The archive.

CVE-2026-48313 · Adobe ColdFusion 2025

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

EPSS 3%CVSS 9.3

CVE-2026-48276 · Adobe ColdFusion 2025

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

CVE-2026-48277 · Adobe ColdFusion 2025

ColdFusion | Improper Input Validation (CWE-20)

CVE-2026-48283 · Adobe ColdFusion 2025

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

CVE-2026-48286 · Adobe Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

CVE-2026-48315 · Adobe ColdFusion 2025

ColdFusion | Improper Input Validation (CWE-20)

EPSS 1%CVSS 9.3

joomlack.fr1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2026-56290 · joomlack.fr JoomlaCK.fr Page Builder CK extension for Joomla

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

KEV · due 10 Jul EPSS 31%public exploit SSVC act CVSS 10.0

kestra-io2 vulnerabilities on this pageMax CVSS 10.0Priority 96KEV 1

CVE-2026-49869 · kestra-io kestra

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

KEV · due 5 Sep EPSS 2%public exploit SSVC act CVSS 10.0

CVE-2026-53576 · kestra-io kestra

Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

EPSS 3%public exploit CVSS 10.0

NetScaler2 vulnerabilities on this pageMax CVSS 9.8Priority 92KEV 1

CVE-2026-8452 · NetScaler ADC

Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service

KEV · due 29 Aug EPSS 1%public exploit SSVC act CVSS 9.8

CVE-2026-8655 · NetScaler ADC

Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service

hiyouga1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-58116 · hiyouga LlamaFactory

LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

EPSS 0.9%public exploit CVSS 9.8

AWS2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-13762 · AWS Amazon CloudFront

HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-13763 · AWS AWS Application Load Balancer

HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF

EPSS 0.7%CVSS 9.8

mitre2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-37106 · mitre

An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php.

EPSS 0.7%public exploit CVSS 9.8

CVE-2026-37637 · mitre

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component

EPSS 0.6%public exploit CVSS 9.1

Budibase4 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

OpenBMB1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2026-58166 · OpenBMB ChatDev

OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete

EPSS 0.9%public exploit CVSS 9.1

Gitea1 vulnerability on this pageMax CVSS 9.9Priority 47KEV 0

CVE-2026-58053 · Gitea act_runner

Gitea act_runner - Container Hardening Bypass via Workflow Container Options

EPSS 0.4%public exploit CVSS 9.9

gorse-io1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-56782 · gorse-io gorse

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

EPSS 4%CVSS 9.8

coollabsio1 vulnerability on this pageMax CVSS 9.6Priority 44KEV 0

CVE-2026-57498 · coollabsio coolify

Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers

EPSS 0.3%public exploit CVSS 9.6

pravel1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-12415 · pravel Invoice Generator

Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

EPSS 0.8%CVSS 9.8

Advantech1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-14162 · Advantech Hospital Quering Management

Advantech｜Hospital Quering Management - Missing Authentication

Daktronics2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-28701 · Daktronics VFC-DMP-5000

Daktronics Controller Firmware Path Traversal

EPSS 0.7%CVSS 9.8

CVE-2026-31928 · Daktronics VFC-DMP-5000

Daktronics Controller Firmware Use of Hard-coded Credentials

EventON1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-9711 · EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin

EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter

EXODIST1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-13766 · EXODIST DBIx::QuickORM

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers

joomcoder.com1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-49048 · joomcoder.com JoomCCK extension for Joomla

Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1

videowhisper1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-57331 · videowhisper Paid Videochat Turnkey Site

WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability

EPSS 0.5%CVSS 9.9

Apple1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-39868 · Apple iOS and iPadOS

This issue was addressed with improved input validation.

EPSS 0.7%CVSS 9.1

Eksagate Electronic Engineering and Computer Industry Trade Inc.1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-8402 · Eksagate Electronic Engineering and Computer Industry Trade Inc. SYSGUARD 6001

SQLi in Exagate's SYSGUARD 6001

metagauss1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-12073 · metagauss ProfileGrid – User Profiles, Groups and Communities

ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-53434 · Apache Software Foundation Apache Tomcat

Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

EPSS 0.6%CVSS 9.1

CVE-2026-55276 · Apache Software Foundation Apache Tomcat

Apache Tomcat: Logged effective web.xml is incomplete

EPSS 0.6%CVSS 9.1

deltaww2 vulnerabilities on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-12819 · deltaww DVP-12SE

DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability

CVE-2026-12818 · deltaww DVP-12SE

DVP-12SE Exposure of Sensitive Information Vulnerability

EPSS 0.4%CVSS 9.3

GNOME1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-58016 · GNOME GLib

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

EPSS 0.6%CVSS 9.1

Google1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-11720 · Google MCP Toolbox for Databases (googleapis/mcp-toolbox)

Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder

Mozilla1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-14241 · Mozilla Firefox

Memory safety bugs fixed in Firefox 152.0.4

EPSS 0.4%CVSS 9.8

Raytha1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-12076 · Raytha Raytha

SQL Injection in Raytha CMS

Redeight1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-53690 · Redeight Redeight CMS

SQL Injection in Redeight CMS