Critical vulnerability archive — page 111

GL-iNet5 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2026-18612 · GL-iNet GL-MT3000

GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection

EPSS 4%public exploit CVSS 9.8

CVE-2026-18614 · GL-iNet GL-MT3000

GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection

EPSS 4%public exploit CVSS 9.8

CVE-2026-18615 · GL-iNet GL-MT3000

GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection

EPSS 4%public exploit CVSS 9.8

CVE-2026-18616 · GL-iNet GL-MT3000

GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

EPSS 4%public exploit CVSS 9.8

CVE-2026-18613 · GL-iNet GL-MT3000

GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

EPSS 1.0%public exploit CVSS 9.8

GL.iNet3 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-18601 · GL.iNet GL-MT3000

GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection

EPSS 4%public exploit CVSS 9.8

CVE-2026-18602 · GL.iNet GL-MT3000

GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection

EPSS 4%public exploit CVSS 9.8

CVE-2026-18684 · GL.iNet GL-MT3000

GL.iNet GL-MT3000 modem.so glc remove_profile command injection

EPSS 4%public exploit CVSS 9.8

krayin1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-41452 · krayin laravel-crm

Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

EPSS 4%public exploit CVSS 9.8

siyuan-note6 vulnerabilities on this pageMax CVSS 10.0Priority 55KEV 0

CVE-2026-69084 · siyuan-note siyuan

SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

EPSS 2%public exploit CVSS 10.0

CVE-2026-69085 · siyuan-note siyuan

SiYuan before v3.7.3 SQL Injection via searchDocs

EPSS 1%public exploit CVSS 10.0

CVE-2026-69083 · siyuan-note siyuan

SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

EPSS 0.5%public exploit CVSS 10.0

CVE-2026-68584 · siyuan-note siyuan

SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

EPSS 0.5%public exploit CVSS 9.2

CVE-2026-68587 · siyuan-note siyuan

SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction

EPSS 0.3%public exploit CVSS 9.2

CVE-2026-68586 · siyuan-note siyuan

SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc

EPSS 0.4%CVSS 9.2

openemr1 vulnerability on this pageMax CVSS 9.4Priority 54KEV 0

CVE-2026-39932 · openemr openemr

OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

EPSS 2%public exploit CVSS 9.4

Wavlink2 vulnerabilities on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2026-18588 · Wavlink WL-NU516U1

Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow

EPSS 1%public exploit CVSS 9.8

CVE-2026-18589 · Wavlink WL-NU516U1

Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow

EPSS 1%CVSS 9.8

Telenia Software1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-64827 · Telenia Software TVox

Telenia TVox 26.5.3 Authentication Bypass via set_env.php

EPSS 0.8%public exploit CVSS 9.8

sequelize1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-69240 · sequelize sequelize

Sequelize: SQL Injection (Oracle DB)

EPSS 0.5%public exploit CVSS 9.8

dhax1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2026-48031 · dhax go-base

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

EPSS 0.6%public exploit CVSS 9.1

Unknown9 vulnerabilities on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-12965 · Unknown Super Store Finder WordPress

Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-16532 · Unknown Link Library

Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-16534 · Unknown Import and export users and customers

Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-12872 · Unknown Webinfos

Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload

EPSS 1%CVSS 9.8

CVE-2026-16060 · Unknown Insert or Embed Articulate Content into WordPress

Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload

EPSS 0.8%CVSS 9.8

CVE-2026-16250 · Unknown Personal QR Message

Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

EPSS 0.8%CVSS 9.8

CVE-2026-16300 · Unknown ChamaWP

Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset

EPSS 0.5%CVSS 9.8

CVE-2026-14557 · Unknown SoftMarket — Digital Marketplace

SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass

EPSS 0.5%CVSS 9.1

CVE-2026-15930 · Unknown Simple Membership

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

EPSS 0.4%CVSS 9.4

Adobe6 vulnerabilities on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2026-48323 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

EPSS 1%CVSS 10.0

CVE-2026-48330 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

EPSS 1%CVSS 10.0

CVE-2026-48326 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

EPSS 1.0%CVSS 9.9

CVE-2026-48331 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

EPSS 0.9%CVSS 10.0

CVE-2026-48333 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

EPSS 0.9%CVSS 9.8

CVE-2026-48317 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

EPSS 0.9%CVSS 9.6

Microsoft1 vulnerability on this pageMax CVSS 9.6Priority 42KEV 0

CVE-2026-66321 · Microsoft Microsoft Edge (Chromium-based)

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

EPSS 1%CVSS 9.6

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-68979 · Apache Software Foundation Apache NiFi

Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

EPSS 0.8%CVSS 9.8

CVE-2026-68980 · Apache Software Foundation Apache NiFi

Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

EPSS 0.5%CVSS 9.1

emlog1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2026-67598 · emlog emlog

Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

EPSS 0.3%public exploit CVSS 9.1

Tranquil IT Systems1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2026-33591 · Tranquil IT Systems WAPT Server

Authentication bypass on WaptServer

EPSS 0.7%CVSS 10.0

checkpoint1 vulnerability on this pageMax CVSS 9.3Priority 40KEV 0

CVE-2026-18574 · checkpoint Security Management Server

Authentication Bypass in Check Point Security Management Server

EPSS 0.9%CVSS 9.3

Tenable, Inc.1 vulnerability on this pageMax CVSS 9.6Priority 40KEV 0

CVE-2026-18667 · Tenable, Inc. Sensor Proxy

Sensor Proxy Version 1.4.2 Fixes One Vulnerability

EPSS 0.7%CVSS 9.6

Menulux Software Inc.1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-2346 · Menulux Software Inc. Mobile App

IDOR in Menulux Software's Mobile App

EPSS 0.5%CVSS 9.8

TIMLEGGE3 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-9390 · TIMLEGGE XML::Sig

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

EPSS 0.5%CVSS 9.1

CVE-2026-18108 · TIMLEGGE Net::SAML2

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature

EPSS 0.3%CVSS 9.8

CVE-2026-9487 · TIMLEGGE XML::Sig

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

EPSS 0.3%CVSS 9.1

@fastify/aws-lambda1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2026-18248 · @fastify/aws-lambda @fastify/aws-lambda

@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

EPSS 0.4%CVSS 9.1

misskey-dev1 vulnerability on this pageMax CVSS 9.2Priority 32KEV 0

CVE-2026-46713 · misskey-dev misskey

Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

EPSS 0.3%CVSS 9.2

WhiskeySockets1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-48063 · WhiskeySockets Baileys

Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

EPSS 0.2%CVSS 9.3

The archive.