervinPraison PraisonAI

PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name

EPSS 2%public exploit CVSS 10.0

mitre2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-67688 · mitre

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module.

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-67689 · mitre

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters i…

EPSS 0.8%public exploit CVSS 9.8

agentfront1 vulnerability on this pageMax CVSS 9.3Priority 49KEV 0

CVE-2026-67531 · agentfront frontmcp

FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

EPSS 0.7%public exploit CVSS 9.3

boringproxy1 vulnerability on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2026-70615 · boringproxy boringproxy

boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation

EPSS 0.4%public exploit CVSS 9.9

Dell3 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-67261 · Dell Virtual Storage Integrator for VMware vSphere Client

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability…

EPSS 2%CVSS 9.8

CVE-2026-54489 · Dell Virtual Storage Integrator for VMware vSphere Client

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vul…

EPSS 0.6%CVSS 9.8

CVE-2026-64993 · Dell RVTools

Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector.

EPSS 0.2%CVSS 9.1

Unknown2 vulnerabilities on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-16054 · Unknown Drag and Drop Multiple File Upload for WooCommerce

Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-12713 · Unknown WPCargo Track & Trace

WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

EPSS 0.5%public exploit CVSS 9.1

Bohdan Triapitsyn2 vulnerabilities on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-53975 · Bohdan Triapitsyn OpenChamber

OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

EPSS 2%CVSS 9.8

CVE-2026-53976 · Bohdan Triapitsyn OpenChamber

OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter

EPSS 3%CVSS 9.3

Apache Software Foundation5 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-66909 · Apache Software Foundation Apache CXF

Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

EPSS 1%CVSS 9.8

CVE-2026-68079 · Apache Software Foundation Apache CXF

Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

EPSS 0.7%CVSS 9.8

CVE-2026-61466 · Apache Software Foundation Apache CXF

Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

EPSS 0.7%CVSS 9.1

CVE-2026-63687 · Apache Software Foundation Apache CXF

Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

EPSS 0.3%CVSS 9.1

CVE-2026-65583 · Apache Software Foundation Apache CXF

Apache CXF: Self-issued ID token claims validation skipped

EPSS 0.3%CVSS 9.1

wbolt.com1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-65553 · wbolt.com Spider Analyser – WordPress搜索引擎蜘蛛分析插件

WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability

EPSS 0.9%CVSS 10.0

Muffingroup1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-65548 · Muffingroup Betheme

WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability

EPSS 0.8%CVSS 9.9

AncoraThemes5 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-65574 · AncoraThemes Abogado

WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65575 · AncoraThemes Accalia

WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65576 · AncoraThemes Adrena

WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65577 · AncoraThemes Advice

WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65578 · AncoraThemes Agora

WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Axiomthemes4 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-65571 · Axiomthemes 69 Clothing

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65572 · Axiomthemes A.Williams

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65579 · axiomthemes Agricola

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-65581 · Axiomthemes AI ANN

WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

GitHub1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-17556 · GitHub Enterprise Server

Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header

EPSS 0.8%CVSS 9.1

MihChe1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-65556 · MihChe WPBruiser {no- Captcha anti-Spam}

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

nuxt1 vulnerability on this pageMax CVSS 9.6Priority 39KEV 0

CVE-2026-71319 · nuxt devtools

Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

EPSS 0.6%CVSS 9.6

qstudio1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-65552 · qstudio Export User Data

WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

ThemeREX1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-65573 · ThemeREX Abelle

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

wpdreams1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-28139 · wpdreams Ajax Search Lite

WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Cisco2 vulnerabilities on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-20303 · Cisco Cisco Catalyst SD-WAN Controller

Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities

EPSS 0.5%CVSS 9.9

CVE-2026-20310 · Cisco Cisco Catalyst SD-WAN Controller

Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access

EPSS 0.6%CVSS 9.1

Loca Software Informatics Technology Ltd. Co.1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-5134 · Loca Software Informatics Technology Ltd. Co. CMS

SQLi in Loca Software's CMS

EPSS 0.5%CVSS 9.8

Nexcess1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-28005 · Nexcess Kadence WooCommerce Email Designer

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

Sergey1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-65507 · Sergey AIWU

WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

Eclipse Foundation1 vulnerability on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2026-12605 · Eclipse Foundation Eclipse GlassFish

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker…

EPSS 0.4%CVSS 9.6

Jenkins Project1 vulnerability on this pageMax CVSS 9.0Priority 36KEV 0

CVE-2026-70426 · Jenkins Project Jenkins

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlie…

EPSS 0.5%CVSS 9.0

Linux1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-64597 · Linux Linux

smb: client: fix double-free in SMB2_close() replay

EPSS 0.4%CVSS 9.8

miniOrange1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-65520 · miniOrange WP OAuth Server

WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

NSquared1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-65508 · NSquared Simply Schedule Appointments

WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

QODE1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-65546 · QODE Qode Tours

WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

IBM2 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-9205 · IBM Langflow OSS

Langflow is affected by weaknesses in secret handling and sensitive configuration access

EPSS 0.3%CVSS 9.8

CVE-2026-8470 · IBM Langflow OSS

Langflow is affected by weaknesses in secret handling and sensitive configuration access

EPSS 0.1%CVSS 9.1

The archive.