Critical vulnerability archive — page 18

Finsys2 vulnerabilities on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2026-110130 · Finsys dockhand

Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

EPSS 0.7%public exploit CVSS 10.0

CVE-2026-110112 · Finsys dockhand

Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation

EPSS 0.4%CVSS 9.2

Microsoft2 vulnerabilities on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-105016 · Microsoft .NET 10.0 runtime

Microsoft QUIC Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8

CVE-2026-97816 · Microsoft Windows 10 Version 1809

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

Adobe21 vulnerabilities on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2026-103848 · Adobe Adobe Experience Manager 6.5 LTS

Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

EPSS 1%CVSS 9.9

CVE-2026-105899 · Adobe ColdFusion 2025

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

EPSS 1%CVSS 10.0

CVE-2026-106624 · Adobe ColdFusion 2025

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

EPSS 1%CVSS 10.0

CVE-2026-90531 · Adobe Adobe Experience Manager as a Cloud Service

Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

EPSS 1%CVSS 9.6

CVE-2026-48382 · Adobe Adobe Experience Manager as a Cloud Service

Adobe Experience Manager | Incorrect Authorization (CWE-863)

EPSS 1.0%CVSS 10.0

CVE-2026-48383 · Adobe Adobe Experience Manager as a Cloud Service

Adobe Experience Manager | Incorrect Authorization (CWE-863)

EPSS 1.0%CVSS 10.0

CVE-2026-90532 · Adobe Adobe Experience Manager as a Cloud Service

Adobe Experience Manager | Incorrect Authorization (CWE-863)

EPSS 0.8%CVSS 10.0

CVE-2026-106622 · Adobe ColdFusion 2025

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

EPSS 0.8%CVSS 10.0

CVE-2026-83662 · Adobe Adobe Experience Manager as a Cloud Service

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

EPSS 1%CVSS 9.3

CVE-2026-105895 · Adobe Adobe Experience Manager 6.5

Adobe Experience Manager | Improper Input Validation (CWE-20)

EPSS 0.7%CVSS 9.9

CVE-2026-105903 · Adobe ColdFusion 2025

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

EPSS 0.6%CVSS 9.9

CVE-2026-106629 · Adobe Adobe Experience Manager 6.5 LTS

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 0.9%CVSS 9.3

CVE-2026-106630 · Adobe Adobe Experience Manager 6.5 LTS

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 0.9%CVSS 9.3

CVE-2026-75732 · Adobe Adobe Experience Manager 6.5 LTS

Adobe Experience Manager | Incorrect Authorization (CWE-863)

EPSS 0.7%CVSS 9.9

CVE-2026-106612 · Adobe ColdFusion 2025

ColdFusion | Incorrect Authorization (CWE-863)

EPSS 0.5%CVSS 9.9

CVE-2026-106621 · Adobe ColdFusion 2025

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

EPSS 0.9%CVSS 9.1

CVE-2026-106626 · Adobe Adobe Experience Manager as a Cloud Service

Adobe Experience Manager | Improper Input Validation (CWE-20)

EPSS 0.7%CVSS 9.1

CVE-2026-106619 · Adobe ColdFusion 2025

ColdFusion | Improper Input Validation (CWE-20)

EPSS 0.6%CVSS 9.0

CVE-2026-106620 · Adobe ColdFusion 2025

ColdFusion | Incorrect Authorization (CWE-863)

EPSS 0.4%CVSS 9.6

CVE-2026-75994 · Adobe ColdFusion 2025

ColdFusion | Incorrect Authorization (CWE-863)

EPSS 0.3%CVSS 9.6

CVE-2026-90530 · Adobe ColdFusion 2025

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

EPSS 0.3%CVSS 9.3

Samsung Open Source1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-110392 · Samsung Open Source QA-Board

Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning

EPSS 1%CVSS 9.8

vitessio1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-104252 · vitessio vitess

Vitess vttablet /twopcz reflected XSS

EPSS 1%CVSS 9.8

snazzyplugins1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-110002 · snazzyplugins Snazzy Social Media Feed

Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter

EPSS 0.9%CVSS 9.8

printcart1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-93388 · printcart Printcart Store – Web to Print Product Designer for WooCommerce

Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url

EPSS 0.9%CVSS 9.8

xorbitsai1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-49950 · xorbitsai xoscar

Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

EPSS 0.9%CVSS 9.8

Omnispace5 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-63146 · Omnispace Agora Project

Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

EPSS 0.7%CVSS 9.8

CVE-2026-63158 · Omnispace Agora Project

Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

EPSS 0.4%CVSS 9.1

CVE-2026-63149 · Omnispace Agora Project

Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

EPSS 0.4%CVSS 9.1

CVE-2026-63159 · Omnispace Agora Project

Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

EPSS 0.3%CVSS 9.1

CVE-2026-63160 · Omnispace Agora Project

Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

EPSS 0.3%CVSS 9.1

Google8 vulnerabilities on this pageMax CVSS 9.6Priority 38KEV 0

CVE-2026-110152 · Google Chrome

Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary…

EPSS 0.5%CVSS 9.6

CVE-2026-110136 · Google Chrome

Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via…

EPSS 0.4%CVSS 9.6

CVE-2026-110149 · Google Chrome

Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox…

EPSS 0.4%CVSS 9.6

CVE-2026-110161 · Google Chrome

Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox…

EPSS 0.4%CVSS 9.6

CVE-2026-110165 · Google Chrome

Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary c…

EPSS 0.4%CVSS 9.6

CVE-2026-110142 · Google Chrome

Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sand…

EPSS 0.3%CVSS 9.6

CVE-2026-110159 · Google Chrome

Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the…

EPSS 0.2%CVSS 9.6

CVE-2026-110144 · Google Chrome

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arb…

EPSS 0.2%CVSS 9.6

Tyche Softwares2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-97657 · Tyche Softwares Abandoned Cart Pro for WooCommerce

Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter

EPSS 0.4%CVSS 9.8

CVE-2026-97668 · Tyche Softwares Abandoned Cart Pro for WooCommerce

Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value

EPSS 0.4%CVSS 9.8

holithemes1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-92097 · holithemes Click to Chat – HoliThemes

Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

EPSS 0.5%CVSS 9.1

IBM3 vulnerabilities on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2026-93895 · IBM WebSphere Application Server - Liberty

IBM WebSphere Application Server Liberty Improper Access Control

EPSS 0.4%CVSS 9.1

CVE-2026-93909 · IBM WebSphere Application Server - Liberty

IBM WebSphere Application Server Liberty is affected by an authentication bypass

EPSS 0.3%CVSS 9.1

CVE-2026-95695 · IBM WebSphere Application Server - Liberty

IBM WebSphere Application Server Liberty Incorrect Authorization

EPSS 0.3%CVSS 9.1

LegacyUpdate1 vulnerability on this pageMax CVSS 9.9Priority 32KEV 0

CVE-2026-97381 · LegacyUpdate LegacyUpdate

Legacy Update ActiveX control accepts unauthorized hosting origins

EPSS 0.2%CVSS 9.9

The archive.