Critical vulnerability archive — page 144

Flowise5 vulnerabilities on this pageMax CVSS 10.0Priority 58KEV 0

CVE-2025-71334 · Flowise Flowise

Flowise - Arbitrary File Access via Missing Chat Flow ID Validation

EPSS 4%public exploit CVSS 9.8

CVE-2025-71338 · Flowise Flowise

Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API

EPSS 1%public exploit CVSS 10.0

CVE-2025-71336 · Flowise Flowise

Flowise - Unsandboxed Remote Code Execution via Custom MCP

EPSS 1%public exploit CVSS 9.8

CVE-2025-71333 · Flowise Flowise

Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-71327 · Flowise Flowise

Flowise - Authentication Bypass via Unprotected Registration Endpoint

EPSS 0.7%public exploit CVSS 9.3

jdx1 vulnerability on this pageMax CVSS 9.6Priority 47KEV 0

CVE-2026-33646 · jdx mise

mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

EPSS 0.5%public exploit CVSS 9.6

Wolfram Research Inc.1 vulnerability on this pageMax CVSS 9.6Priority 47KEV 0

CVE-2025-11919 · Wolfram Research Inc. Cloud

Unprotected temporary directories in Wolfram Cloud may result in privilege escalation

EPSS 0.5%public exploit CVSS 9.6

oooorgle1 vulnerability on this pageMax CVSS 9.3Priority 43KEV 0

CVE-2026-56062 · oooorgle Quotes llama

WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability

EPSS 1%CVSS 9.3

ThemeHunk1 vulnerability on this pageMax CVSS 9.3Priority 43KEV 0

CVE-2026-56070 · ThemeHunk Advance Product Search

WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability

EPSS 1%CVSS 9.3

Canonical1 vulnerability on this pageMax CVSS 9.6Priority 42KEV 0

CVE-2026-12411 · Canonical lxd

Broken Access Control in Canonical LXD DevLXD API

EPSS 0.2%public exploit CVSS 9.6

Edgewall *Genshi*1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-0685 · Edgewall *Genshi* Genshi

Server side template inject (SSTI) in Edgewall Genshi Template Engine

EPSS 0.9%CVSS 9.8

GeoVision Inc.4 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-57878 · GeoVision Inc. GV-LPCLPC2011/2211

GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd)

EPSS 1.0%CVSS 9.8

CVE-2026-57879 · GeoVision Inc. GV-LPCLPC2011/2211

GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr)

EPSS 0.9%CVSS 9.8

CVE-2026-57880 · GeoVision Inc. GV-LPCLPC2011/2211

GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr)

EPSS 0.9%CVSS 9.8

CVE-2026-57881 · GeoVision Inc. GV-LPCLPC2011/2211

GV-LPC2011/LPC2211 - unauthorized stack-based buffer overflow vulnerability (vlsvr)

EPSS 0.6%CVSS 9.8

BuddyBoss1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-56032 · BuddyBoss Buddyboss Platform

WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

dokku4 vulnerabilities on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-54636 · dokku dokku

Dokku: OS Command Injection via app.json managed Cron

EPSS 0.5%CVSS 9.9

CVE-2026-45406 · dokku dokku

Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval

EPSS 0.5%CVSS 9.0

CVE-2026-45405 · dokku dokku

Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add

EPSS 0.5%CVSS 9.0

CVE-2026-45408 · dokku dokku

Dokku: OS Command Injection via App Name in Git Pre-Receive Hook

EPSS 0.4%CVSS 9.0

Uncanny Owl1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-56057 · Uncanny Owl Uncanny Automator Pro

WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Dokan Multivendor Plugin1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-56033 · Dokan Multivendor Plugin Dokan Pro

WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

EVoke1 vulnerability on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-40702 · EVoke EVoke CSMS

EVoke Systems EVoke CSMS Missing Authentication for Critical Function

EPSS 0.6%CVSS 9.4

opf4 vulnerabilities on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-46386 · opf openproject

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

EPSS 0.5%CVSS 9.9

CVE-2026-52782 · opf openproject

OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources

EPSS 0.5%CVSS 9.9

CVE-2026-52780 · opf openproject

OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

EPSS 0.4%CVSS 9.6

CVE-2026-52785 · opf openproject

OpenProject: SQL injection in timestamps functionality

EPSS 0.4%CVSS 9.9

paytiumsupport1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-56030 · paytiumsupport Paytium

WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

PhysCode1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-56059 · PhysCode Travel Booking

WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Pluggabl1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-56027 · Pluggabl Booster for WooCommerce

WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

pydicom1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-56445 · pydicom pynetdicom Library

pydicom pynetdicom Library Path Traversal

EPSS 0.6%CVSS 9.1

ThemeCatcher1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-56058 · ThemeCatcher Quform

WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

themewant1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-56028 · themewant Easy Elements for Elementor – Addons & Website Templates

WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

WSO21 vulnerability on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2026-2053 · WSO2 WSO2 API Manager

Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

EPSS 0.4%CVSS 10.0

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2025-55017 · Apache Software Foundation Apache IoTDB

Apache IoTDB: Path Traversal Vulnerability

EPSS 0.5%CVSS 9.1

CVE-2025-64152 · Apache Software Foundation Apache IoTDB

Apache IoTDB: Path Traversal Vulnerability

EPSS 0.5%CVSS 9.1

Crocoblock. Jetimpex Inc.3 vulnerabilities on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2026-56067 · Crocoblock. Jetimpex Inc. JetSmartFilters

WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.3

CVE-2026-54820 · Crocoblock. Jetimpex Inc. JetBooking

WordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

CVE-2026-56068 · Crocoblock. Jetimpex Inc. JetEngine

WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Linux1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-53309 · Linux Linux

ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

EPSS 0.4%CVSS 9.8

Templatespare1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-57658 · Templatespare TemplateSpare

WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.1

codemstory1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-56036 · codemstory 워드프레스 결제 심플페이

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

contempoinc1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-54827 · contempoinc Real Estate 7

WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

JetBrains2 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-53914 · JetBrains Kotlin

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

EPSS 0.4%CVSS 9.8

CVE-2026-57926 · JetBrains YouTrack

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

EPSS 0.3%CVSS 9.8

Online Web Tutor1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-56034 · Online Web Tutor Library Management System

WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Paolo1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-54831 · Paolo GeoDirectory

WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Shenzhen i365-Tech Co. Ltd.1 vulnerability on this pageMax CVSS 9.2Priority 35KEV 0

CVE-2026-9222 · Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker

Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication

EPSS 0.4%CVSS 9.2

wpDataTables1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-54825 · wpDataTables wpDataTables

WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

nodejs1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-48930 · nodejs node

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncatio…

EPSS 0.3%CVSS 9.8

The archive.