Critical vulnerability archive — page 11

Wavlink1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-113802 · Wavlink WL-WN530BE1-A

Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler

EPSS 3%public exploit CVSS 9.8

DrayTek3 vulnerabilities on this pageMax CVSS 9.9Priority 56KEV 0

CVE-2026-113389 · DrayTek Vigor2960

DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection

EPSS 2%public exploit CVSS 9.9

CVE-2026-113390 · DrayTek Vigor2960

DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection

EPSS 2%public exploit CVSS 9.9

CVE-2026-113391 · DrayTek Vigor2960

DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection

EPSS 2%public exploit CVSS 9.9

H3C2 vulnerabilities on this pageMax CVSS 9.9Priority 56KEV 0

CVE-2026-112370 · H3C Magic NX15

H3C Magic NX15 usrlist sub_416874 os command injection

EPSS 2%public exploit CVSS 9.9

CVE-2026-112371 · H3C Magic NX15

H3C Magic NX15 RPC esps write code injection

EPSS 0.5%public exploit CVSS 9.9

VulDB1 vulnerability on this pageMax CVSS 9.9Priority 56KEV 0

CVE-2026-113506 · VulDB

aaPanel File Manager common.py ExecShell os command injection

EPSS 2%public exploit CVSS 9.9

python-pillow4 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2026-112393 · python-pillow Pillow

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

EPSS 1%public exploit CVSS 9.8

CVE-2026-112403 · python-pillow Pillow

Pillow: Heap buffer overflow in ImagingJpegDecode

EPSS 0.9%public exploit CVSS 9.8

CVE-2026-112398 · python-pillow Pillow

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

EPSS 0.7%public exploit CVSS 9.8

CVE-2026-112900 · python-pillow Pillow

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

EPSS 1%CVSS 9.8

cas-bigdatalab1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-109442 · cas-bigdatalab piflow

piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell

EPSS 0.8%public exploit CVSS 9.8

eosphoros-ai2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-77932 · eosphoros-ai DB-GPT

DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-77933 · eosphoros-ai DB-GPT

DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment

EPSS 0.4%public exploit CVSS 9.8

EvoScientist1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-77930 · EvoScientist EvoScientist

EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents

EPSS 0.7%public exploit CVSS 9.8

froxlor1 vulnerability on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2026-113678 · froxlor froxlor

Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

EPSS 0.6%public exploit CVSS 9.9

Tracer-Cloud1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-109444 · Tracer-Cloud opensre

OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection

EPSS 0.7%public exploit CVSS 9.8

chatchat-space1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-75128 · chatchat-space Langchain-Chatchat

Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint

EPSS 0.6%public exploit CVSS 9.8

letta-ai1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-77936 · letta-ai letta

Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

EPSS 0.6%public exploit CVSS 9.8

giuseppe99barchetta1 vulnerability on this pageMax CVSS 9.3Priority 46KEV 0

CVE-2026-113703 · giuseppe99barchetta SuggestArr

SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

EPSS 0.5%public exploit CVSS 9.3

argoproj3 vulnerabilities on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-113672 · argoproj argo-cd

Argo CD: A Jsonnet import can read files from the repo-server

EPSS 0.8%CVSS 9.9

CVE-2026-113708 · argoproj argo-cd

Argo CD: A Kustomize remote ref can run commands in the repo-server

EPSS 0.7%CVSS 9.9

CVE-2026-113709 · argoproj argo-cd

Argo CD: A Kustomize Helm config home can run commands in the repo-server

EPSS 0.5%CVSS 9.9

Advantech4 vulnerabilities on this pageMax CVSS 9.3Priority 40KEV 0

CVE-2026-43836 · Advantech ADAM-3600

A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.

EPSS 0.9%CVSS 9.3

CVE-2026-43844 · Advantech ADAM-3600

A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.

EPSS 0.5%CVSS 9.3

CVE-2026-43845 · Advantech ADAM-3600

A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.

