Critical vulnerability archive — page 135

MervinPraison3 vulnerabilities on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2026-61447 · MervinPraison PraisonAI

PraisonAI before 1.6.78 Remote Code Execution via CodeAgent

EPSS 15%public exploit CVSS 10.0

CVE-2026-60090 · MervinPraison PraisonAI

PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension

EPSS 0.7%public exploit CVSS 9.8

CVE-2026-61445 · MervinPraison PraisonAI

PraisonAI before 4.6.78 Arbitrary File Write and Command Execution

EPSS 0.6%public exploit CVSS 9.9

Comfast1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2026-15511 · Comfast CF-WR631AX V3

Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection

EPSS 5%public exploit CVSS 9.8

openwrt1 vulnerability on this pageMax CVSS 9.4Priority 53KEV 0

CVE-2026-61876 · openwrt luci

LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

EPSS 2%public exploit CVSS 9.4

mitre7 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-51821 · mitre

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /…

EPSS 0.7%public exploit CVSS 9.8

CVE-2026-51540 · mitre

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the…

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-52533 · mitre

An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-51537 · mitre

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when p…

EPSS 0.6%public exploit CVSS 9.1

CVE-2026-51536 · mitre

In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsis…

EPSS 0.6%public exploit CVSS 9.1

CVE-2026-51541 · mitre

OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a for…

EPSS 0.6%public exploit CVSS 9.1

CVE-2026-51538 · mitre

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessi…

EPSS 0.5%public exploit CVSS 9.1

zephyrproject1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-10666 · zephyrproject zephyr

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

EPSS 0.7%public exploit CVSS 9.8

rsjoomla.com1 vulnerability on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2026-57827 · rsjoomla.com rsjoomla.com RSFiles extension for Joomla

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

EPSS 17%CVSS 10.0

Drupal5 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-10768 · Drupal LocalGov Workflows

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

EPSS 2%CVSS 9.8

CVE-2026-11913 · Drupal Mother May I

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

EPSS 0.6%CVSS 9.8

CVE-2026-12535 · Drupal Formatter Field

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

EPSS 0.6%CVSS 9.8

CVE-2026-9726 · Drupal Drupal AlternativeCommerce (Basket)

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

EPSS 0.6%CVSS 9.8

CVE-2026-15089 · Drupal Commerce guest registration

Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079

EPSS 0.4%CVSS 9.1

Unknown1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2026-11964 · Unknown User Registration & Membership

User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation

EPSS 0.5%public exploit CVSS 9.1

Hydro-Québec1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-20744 · Hydro-Québec Le Circuit Electrique charging station backend

Hydro-Québec Le Circuit Electrique charging station backend Improper Access Control

EPSS 0.8%CVSS 9.8

WAGO1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-4769 · WAGO 0765-110x/0100-0000

Unauthenticated Access to Internal Diagnostic Interface

EPSS 0.8%CVSS 9.8

Centreon1 vulnerability on this pageMax CVSS 9.6Priority 40KEV 0

CVE-2026-14453 · Centreon Infra Monitoring

A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets

EPSS 0.8%CVSS 9.6

Flowise1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-56271 · Flowise Flowise

Flowise - Weak Default JWT Secrets in Authentication Middleware

EPSS 0.7%CVSS 9.8

miniOrange Security Software Pvt Ltd.1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-57807 · miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client)

WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability

EPSS 0.7%CVSS 9.8

OpenPLC1 vulnerability on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-14480 · OpenPLC OpenPLC

OpenPLC v3 External Control of File Name or Path

EPSS 0.6%CVSS 9.9

axiomthemes1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-57738 · axiomthemes 777

WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Brainstorm Force1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-57401 · Brainstorm Force SureDash

WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability

EPSS 0.5%CVSS 9.9

CodeRevolution1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-57719 · CodeRevolution Aimogen Pro

WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

Realtyna1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-57811 · Realtyna Realtyna Organic IDX plugin

WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability

EPSS 0.6%CVSS 10.0

stmcan1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-57744 · stmcan RT-Theme 18 | Extensions

WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

ThemeGoods1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-57770 · ThemeGoods Grand Photography

WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Themeum2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-57724 · Themeum Kirki

WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

CVE-2026-57726 · Themeum Kirki

WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

wpWax1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-59518 · wpWax Directorist

WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Crawl4AI1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-56260 · Crawl4AI Crawl4AI

Crawl4AI - Arbitrary File Write via output_path Parameter

EPSS 0.6%CVSS 9.1

properfraction1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-57813 · properfraction MailOptin

WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

quantumcloud2 vulnerabilities on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-57710 · quantumcloud WoowBot Pro Max

WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

CVE-2026-57707 · quantumcloud Simple Business Directory Pro

WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-41041 · Apache Software Foundation Apache Gravitino

Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

EPSS 0.6%CVSS 9.1

openreplay1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-55879 · openreplay openreplay

OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover

EPSS 0.5%CVSS 9.3

joomshaper.com1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-57830 · joomshaper.com Helix Ultimate extension for Joomla

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7

EPSS 0.5%CVSS 9.1

Melograno Venture Studio1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2026-57702 · Melograno Venture Studio Amelia

WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.3

phoca.cz1 vulnerability on this pageMax CVSS 9.0Priority 36KEV 0

CVE-2026-57828 · phoca.cz phoca.cz Phoca Download extension for Joomla

Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3

EPSS 0.5%CVSS 9.0

tilt-dev1 vulnerability on this pageMax CVSS 9.2Priority 36KEV 0

CVE-2026-55884 · tilt-dev tilt

Tilt: Missing authentication on the network-exposed Tilt HUD server

EPSS 0.5%CVSS 9.2

AcyMailing Newsletter Team1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-57739 · AcyMailing Newsletter Team AcyMailing SMTP Newsletter

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

LatePoint1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-57714 · LatePoint LatePoint

WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Sergey1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-59515 · Sergey AIWU

WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

ImageMagick1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2026-56372 · ImageMagick ImageMagick

ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method

EPSS 0.3%CVSS 9.1

EVbee1 vulnerability on this pageMax CVSS 9.5Priority 32KEV 0

CVE-2026-22093 · EVbee EVbee Service

Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

EPSS 0.3%CVSS 9.5

The archive.