Critical vulnerability archive — page 14

BeyondTrust1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2026-102764 · BeyondTrust Remote Support

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

KEV · due 19 Oct EPSS 19%public exploit SSVC act CVSS 9.8

Wavlink2 vulnerabilities on this pageMax CVSS 10.0Priority 58KEV 0

CVE-2026-110957 · Wavlink WL-WN530BE2-A

Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection

EPSS 3%public exploit CVSS 10.0

CVE-2026-110958 · Wavlink WN530HG4B

Wavlink WN530HG4B api.cgi heap-based overflow

EPSS 1%public exploit CVSS 10.0

mitre1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2026-104586 · mitre

AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

EPSS 2%public exploit CVSS 9.8

opnsense1 vulnerability on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2026-57155 · opnsense core

OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

EPSS 0.9%public exploit CVSS 9.9

msgbyte1 vulnerability on this pageMax CVSS 9.1Priority 48KEV 0

CVE-2026-55240 · msgbyte tianji

Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates

EPSS 0.7%public exploit CVSS 9.1

Eclipse Foundation2 vulnerabilities on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2026-19863 · Eclipse Foundation org.eclipse.jetty:jetty-ethereum

An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the config…

EPSS 0.5%public exploit CVSS 9.3

CVE-2026-102469 · Eclipse Foundation Eclipse Vert.x

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client)…

EPSS 0.5%CVSS 9.2

Labs641 vulnerability on this pageMax CVSS 9.6Priority 46KEV 0

CVE-2026-57496 · Labs64 NetLicensing-MCP

NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction

EPSS 0.4%public exploit CVSS 9.6

Nutanix1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-84731 · Nutanix Acropolis Operating System (AOS)

Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS

EPSS 1%CVSS 9.8

10web1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-108587 · 10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer

10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter

EPSS 0.9%CVSS 9.8

QNAP Systems Inc.4 vulnerabilities on this pageMax CVSS 9.4Priority 41KEV 0

CVE-2026-47786 · QNAP Systems Inc. HybridDesk Station

Pre-Authentication Command Injection

EPSS 1%CVSS 9.3

CVE-2026-34006 · QNAP Systems Inc. sMedio DTCP MOVE

Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer

EPSS 0.4%CVSS 9.3

CVE-2026-50612 · QNAP Systems Inc. QuMagie

Import Symlink Following Remote Code Execution Vulnerability in QuMagie

EPSS 0.4%CVSS 9.4

CVE-2026-50619 · QNAP Systems Inc. Qsirch

Unauthenticated remote code execution vulnerability

EPSS 0.4%CVSS 9.3

EnergizeLab4 vulnerabilities on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-105038 · EnergizeLab FastAPI AI inference server

EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

EPSS 0.6%CVSS 9.8

CVE-2026-105032 · EnergizeLab FastAPI AI inference server

EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write

EPSS 0.9%CVSS 9.1

CVE-2026-105037 · EnergizeLab station-middleware

EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EPSS 0.4%CVSS 9.9

CVE-2026-105039 · EnergizeLab station-middleware

EnergizeLab Station Middleware Admin APIs Missing Role Checks

EPSS 0.3%CVSS 9.6

Linux2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-99999 · Linux Linux

ipv4: validate checksum_start before completing checksum

EPSS 0.8%CVSS 9.3

CVE-2026-98432 · Linux Linux

ipv4: free inet_opt and ireq_opt after an RCU grace period

EPSS 0.4%CVSS 9.8

authlib1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-102946 · authlib joserfc

joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

EPSS 0.1%public exploit CVSS 9.1

WebPros1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2026-105474 · WebPros SolusVM 2

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrar…

EPSS 0.5%CVSS 9.4

AWS1 vulnerability on this pageMax CVSS 9.9Priority 36KEV 0

CVE-2026-110812 · AWS Amazon Neptune Engine

Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

EPSS 0.4%CVSS 9.9

gitpython-developers1 vulnerability on this pageMax CVSS 9.2Priority 36KEV 0

CVE-2026-110858 · gitpython-developers GitPython

GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

EPSS 0.5%CVSS 9.2

JetBrains1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-111094 · JetBrains TeamCity

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol wa…

EPSS 0.4%CVSS 9.8

containerd1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-47218 · containerd runwasi

runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

EPSS 0.4%CVSS 9.3

Diaple1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-101287 · Diaple Stela

Authentication bypass in Stela by Diaple Networking

EPSS 0.4%CVSS 9.3

espocrm1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-47168 · espocrm espocrm

EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EPSS 0.4%CVSS 9.1

Link Whisper INC2 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-109686 · Link Whisper INC Link Whisper Free

WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-109688 · Link Whisper INC Link Whisper Free

WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability

EPSS 0.2%CVSS 9.3

The OpenNMS Group1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2026-111235 · The OpenNMS Group Meridian

OpenNMS REST authorization bypass via non-canonical HTTP method

EPSS 0.4%CVSS 9.1

Wheels1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-110911 · Wheels Wheels

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as fi…

EPSS 0.3%CVSS 9.8

better-auth2 vulnerabilities on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2026-110862 · better-auth better-auth

Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

EPSS 0.3%CVSS 9.3

CVE-2026-110864 · better-auth better-auth

Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy

EPSS 0.3%CVSS 9.1

FreeBSD2 vulnerabilities on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-101306 · FreeBSD FreeBSD

Multiple jail filesystem root escapes

EPSS 0.3%CVSS 9.8

CVE-2026-101307 · FreeBSD FreeBSD

Remotely triggerable buffer overflow in tcp_rack

EPSS 0.3%CVSS 9.1

Mitsubishi Electric Corporation2 vulnerabilities on this pageMax CVSS 9.4Priority 33KEV 0

CVE-2026-16436 · Mitsubishi Electric Corporation GENESIS

An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

EPSS 0.3%CVSS 9.2

CVE-2026-16438 · Mitsubishi Electric Corporation GENESIS64

An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64

EPSS 0.3%CVSS 9.4

Shabti Kaplan1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-109892 · Shabti Kaplan Frontend Admin by DynamiApps

WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability

EPSS 0.3%CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-109145 · Unknown User Rights Access Manager

User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler

EPSS 0.3%CVSS 9.8

WP ManageNinja LLC1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-109694 · WP ManageNinja LLC Fluent CRM

WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

EPSS 0.3%CVSS 9.8

Kitae Park1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-109698 · Kitae Park Mang Board WP

WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

renovatebot1 vulnerability on this pageMax CVSS 9.0Priority 31KEV 0

CVE-2026-110867 · renovatebot renovate

Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset

EPSS 0.3%CVSS 9.0

TMS1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-108497 · TMS Amelia

WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability

EPSS 0.2%CVSS 9.3

Znuny1 vulnerability on this pageMax CVSS 9.5Priority 31KEV 0

CVE-2026-93483 · Znuny Znuny

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functi…

EPSS 0.2%CVSS 9.5

Hitachi Vantara2 vulnerabilities on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2026-108335 · Hitachi Vantara Remote Ops Agent

Password Reset Functionality Missing Brute-Force Protection

EPSS 0.2%CVSS 9.1

CVE-2026-108336 · Hitachi Vantara Remot Ops Agent

Token Signing Key Allows Unauthenticated Administrative Access

EPSS 0.2%CVSS 9.1

undici2 vulnerabilities on this pageMax CVSS 9.1Priority 29KEV 0

CVE-2026-109383 · undici undici

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

EPSS 0.2%CVSS 9.1

CVE-2026-109829 · undici undici

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

EPSS 0.1%CVSS 9.1

The archive.