Critical vulnerability archive — page 164

Oracle Corporation9 vulnerabilities on this pageMax CVSS 10.0Priority 99KEV 1

CVE-2026-46817 · Oracle Corporation Oracle Payments

Oracle E-Business Suite Improper Privilege Management Vulnerability

KEV · due 18 Jul EPSS 12%public exploit SSVC act CVSS 9.8

CVE-2026-46840 · Oracle Corporation Oracle REST Data Services

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service).

EPSS 0.7%CVSS 10.0

CVE-2026-34311 · Oracle Corporation Oracle Hospitality OPERA 5 Property Services

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera).

EPSS 0.5%CVSS 9.8

CVE-2026-46775 · Oracle Corporation Oracle REST Data Services

Vulnerability in Oracle REST Data Services (component: Core).

EPSS 0.4%CVSS 9.9

CVE-2026-46839 · Oracle Corporation Oracle REST Data Services

Vulnerability in Oracle REST Data Services (component: Core).

EPSS 0.4%CVSS 9.9

CVE-2026-46822 · Oracle Corporation Oracle iAssets

Vulnerability in the Oracle iAssets product of Oracle E-Business Suite (component: Internal Operations).

EPSS 0.3%CVSS 9.9

CVE-2026-46819 · Oracle Corporation Oracle Internet Procurement Connector

Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations).

EPSS 0.3%CVSS 9.1

CVE-2026-46824 · Oracle Corporation Oracle Universal Work Queue

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration).

EPSS 0.3%CVSS 9.9

CVE-2026-46833 · Oracle Corporation Oracle Database Server

Vulnerability in the Net Service component of Oracle Database Server.

EPSS 0.3%CVSS 9.0

flippercode1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-8732 · flippercode WP Maps Pro

WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

EPSS 20%CVSS 9.8

Hmbown2 vulnerabilities on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2026-45311 · Hmbown CodeWhale

CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

EPSS 0.6%public exploit CVSS 9.6

CVE-2026-45374 · Hmbown CodeWhale

CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

EPSS 0.4%public exploit CVSS 9.6

nyariv1 vulnerability on this pageMax CVSS 10.0Priority 48KEV 0

CVE-2026-43898 · nyariv SandboxJS

SandboxJS: Sandbox escape via Function.caller leakage of internal call op

EPSS 0.5%public exploit CVSS 10.0

portainer3 vulnerabilities on this pageMax CVSS 9.9Priority 45KEV 0

CVE-2026-44848 · portainer portainer

Portainer: Missing authorization on Docker plugin endpoints allows host RCE

EPSS 0.4%public exploit CVSS 9.4

CVE-2026-44881 · portainer portainer

Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

EPSS 0.5%CVSS 9.9

CVE-2026-44849 · portainer portainer

Portainer: Endpoint security bypass via Swarm service create/update

EPSS 0.4%CVSS 9.4

Acer4 vulnerabilities on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2026-49199 · Acer Predator Connect W6x

Predator Connect W6x: RCE via MQTT

EPSS 1%CVSS 10.0

CVE-2026-49200 · Acer Wave 7 router

Acer Wave 7 router: Broken Access Control

EPSS 0.5%CVSS 10.0

CVE-2026-49197 · Acer Predator Connect W6x

Predator Connect W6x: Improper Authentication

EPSS 0.3%CVSS 10.0

CVE-2026-49201 · Acer Wave 7 router

Acer Wave 7 router: Hardcoded Cryptographic Key

EPSS 0.3%CVSS 10.0

jpettitt1 vulnerability on this pageMax CVSS 9.6Priority 44KEV 0

CVE-2026-45323 · jpettitt meshcore-card

MeshCore Card: XSS vulnerability through meshcore node name

EPSS 0.3%public exploit CVSS 9.6

hwk-fr1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-8809 · hwk-fr Advanced Custom Fields: Extended

Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

EPSS 0.8%CVSS 9.8

Mautic2 vulnerabilities on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-9558 · Mautic

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.

EPSS 0.6%CVSS 9.9

CVE-2026-9559 · Mautic

A path traversal vulnerability exists in the campaign import feature of Mautic 7.

EPSS 0.6%CVSS 9.9

cloudnative-pg1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-44477 · cloudnative-pg cloudnative-pg

CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

EPSS 0.5%CVSS 9.9

glboy1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-3655 · glboy OTP Login With Phone Number, OTP Verification

OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification

EPSS 0.5%CVSS 9.8

Casdoor6 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-9094 · Casdoor Casdoor

CVE-2026-9094

EPSS 0.4%CVSS 9.8

CVE-2026-9093 · Casdoor Casdoor

CVE-2026-9093

EPSS 0.4%CVSS 9.8

CVE-2026-9097 · Casdoor Casdoor

CVE-2026-9097

EPSS 0.4%CVSS 9.8

CVE-2026-9092 · Casdoor Casdoor

CVE-2026-9092

EPSS 0.3%CVSS 9.1

CVE-2026-9090 · Casdoor Casdoor

CVE-2026-9090

EPSS 0.2%CVSS 9.1

CVE-2026-9098 · Casdoor Casdoor

CVE-2026-9098

EPSS 0.2%CVSS 9.1

gitbutlerapp1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-45261 · gitbutlerapp gitbutler

GitButler: Link injection via forge integration enables arbitrary script execution

EPSS 0.5%CVSS 9.3

ScadaBR1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-9645 · ScadaBR ScadaBR

ScadaBR Authenticated Remote Code Execution

EPSS 0.4%CVSS 9.9

JasperFx1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-45288 · JasperFx marten

Marten has an SQL injection vulnerability in its full-text search regConfig parameter

EPSS 0.4%CVSS 9.8

Google9 vulnerabilities on this pageMax CVSS 9.6Priority 35KEV 0

CVE-2026-9872 · Google Chrome

Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox…

EPSS 0.4%CVSS 9.6

CVE-2026-9874 · Google Chrome

Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a c…

EPSS 0.2%CVSS 9.6

CVE-2026-9875 · Google Chrome

Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbo…

EPSS 0.2%CVSS 9.6

CVE-2026-9876 · Google Chrome

Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox es…

EPSS 0.2%CVSS 9.6

CVE-2026-9886 · Google Chrome

Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape…

EPSS 0.2%CVSS 9.6

CVE-2026-9918 · Google Chrome

Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox…

EPSS 0.2%CVSS 9.6

CVE-2026-9967 · Google Chrome

Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via…

EPSS 0.2%CVSS 9.6

CVE-2026-9891 · Google Chrome

Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process…

EPSS 0.2%CVSS 9.0

CVE-2026-9881 · Google Chrome

Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicio…

EPSS 0.2%CVSS 9.0

Waterfall1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2025-41268 · Waterfall WF-500

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in vers…

EPSS 0.4%CVSS 9.1

rustfs1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-45039 · rustfs rustfs

RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

EPSS 0.3%CVSS 9.8

electerm3 vulnerabilities on this pageMax CVSS 9.4Priority 31KEV 0

CVE-2026-45058 · electerm electerm

electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark

EPSS 0.2%CVSS 9.4

CVE-2026-45353 · electerm electerm

electerm: Local code through electerm's single-instance socket

EPSS 0.1%CVSS 9.3

CVE-2026-45787 · electerm electerm

electerm's encrypt method not safe enough

EPSS 0.1%CVSS 9.1

XCharge1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-9037 · XCharge C6

Download of code without integrity check in XCharge C6

EPSS 0.2%CVSS 9.3

The archive.