Critical vulnerability archive — page 167

Totolink25 vulnerabilities on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2026-9388 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9436 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9457 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9458 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9543 · Totolink N300RH

Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9384 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9385 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9386 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9387 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9404 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9405 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9406 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9407 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9408 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9432 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9433 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9434 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9435 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9454 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9455 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9456 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9475 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9476 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9477 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-9478 · Totolink A8000RU

Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection

EPSS 2%public exploit CVSS 9.8

Dolibarr1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2018-25357 · Dolibarr Dolibarr ERP CRM

Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

EPSS 2%public exploit CVSS 9.8

baptisteArno1 vulnerability on this pageMax CVSS 10.0Priority 46KEV 0

CVE-2026-33712 · baptisteArno typebot.io

TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls

EPSS 0.3%public exploit CVSS 10.0

Go standard library1 vulnerability on this pageMax CVSS 9.6Priority 45KEV 0

CVE-2026-39821 · Go standard library net/http

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

EPSS 2%CVSS 9.6

mitre4 vulnerabilities on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-48687 · mitre

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin.

EPSS 2%CVSS 9.8

CVE-2026-48689 · mitre

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dy…

EPSS 0.7%CVSS 9.8

CVE-2026-48686 · mitre

FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information…

EPSS 0.6%CVSS 9.8

CVE-2026-48691 · mitre

FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder.

EPSS 0.3%CVSS 9.8

LizardByte1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2026-32253 · LizardByte Sunshine

Sunshine: Authentication bypass via improper client certificate validation

EPSS 0.3%public exploit CVSS 9.8

mlflow1 vulnerability on this pageMax CVSS 9.0Priority 43KEV 0

CVE-2026-2651 · mlflow mlflow/mlflow

Missing Authorization Validation in mlflow/mlflow

EPSS 0.3%public exploit CVSS 9.0

Microsoft8 vulnerabilities on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-41104 · Microsoft Microsoft Planetary Computer Pro (GeoCatalog)

Microsoft Planetary Computer Pro Information Disclosure Vulnerability

EPSS 0.9%CVSS 10.0

CVE-2026-23652 · Microsoft Microsoft Power Pages

Microsoft Power Pages Remote Code Execution Vulnerability

EPSS 0.6%CVSS 10.0

CVE-2026-40411 · Microsoft Azure Virtual Network Gateway

Azure Virtual Network Gateway Remote Code Execution Vulnerability

EPSS 0.5%CVSS 9.9

CVE-2026-40412 · Microsoft Azure Orbital Spatio

Azure Orbital Spatio Remote Code Execution Vulnerability

EPSS 0.5%CVSS 10.0

CVE-2026-47280 · Microsoft Azure Resource Manager

Azure Resource Manager Elevation of Privilege Vulnerability

EPSS 0.5%CVSS 10.0

CVE-2026-33843 · Microsoft Microsoft Entra

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

EPSS 0.5%CVSS 9.8

CVE-2026-41090 · Microsoft Microsoft 365 Copilot for iOS

Microsoft Copilot Tampering Vulnerability

EPSS 0.4%CVSS 9.3

CVE-2026-42901 · Microsoft Microsoft Entra

Microsoft Entra ID Elevation of Privilege Vulnerability

EPSS 0.3%CVSS 10.0

Red Hat1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-7374 · Red Hat Red Hat Container Native Virtualization 4.12

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

EPSS 0.7%CVSS 9.9

CPANSec1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-8376 · CPANSec

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds

EPSS 0.6%CVSS 9.8

Besen1 vulnerability on this pageMax CVSS 9.2Priority 36KEV 0

CVE-2026-9397 · Besen BS20 EV Charging Station

Besen BS20 EV Charging Station OTA Update Installation improper authorization

EPSS 0.5%CVSS 9.2

BINGOS1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-42496 · BINGOS Archive::Tar

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

EPSS 0.5%CVSS 9.1

Crocoblock1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-42774 · Crocoblock JetEngine

WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

eMagicOne1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-42773 · eMagicOne eMagicOne Store Manager

WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Krajowa Izba Rozliczeniowa1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2026-9058 · Krajowa Izba Rozliczeniowa Szafir SDK

Improper Certificate Verification in Szafir SDK

EPSS 0.3%CVSS 9.3

LXQt1 vulnerability on this pageMax CVSS 9.3Priority 29KEV 0

CVE-2026-48700 · LXQt PCManFM-Qt

An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0.

EPSS 0.2%CVSS 9.3

The archive.