Critical vulnerability archive — page 157

SimpleHelp1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2026-48558 · SimpleHelp SimpleHelp

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

KEV · due 2 Jul EPSS 80%public exploit SSVC act CVSS 10.0

patriksimek5 vulnerabilities on this pageMax CVSS 10.0Priority 55KEV 0

MacWarrior2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-42846 · MacWarrior clipbucket-v5

ClipBucket: Remote Play URL Command Injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2026-45060 · MacWarrior clipbucket-v5

ClipBucket: Blind SQL Injection in progress_video.php

EPSS 0.4%public exploit CVSS 9.8

apostrophecms2 vulnerabilities on this pageMax CVSS 9.3Priority 49KEV 0

CVE-2026-44990 · apostrophecms sanitize-html

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

EPSS 0.7%public exploit CVSS 9.3

CVE-2026-53609 · apostrophecms apostrophe

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

EPSS 0.3%public exploit CVSS 9.1

Amasty1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-53787 · Amasty Order Attributes for Magento 2

Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

EPSS 6%CVSS 9.8

Aqara6 vulnerabilities on this pageMax CVSS 10.0Priority 47KEV 0

CVE-2026-50085 · Aqara Board service

Aqara Board IoT insecure debug API

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-50083 · Aqara Aquara IAM/SSO Gateway

Aqara hardcoded OAuth client credentials

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-50086 · Aqara Aqara IAM/SSO Gateway

Aqara unauthenticated AES oracle

EPSS 0.3%public exploit CVSS 10.0

CVE-2026-50084 · Aqara Cloud Production API

Aqara API cross-account access

EPSS 0.2%public exploit CVSS 9.6

CVE-2026-50091 · Aqara com.lumiunited.aqarahome

Aqara Home Android SDK hardcoded keys

EPSS 0.3%public exploit CVSS 9.1

CVE-2026-50090 · Aqara Cloud OAuth Authorization Endpoint

Aqara OAuth redirect_uri validation bypass

EPSS 0.2%public exploit CVSS 9.3

jmespath1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-54133 · jmespath jmespath.php

jmespath.php has CompilerRuntime code injection via unescaped function names

EPSS 0.4%public exploit CVSS 9.8

nesquena1 vulnerability on this pageMax CVSS 9.4Priority 47KEV 0

CVE-2026-49973 · nesquena hermes-webui

Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings

EPSS 0.5%public exploit CVSS 9.4

nezhahq2 vulnerabilities on this pageMax CVSS 9.9Priority 47KEV 0

CVE-2026-46716 · nezhahq nezha

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

EPSS 0.4%public exploit CVSS 9.9

CVE-2026-53519 · nezhahq nezha

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

EPSS 2%CVSS 9.1

phpBB1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-48611 · phpBB phpBB

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading t…

EPSS 4%CVSS 9.8

Apache Software Foundation3 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-50627 · Apache Software Foundation Apache CXF

Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

EPSS 4%CVSS 9.1

CVE-2026-50628 · Apache Software Foundation Apache CXF

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

EPSS 0.7%CVSS 9.8

CVE-2026-49875 · Apache Software Foundation Apache CXF

Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

EPSS 0.5%CVSS 9.8

duck-organization1 vulnerability on this pageMax CVSS 9.5Priority 45KEV 0

CVE-2026-47174 · duck-organization duck-site

Duck Site: Untrusted pull request code can trigger privileged production deployment

EPSS 0.4%public exploit CVSS 9.5

Hippoo1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-49060 · Hippoo Hippoo Mobile App for WooCommerce

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

EPSS 2%CVSS 9.8

Chroma1 vulnerability on this pageMax CVSS 9.4Priority 44KEV 0

CVE-2026-45833 · Chroma ChromaDB

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrar…

EPSS 0.3%public exploit CVSS 9.4

MariaDB4 vulnerabilities on this pageMax CVSS 9.9Priority 44KEV 0

CVE-2026-44170 · MariaDB server

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

EPSS 1%CVSS 9.9

CVE-2026-48165 · MariaDB server

MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

EPSS 2%CVSS 9.1

CVE-2026-44172 · MariaDB server

MariaDB: mysql_real_escape_string() incorrectly handled big5

EPSS 1%CVSS 9.1

CVE-2026-48163 · MariaDB server

MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

EPSS 0.9%CVSS 9.1

Beardev1 vulnerability on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2026-42647 · Beardev JoomSport

WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

EPSS 1%CVSS 9.3

Ubiquiti Inc3 vulnerabilities on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-47367 · Ubiquiti Inc UID Enterprise Agent

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Ent…

EPSS 0.8%CVSS 9.9

CVE-2026-47370 · Ubiquiti Inc UniFi OS Server

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain…

EPSS 0.8%CVSS 9.9

CVE-2026-47369 · Ubiquiti Inc UniFi OS Server

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain…

EPSS 0.3%CVSS 9.9

WebPros1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-47365 · WebPros WordPress-Toolkit

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass…

EPSS 0.4%CVSS 9.9

CyberArk Software, a Palo Alto Networks Company1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-45177 · CyberArk Software, a Palo Alto Networks Company Conjur Cloud (Edge Finding only)

Idira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanism

EPSS 0.5%CVSS 9.1

netty2 vulnerabilities on this pageMax CVSS 10.0Priority 36KEV 0

CVE-2026-47691 · netty netty

Netty has Insufficient Bailiwick Validation for NS Records

EPSS 0.4%CVSS 10.0

CVE-2026-45674 · netty netty

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

EPSS 0.3%CVSS 10.0

Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co.1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-6853 · Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App

OTP Bypass in Başbelen Group's Pause+ Mobile App

EPSS 0.3%CVSS 9.8

IEI Integration Corp1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-11849 · IEI Integration Corp iRM-TSi410X

IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials

EPSS 0.4%CVSS 9.8

Naxclow2 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-28742 · Naxclow Smart Doorbell X3

Naxclow IoT Platform Use of hard-coded cryptographic key

EPSS 0.3%CVSS 9.8

CVE-2026-50101 · Naxclow Smart Doorbell X3

Naxclow IoT Platform Not using password aging

EPSS 0.3%CVSS 9.2

WBW Plugins1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-39494 · WBW Plugins Product Filter by WBW

WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Yarbo1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-10557 · Yarbo Yarbo Android/IOS mobile application

Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials

EPSS 0.4%CVSS 9.8

Zoom Communications1 vulnerability on this pageMax CVSS 9.8Priority 32KEV 0

CVE-2026-53407 · Zoom Communications Zoom Workplace

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may a…

EPSS 0.2%CVSS 9.8

Google1 vulnerability on this pageMax CVSS 9.6Priority 31KEV 0

CVE-2026-12027 · Google Chrome

Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the rende…

EPSS 0.2%CVSS 9.6

vivo1 vulnerability on this pageMax CVSS 9.4Priority 29KEV 0

CVE-2026-11535 · vivo PcSuite

An unauthorized access vulnerability exists in the PcSuite APP.

EPSS 0.2%CVSS 9.4

Cloud Foundry1 vulnerability on this pageMax CVSS 9.0Priority 28KEV 0

CVE-2026-41005 · Cloud Foundry UAA

UAA accepts SAML Encrypted Assertions authentication bypass

EPSS 0.1%CVSS 9.0

The archive.