Critical vulnerability archive — page 146

gogs3 vulnerabilities on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2026-52806 · gogs gogs

Gogs: RCE via git rebase --exec argument injection in pull request merge

EPSS 8%public exploit CVSS 9.9

CVE-2026-52813 · gogs gogs

Gogs: Path Traversal in organization name results in RCE through Git hooks

EPSS 1%public exploit CVSS 10.0

CVE-2026-52811 · gogs gogs

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

EPSS 0.5%CVSS 9.0

siyuan-note5 vulnerabilities on this pageMax CVSS 9.9Priority 57KEV 0

CVE-2026-54069 · siyuan-note siyuan

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

EPSS 7%public exploit CVSS 9.2

CVE-2026-50551 · siyuan-note siyuan

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

EPSS 0.6%public exploit CVSS 9.9

CVE-2026-54067 · siyuan-note siyuan

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

EPSS 0.4%public exploit CVSS 9.9

CVE-2026-54158 · siyuan-note siyuan

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

EPSS 0.4%public exploit CVSS 9.9

CVE-2026-55570 · siyuan-note siyuan

SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)

EPSS 0.4%public exploit CVSS 9.0

appsmithorg2 vulnerabilities on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2026-55454 · appsmithorg appsmith

Appsmith: Caddy admin API exposed without authentication

EPSS 0.6%public exploit CVSS 9.9

CVE-2026-55455 · appsmithorg appsmith

Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

EPSS 0.4%public exploit CVSS 9.1

RocketChat4 vulnerabilities on this pageMax CVSS 9.3Priority 46KEV 0

CVE-2026-45688 · RocketChat Rocket.Chat

Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-45689 · RocketChat Rocket.Chat

Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-55666 · RocketChat Rocket.Chat

Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

EPSS 0.4%CVSS 9.3

CVE-2026-46423 · RocketChat Rocket.Chat

Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty

EPSS 0.2%CVSS 9.3

Cacti5 vulnerabilities on this pageMax CVSS 9.8Priority 45KEV 0

Rapid74 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-8592 · Rapid7 InsightConnect AWK Plugin

OS Command Injection in Rapid7 InsightConnect AWK Plugin

EPSS 1%CVSS 9.8

CVE-2026-8660 · Rapid7 InsightConnect Ping Plugin

OS Command Injection in Rapid7 InsightConnect Ping Plugin

EPSS 1%CVSS 9.8

CVE-2026-8665 · Rapid7 InsightConnect TR Plugin

OS Command Injection in Rapid7 InsightConnect Translate Plugin

EPSS 1%CVSS 9.8

CVE-2026-8666 · Rapid7 InsightConnect Traceroute Plugin

OS Command Injection in Rapid7 InsightConnect Traceroute Plugin

EPSS 1%CVSS 9.8

Linux19 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-53176 · Linux Linux

IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

EPSS 0.8%CVSS 9.8

CVE-2026-53046 · Linux Linux

ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

EPSS 0.7%CVSS 9.8

CVE-2026-53151 · Linux Linux

rxrpc: Fix the ACK parser to extract the SACK table for parsing

EPSS 0.7%CVSS 9.8

CVE-2026-53247 · Linux Linux

net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

EPSS 0.7%CVSS 9.8

CVE-2026-53221 · Linux Linux

ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

EPSS 0.6%CVSS 9.8

CVE-2026-53228 · Linux Linux

ipv6: sit: reload inner IPv6 header after GSO offloads

EPSS 0.6%CVSS 9.8

CVE-2026-53045 · Linux Linux

memory: tegra124-emc: Fix dll_change check

EPSS 0.5%CVSS 9.8

CVE-2026-53215 · Linux Linux

net: mvpp2: refill RX buffers before XDP or skb use

EPSS 0.5%CVSS 9.8

CVE-2026-53216 · Linux Linux

net: mvpp2: limit XDP frame size to the RX buffer

EPSS 0.5%CVSS 9.8

CVE-2026-53055 · Linux Linux

crypto: hisilicon/sec2 - prevent req used-after-free for sec

EPSS 0.4%CVSS 9.8

CVE-2026-53224 · Linux Linux

sctp: validate embedded INIT chunk and address list lengths in cookie

EPSS 0.6%CVSS 9.1

CVE-2026-53225 · Linux Linux

sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

EPSS 0.6%CVSS 9.1

CVE-2026-53246 · Linux Linux

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

EPSS 0.4%CVSS 9.8

CVE-2026-53049 · Linux Linux

gfs2: add some missing log locking

EPSS 0.4%CVSS 9.8

CVE-2026-53088 · Linux Linux

net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

EPSS 0.4%CVSS 9.8

CVE-2026-53131 · Linux Linux

netfilter: require Ethernet MAC header before using eth_hdr()

EPSS 0.4%CVSS 9.4

CVE-2026-53186 · Linux Linux

RDMA/srp: bound SRP_RSP sense copy by the received length

EPSS 0.5%CVSS 9.1

CVE-2026-53086 · Linux Linux

net: bcmgenet: fix racing timeout handler

EPSS 0.3%CVSS 9.8

CVE-2026-53175 · Linux Linux

inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

EPSS 0.3%CVSS 9.8

rclone1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-49980 · rclone rclone

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

EPSS 0.8%CVSS 9.8

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2026-46752 · Apache Software Foundation Apache Kvrocks

Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()

EPSS 0.5%CVSS 10.0

CVE-2026-41566 · Apache Software Foundation Apache Kvrocks

Apache Kvrocks: Improper permission for the APPLYBATCH command

EPSS 0.4%CVSS 9.4

docling-project1 vulnerability on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-44020 · docling-project docling

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

EPSS 0.6%CVSS 9.4

TryGhost1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2026-53943 · TryGhost Ghost

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

EPSS 0.4%CVSS 9.6

FOSSBilling1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2026-33543 · FOSSBilling FOSSBilling

FOSSBilling: Authentication bypass allows unauthenticated administrator creation

EPSS 0.4%CVSS 9.3

Google2 vulnerabilities on this pageMax CVSS 9.6Priority 34KEV 0

CVE-2026-13028 · Google Chrome

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox es…

EPSS 0.3%CVSS 9.6

CVE-2026-13032 · Google Chrome

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox es…

EPSS 0.3%CVSS 9.6

The archive.