Critical vulnerability archive — page 177

Palo Alto Networks1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2026-0300 · Palo Alto Networks Cloud NGFW

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

KEV · due 9 May EPSS 42%public exploit SSVC act CVSS 9.8

D-Link2 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2026-7854 · D-Link DI-8100

D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow

EPSS 6%public exploit CVSS 9.8

CVE-2026-7853 · D-Link DI-8100

D-Link DI-8100 HTTP auto_reboot.asp sprintf buffer overflow

EPSS 2%public exploit CVSS 9.8

gotenberg1 vulnerability on this pageMax CVSS 10.0Priority 57KEV 0

CVE-2026-40281 · gotenberg gotenberg

Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

EPSS 2%public exploit CVSS 10.0

openmrs1 vulnerability on this pageMax CVSS 9.4Priority 50KEV 0

CVE-2026-40076 · openmrs openmrs-core

OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload

EPSS 0.9%public exploit CVSS 9.4

PHPOffice1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-34084 · PHPOffice PhpSpreadsheet

PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

EPSS 0.7%public exploit CVSS 9.8

ci4-cms-erp3 vulnerabilities on this pageMax CVSS 9.4Priority 49KEV 0

CVE-2026-41202 · ci4-cms-erp ci4ms

ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE

EPSS 0.7%public exploit CVSS 9.4

CVE-2026-41203 · ci4-cms-erp ci4ms

ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE

EPSS 0.6%public exploit CVSS 9.4

CVE-2026-41201 · ci4-cms-erp ci4ms

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2

EPSS 0.3%CVSS 9.1

coredns1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-35579 · coredns coredns

CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports

EPSS 0.6%public exploit CVSS 9.8

dataease1 vulnerability on this pageMax CVSS 9.4Priority 48KEV 0

CVE-2026-33324 · dataease SQLBot

SQLBot prompt injection allows arbitrary SQL execution and remote code execution

EPSS 0.6%public exploit CVSS 9.4

OpenClaw6 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-44112 · OpenClaw OpenClaw

OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes

EPSS 7%CVSS 9.6

CVE-2026-44109 · OpenClaw OpenClaw

OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation

EPSS 0.7%CVSS 9.8

CVE-2026-43585 · OpenClaw OpenClaw

OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution

EPSS 0.5%CVSS 9.8

CVE-2026-43575 · OpenClaw OpenClaw

OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route

EPSS 0.4%CVSS 9.8

CVE-2026-43578 · OpenClaw OpenClaw

OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgrade

EPSS 0.3%CVSS 9.1

CVE-2026-43581 · OpenClaw OpenClaw

OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding

EPSS 0.2%CVSS 9.6

OpenCTI-Platform1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-27960 · OpenCTI-Platform opencti

OpenCTI privilege escalation and unauthenticated access via default admin account

EPSS 7%CVSS 9.8

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2026-28780 · Apache Software Foundation Apache HTTP Server

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

EPSS 1%CVSS 9.8

CVE-2026-40010 · Apache Software Foundation Apache Wicket

Apache Wicket: possible session fixation using AuthenticatedWebSession

EPSS 0.4%CVSS 9.1

mitre6 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2025-63706 · mitre

NPM package next-npm-version1.0.1 is vulnerable to Command injection.

EPSS 2%CVSS 9.8

CVE-2026-37709 · mitre

Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote…

EPSS 0.6%CVSS 9.8

CVE-2025-63704 · mitre

NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution.

EPSS 0.5%CVSS 9.8

CVE-2025-63703 · mitre

npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().

EPSS 0.4%CVSS 9.8

CVE-2026-36458 · mitre

ChestnutCMS v1.5.10 has a SQL injection vulnerability.

EPSS 0.4%CVSS 9.8

CVE-2026-30496 · mitre

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unau…

EPSS 0.3%CVSS 9.8

Linux10 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-43185 · Linux Linux

ksmbd: fix signededness bug in smb_direct_prepare_negotiation()

EPSS 0.9%CVSS 9.8

CVE-2026-43186 · Linux Linux

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

EPSS 0.6%CVSS 9.8

CVE-2026-43125 · Linux Linux

dlm: validate length in dlm_search_rsb_tree

EPSS 0.5%CVSS 9.8

CVE-2026-43208 · Linux Linux

net: do not pass flow_id to set_rps_cpu()

EPSS 0.5%CVSS 9.8

CVE-2026-43083 · Linux Linux

net: ioam6: fix OOB and missing lock

EPSS 0.6%CVSS 9.1

CVE-2026-43197 · Linux Linux

netconsole: avoid OOB reads, msg is not nul-terminated

EPSS 0.6%CVSS 9.1

CVE-2026-43071 · Linux Linux

dcache: Limit the minimal number of bucket to two

EPSS 0.5%CVSS 9.1

CVE-2026-43117 · Linux Linux

btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()

EPSS 0.5%CVSS 9.1

CVE-2026-43114 · Linux Linux

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

EPSS 0.4%CVSS 9.4

CVE-2026-43198 · Linux Linux

tcp: fix potential race in tcp_v6_syn_recv_sock()

EPSS 0.3%CVSS 9.8

sandboxie-plus1 vulnerability on this pageMax CVSS 9.3Priority 41KEV 0

CVE-2026-34458 · sandboxie-plus Sandboxie

Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly

EPSS 0.3%public exploit CVSS 9.3

Qwibit1 vulnerability on this pageMax CVSS 9.3Priority 39KEV 0

CVE-2026-7875 · Qwibit NanoClaw

NanoClaw Host/Container Filesystem Boundary Vulnerability via Outbound Attachment Handling

EPSS 0.1%public exploit CVSS 9.3

givanz1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-41930 · givanz Vvveb

Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin

EPSS 0.3%CVSS 9.8

MasaCMS3 vulnerabilities on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-40330 · MasaCMS MasaCMS

Masa CMS SQL injection via sortDirection parameter in beanFeed

EPSS 0.4%CVSS 9.3

CVE-2026-40329 · MasaCMS MasaCMS

SQL Injection vulnerability via sortBy in beanFeed

EPSS 0.3%CVSS 9.3

CVE-2026-40331 · MasaCMS MasaCMS

Masa CMS unauthenticated SQL injection via altTable parameter in JSON API

EPSS 0.3%CVSS 9.3

torproject1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-44597 · torproject Tor

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.

EPSS 0.4%CVSS 9.1

CHORNY1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-5081 · CHORNY Apache::Session::Generate::ModUniqueId

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure

EPSS 0.3%CVSS 9.1

HCL2 vulnerabilities on this pageMax CVSS 9.8Priority 32KEV 0

CVE-2025-59851 · HCL DFXAnalytics

HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability

EPSS 0.2%CVSS 9.8

CVE-2025-59852 · HCL DFXAnalytics

HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability

EPSS 0.1%CVSS 9.1

rucio2 vulnerabilities on this pageMax CVSS 9.4Priority 32KEV 0

CVE-2026-29080 · rucio rucio

Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API

EPSS 0.3%CVSS 9.4

CVE-2026-29090 · rucio rucio

Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

EPSS 0.3%CVSS 9.0

Google2 vulnerabilities on this pageMax CVSS 9.6Priority 31KEV 0

CVE-2026-7908 · Google Chrome

Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape vi…

EPSS 0.2%CVSS 9.6

CVE-2026-7910 · Google Chrome

Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to byp…

EPSS 0.2%CVSS 9.6

The archive.