EPSS 0.5%CVSS 9.2

CVE-2026-43838 · Advantech ADAM-3600

A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.

EPSS 0.4%CVSS 9.2

curl2 vulnerabilities on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2026-87866 · curl curl

wolfSSL public-key pinning bypass

EPSS 0.2%public exploit CVSS 9.1

CVE-2026-86411 · curl curl

FTP connection reuse inherits client-certificate

EPSS 0.2%public exploit CVSS 9.1

FlexGet1 vulnerability on this pageMax CVSS 9.2Priority 40KEV 0

CVE-2026-113613 · FlexGet FlexGet

FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin

EPSS 0.9%CVSS 9.2

Signal1 vulnerability on this pageMax CVSS 9.3Priority 40KEV 0

CVE-2026-113380 · Signal RingRTC

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangu…

EPSS 0.9%CVSS 9.3

getgrav1 vulnerability on this pageMax CVSS 9.3Priority 39KEV 0

CVE-2026-112780 · getgrav grav

Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

EPSS 0.7%CVSS 9.3

Apache Software Foundation4 vulnerabilities on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2026-86471 · Apache Software Foundation Apache CouchDB

Apache CouchDB: Admin credentials leading to code execution as operating system user

EPSS 0.6%CVSS 9.3

CVE-2026-101296 · Apache Software Foundation Apache Tomcat

Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

EPSS 0.6%CVSS 9.1

CVE-2026-103119 · Apache Software Foundation Apache Tomcat

Apache Tomcat: AJP response mix-up

EPSS 0.6%CVSS 9.1

CVE-2026-101356 · Apache Software Foundation Apache Tomcat

Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

EPSS 0.5%CVSS 9.1

Amazon1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-112380 · Amazon Kiro Crew

Missing authorization in the WhatsApp channel in Kiro Crew

EPSS 0.4%CVSS 9.9

networknt1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-113682 · networknt light-4j

Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password

EPSS 0.6%CVSS 9.1

totolink2 vulnerabilities on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-10139 · totolink Totolink

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1…

EPSS 0.6%CVSS 9.1

CVE-2026-10141 · totolink Totolink

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250…

EPSS 0.3%CVSS 9.1

Google1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-105772 · Google ADK TypeScript (@google/adk)

Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

EPSS 0.5%CVSS 9.1

ning1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-109395 · ning compress-lzf

Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

EPSS 0.5%CVSS 9.1

Red Hat1 vulnerability on this pageMax CVSS 9.9Priority 35KEV 0

CVE-2026-105312 · Red Hat StreamsHub Console for Apache Kafka®

Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

EPSS 0.3%CVSS 9.9

Eclipse Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-113620 · Eclipse Foundation Eclipse ioFog

Eclipse ioFog operator WebSocket accepts an unverified JWT

EPSS 0.3%CVSS 9.8

CVE-2026-93475 · Eclipse Foundation Eclipse ThreadX - NetX Duo

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

EPSS 0.2%CVSS 9.3

Unblu inc.1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-9589 · Unblu inc. Unblu Spark

Unblu Spark Authorization Bypass in Configuration Cascade Operations

EPSS 0.4%CVSS 9.3

Mozilla2 vulnerabilities on this pageMax CVSS 9.8Priority 31KEV 0

CVE-2026-113399 · Mozilla Firefox

Incorrect boundary conditions in the SVG component

EPSS 0.2%CVSS 9.8

CVE-2026-113867 · Mozilla Thunderbird

Stanza injection in XMPP chat

EPSS 0.2%CVSS 9.1

Xerj1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2026-97406 · Xerj Console API

Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

EPSS 0.2%CVSS 9.1

Apple1 vulnerability on this pageMax CVSS 9.1Priority 29KEV 0

CVE-2026-86868 · Apple macOS

An authentication issue was addressed with improved state management.

EPSS 0.2%CVSS 9.1

The archive.