Critical vulnerability archive — page 112

mitre4 vulnerabilities on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2026-51190 · mitre

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: t…

EPSS 2%public exploit CVSS 9.8

CVE-2026-51775 · mitre

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/control…

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-52102 · mitre

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary co…

EPSS 3%CVSS 9.8

CVE-2026-38447 · mitre

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.

EPSS 0.7%CVSS 9.8

Hugging Face1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-68770 · Hugging Face sentence-transformers

sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

EPSS 0.9%public exploit CVSS 9.8

FreeRDP7 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-67305 · FreeRDP FreeRDP

FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr

EPSS 0.8%public exploit CVSS 9.4

CVE-2026-67292 · FreeRDP FreeRDP

FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure

EPSS 0.5%public exploit CVSS 9.3

CVE-2026-67294 · FreeRDP FreeRDP

FreeRDP before 3.29.0 TLS Certificate EKU Bypass

EPSS 0.4%public exploit CVSS 9.3

CVE-2026-67289 · FreeRDP FreeRDP

FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

EPSS 0.4%CVSS 9.8

CVE-2026-68579 · FreeRDP FreeRDP

FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read

EPSS 0.5%CVSS 9.6

CVE-2026-66402 · FreeRDP FreeRDP

FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass

EPSS 0.3%CVSS 9.8

CVE-2026-67293 · FreeRDP FreeRDP

FreeRDP before 3.29.0 Improper Certificate Hostname Validation

EPSS 0.2%CVSS 9.3

wazuh1 vulnerability on this pageMax CVSS 9.3Priority 49KEV 0

CVE-2026-67308 · wazuh wazuh

Wazuh GitHub Actions Shell Injection via Fork Pull Request

EPSS 0.7%public exploit CVSS 9.3

realtyna1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-14483 · realtyna Realtyna Organic IDX plugin + WPL Real Estate

Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

EPSS 4%CVSS 9.8

bank-vaults1 vulnerability on this pageMax CVSS 9.6Priority 47KEV 0

CVE-2026-54725 · bank-vaults vault-secrets-webhook

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

EPSS 0.4%public exploit CVSS 9.6

Advantech3 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-43830 · Advantech ADAM-3600

A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.

EPSS 3%CVSS 9.8

CVE-2026-43831 · Advantech ADAM-3600

A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code exec…

EPSS 0.6%CVSS 9.2

CVE-2026-43832 · Advantech ADAM-3600

A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code executi…

EPSS 0.6%CVSS 9.2

Unknown3 vulnerabilities on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-13596 · Unknown Participants Database

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-14919 · Unknown ShopMonitor.io

ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute

EPSS 0.5%CVSS 9.8

CVE-2026-16256 · Unknown POUCO Import Users

Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation

EPSS 0.5%CVSS 9.8

Comfy-Org1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-68771 · Comfy-Org ComfyUI

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

EPSS 1%CVSS 9.8

go-vikunja1 vulnerability on this pageMax CVSS 9.3Priority 43KEV 0

CVE-2026-68582 · go-vikunja vikunja

Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

EPSS 0.3%public exploit CVSS 9.3

britcoder1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-15964 · britcoder Single Sign On For TNG

Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change

EPSS 0.9%CVSS 9.8

codeigniter42 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-63223 · codeigniter4 CodeIgniter4

CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

EPSS 0.8%CVSS 9.8

CVE-2026-63221 · codeigniter4 CodeIgniter4

CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

EPSS 0.6%CVSS 9.4

laughingman77431 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-65321 · laughingman7743 PyAthena

PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

EPSS 0.8%CVSS 9.8

better-auth3 vulnerabilities on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-67330 · better-auth scim

better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision

EPSS 0.6%CVSS 9.9

CVE-2025-71401 · better-auth better-auth

better-auth before 1.4.2 basePath Modification DoS

EPSS 0.5%CVSS 9.3

CVE-2026-67336 · better-auth better-auth

better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

EPSS 0.2%CVSS 9.4

pgadmin.org3 vulnerabilities on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-17566 · pgadmin.org pgAdmin 4

pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

EPSS 0.7%CVSS 9.9

CVE-2026-17351 · pgadmin.org pgAdmin 4

pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

EPSS 0.5%CVSS 9.4

CVE-2026-17349 · pgadmin.org pgAdmin 4

pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

EPSS 0.4%CVSS 9.6

Rich Source1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-18452 · Rich Source DMS+ (Non-Mobile)

Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

EPSS 0.6%CVSS 10.0

WPWeb1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-8457 · WPWeb WooCommerce - Social Login

WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

EPSS 0.7%CVSS 9.8

ArcadeData2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-67341 · ArcadeData arcadedb

ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

EPSS 0.5%CVSS 9.8

CVE-2026-67342 · ArcadeData arcadedb

ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

EPSS 0.5%CVSS 9.8

Innotim Software, Telecommunications and Consulting Trade Ltd. Co.1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-17561 · Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM

Unauthenticated RCE in Innotim Software's Logsign SIEM

EPSS 0.6%CVSS 9.8

wpwax1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-3141 · wpwax FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More

FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter

EPSS 0.9%CVSS 9.1

Johnson Controls1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-21662 · Johnson Controls FM Systems Employee

FMS Employee Allows Upload of Unrestricted Files

EPSS 0.5%CVSS 9.8

pterodactyl1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-52855 · pterodactyl wings

Wings exposes node configuration secrets through egg configuration-file templating

EPSS 0.5%CVSS 9.9

VPS.org2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-16504 · VPS.org Zulip template

VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities

EPSS 0.5%CVSS 9.8

CVE-2026-16503 · VPS.org Supabase template

VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

EPSS 0.4%CVSS 9.1

WebPros1 vulnerability on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-58048 · WebPros cPanel

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

EPSS 0.6%CVSS 9.4

gitpython-developers1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-67324 · gitpython-developers GitPython

GitPython 3.1.50 Authentication Bypass via Joined Short Options

EPSS 0.5%CVSS 9.8

PHP Jabbers1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2025-67649 · PHP Jabbers Car Rental Script

Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script

EPSS 0.4%CVSS 9.3

Legion of the Bouncy Castle Inc.4 vulnerabilities on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-8763 · Legion of the Bouncy Castle Inc. BC-JAVA

Name Constraints bypass via trailing dot in rfc822Name and URI

EPSS 0.4%CVSS 9.3

CVE-2026-58062 · Legion of the Bouncy Castle Inc. BC-JAVA

Stapled OCSP response accepted without binding to the checked certificate

EPSS 0.4%CVSS 9.3

CVE-2026-59638 · Legion of the Bouncy Castle Inc. BC-JAVA

JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

EPSS 0.3%CVSS 9.3

CVE-2026-59650 · Legion of the Bouncy Castle Inc. BC-JAVA

MTI/A0 DH agreement exponentiates unvalidated peer value

EPSS 0.3%CVSS 9.3

The archive.