The archive.

CVE-2026-35222 · Joomla! Project Joomla! CMS

Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags

CVE-2026-48898 · Joomla! Project Joomla! CMS

Joomla! Core - [20260513] - Privilege escalation through com_users batch task

CVE-2026-48902 · Joomla! Project Joomla! CMS

Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

CVE-2026-48899 · Joomla! Project Joomla! CMS

Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins

EPSS 0.2%CVSS 9.8

twentyhq1 vulnerability on this pageMax CVSS 9.9Priority 48KEV 0

CVE-2026-46624 · twentyhq twenty

Twenty: SQL Injection via the timeZone field

EPSS 0.5%public exploit CVSS 9.9

VowpalWabbit1 vulnerability on this pageMax CVSS 9.9Priority 48KEV 0

CVE-2026-44723 · VowpalWabbit vowpal_wabbit

Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner

EPSS 0.5%public exploit CVSS 9.9

GitHub1 vulnerability on this pageMax CVSS 9.2Priority 47KEV 0

CVE-2026-9312 · GitHub Enterprise Server

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint

EPSS 9%CVSS 9.2

Red Hat1 vulnerability on this pageMax CVSS 9.0Priority 47KEV 0

CVE-2026-4480 · Red Hat Red Hat Enterprise Linux 10

Samba: samba: remote code execution in printing subsystem via unescaped job description

EPSS 29%CVSS 9.0

Synology2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-12686 · Synology BeeStation OS

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.…

EPSS 3%CVSS 9.8

CVE-2025-13392 · Synology DiskStation Manager (DSM)

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and…

factionsecurity1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-44668 · factionsecurity faction

Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates

EPSS 0.4%public exploit CVSS 9.8

dotCMS1 vulnerability on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2026-8054 · dotCMS dotCMS Core

Unauthenticated SQL Injection in dotCMS Publish Audit API

EPSS 2%CVSS 10.0

prolix-oc4 vulnerabilities on this pageMax CVSS 9.9Priority 45KEV 0

CVE-2026-44449 · prolix-oc Lumiverse

Lumiverse: SMB `exists()` basename injection via smbclient `!cmd` escape

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-44444 · prolix-oc Lumiverse

Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-44451 · prolix-oc Lumiverse

Lumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass

EPSS 0.2%public exploit CVSS 9.3

CVE-2026-44450 · prolix-oc Lumiverse

Lumiverse: RCE via MCP stdio argument injection

EPSS 0.4%CVSS 9.9

xyproto1 vulnerability on this pageMax CVSS 9.0Priority 45KEV 0

CVE-2026-45721 · xyproto algernon

Algernon: handler.lua discovery walks parent directories above the server root

EPSS 0.4%public exploit CVSS 9.0

yoda-digital1 vulnerability on this pageMax CVSS 9.2Priority 45KEV 0

CVE-2026-44895 · yoda-digital mcp-gitlab-server

GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools

EPSS 0.4%public exploit CVSS 9.2

IBM6 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-8633 · IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins

EPSS 0.9%CVSS 9.8

CVE-2026-3660 · IBM Engineering Lifecycle Management

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass

EPSS 0.6%CVSS 9.8

CVE-2026-9170 · IBM HTTP Server

IBM HTTP Server is affected by multiple vulnerabilities

CVE-2026-8855 · IBM HTTP Server

IBM HTTP Server is affected by multiple vulnerabilities

CVE-2025-36220 · IBM Cloud Pak for Data System - Cyclops

Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.

CVE-2026-8856 · IBM HTTP Server

IBM HTTP Server is affected by multiple vulnerabilities

EPSS 0.2%CVSS 9.1

india-web-developer1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-8760 · india-web-developer Login with OTP

Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force

EPSS 1%CVSS 9.8

OALDERS1 vulnerability on this pageMax CVSS 9.1Priority 42KEV 0

CVE-2026-8450 · OALDERS HTTP::Daemon

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

EPSS 1%CVSS 9.1

amir201 vulnerability on this pageMax CVSS 9.6Priority 41KEV 0

CVE-2026-44985 · amir20 dozzle

Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication

EPSS 0.2%public exploit CVSS 9.6

NVIDIA1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-24212 · NVIDIA Isaac Launchable

NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text.

EPSS 0.7%CVSS 9.8

shepherdwind1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-44966 · shepherdwind velocity.js

Velocity.js: Prototype Pollution in #set path assignment

Eppendorf1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-7251 · Eppendorf BioFlo 320

Eppendorf BioFlo 320 Use of hard-coded password

OpenVPN Inc1 vulnerability on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-9560 · OpenVPN Inc OpenVPN Connect

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary command…

EPSS 0.6%CVSS 9.4

Saleswonder Team: Tobias2 vulnerabilities on this pageMax CVSS 9.9Priority 36KEV 0

CVE-2026-42757 · Saleswonder Team: Tobias WebinarIgnition

WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability

EPSS 0.4%CVSS 9.9

CVE-2026-42758 · Saleswonder Team: Tobias WebinarIgnition

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

Ludwig You1 vulnerability on this pageMax CVSS 9.9Priority 35KEV 0

CVE-2026-42756 · Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly

WordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerability

EPSS 0.3%CVSS 9.9

miniOrange1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-42731 · miniOrange miniorange otp verification

WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability

Google Cloud1 vulnerability on this pageMax CVSS 9.2Priority 34KEV 0

CVE-2026-2264 · Google Cloud Apigee-X

Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.

EPSS 0.4%CVSS 9.2

WPify1 vulnerability on this pageMax CVSS 9.9Priority 34KEV 0

CVE-2026-42748 · WPify WPify Woo Czech

WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.9

RealMag7773 vulnerabilities on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-42727 · RealMag777 Active Products Tables for WooCommerce

WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

CVE-2026-42755 · RealMag777 TableOn

WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability

CVE-2026-42761 · RealMag777 Active Products Tables for WooCommerce

WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability

tassos.gr1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-48906 · tassos.gr Novarain/Tassos Framework (plg_system_nrframework)

Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla

EPSS 0.3%CVSS 9.3

ZTE1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-49002 · ZTE ZXUniPOS NDS-LTE

Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product

EPSS 0.3%CVSS 9.1

hassantafreshi1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-42747 · hassantafreshi Easy Form Builder

WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability

tainacan1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-42740 · tainacan Tainacan

WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability

Kareadita1 vulnerability on this pageMax CVSS 9.3Priority 29KEV 0

CVE-2026-47202 · Kareadita Kavita

Kavita: Pre-Auth Account Takeover