Critical vulnerability archive — page 181

dgraph-io3 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-41492 · dgraph-io dgraph

Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

EPSS 3%public exploit CVSS 9.8

CVE-2026-41327 · dgraph-io dgraph

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-41328 · dgraph-io dgraph

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

EPSS 0.4%public exploit CVSS 9.1

Totolink16 vulnerabilities on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2026-7121 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7037 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7122 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7123 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7124 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7125 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7136 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7137 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7138 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7139 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7140 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7152 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7153 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7154 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7155 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection

EPSS 2%public exploit CVSS 9.8

CVE-2026-7156 · Totolink A8000RU

Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection

EPSS 2%public exploit CVSS 9.8

mitre4 vulnerabilities on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2026-31255 · mitre

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi.

EPSS 1%public exploit CVSS 9.8

CVE-2026-35903 · mitre

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service.

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-30352 · mitre

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to ex…

EPSS 0.5%CVSS 9.8

CVE-2024-46636 · mitre

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in t…

EPSS 0.3%CVSS 9.4

axios2 vulnerabilities on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2026-42043 · axios axios

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

EPSS 0.7%public exploit CVSS 10.0

CVE-2026-42044 · axios axios

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

EPSS 0.6%public exploit CVSS 9.1

Red Hat1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-6951 · Red Hat Red Hat Enterprise Linux 8

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-259…

EPSS 0.9%public exploit CVSS 9.8

Apache Software Foundation6 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2026-33453 · Apache Software Foundation Apache Camel

Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution

EPSS 9%CVSS 10.0

CVE-2026-40453 · Apache Software Foundation Apache Camel JMS

Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

EPSS 2%CVSS 9.9

CVE-2026-40860 · Apache Software Foundation Apache Camel

Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

EPSS 2%CVSS 9.8

CVE-2026-33454 · Apache Software Foundation Apache Camel

Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

EPSS 1%CVSS 9.4

CVE-2026-41635 · Apache Software Foundation Apache MINA

Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE

EPSS 0.6%CVSS 9.8

CVE-2026-41409 · Apache Software Foundation Apache MINA

Apache MINA: CWE-502 Deserialization of Untrusted Data

EPSS 0.4%CVSS 9.8

BridgeHead Software1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-39920 · BridgeHead Software FileStore

BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

EPSS 0.5%public exploit CVSS 9.8

ProjeQtor1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-41462 · ProjeQtor ProjeQtor

ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login

EPSS 0.6%public exploit CVSS 9.8

Tenda1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-7036 · Tenda i9

Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal

EPSS 0.5%public exploit CVSS 9.8

usmannasir1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2026-41473 · usmannasir cyberpanel

CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

EPSS 0.8%public exploit CVSS 9.1

VulDB1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-6987 · VulDB

PicoClaw Web Launcher Management Plane restart command injection

EPSS 3%CVSS 9.8

bacnet-stack1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-41475 · bacnet-stack bacnet-stack

BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser

EPSS 0.5%public exploit CVSS 9.1

Budibase1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2026-41428 · Budibase budibase

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

EPSS 0.4%public exploit CVSS 9.1

saltcorn1 vulnerability on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2026-41478 · saltcorn saltcorn

Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

EPSS 0.3%public exploit CVSS 10.0

Linux2 vulnerabilities on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-31682 · Linux Linux

bridge: br_nd_send: linearize skb before parsing ND options

EPSS 0.6%CVSS 9.1

CVE-2026-31685 · Linux Linux

netfilter: ip6t_eui64: reject invalid MAC header for all packets

EPSS 0.5%CVSS 9.4

Directorist1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-22337 · Directorist Directorist Social Login

WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability

EPSS 0.3%CVSS 9.8

AWS1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-6911 · AWS AWS Ops Wheel

Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

EPSS 0.3%CVSS 9.8

clerk1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-41248 · clerk astro

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

EPSS 0.3%CVSS 9.1

Directorist Booking1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-22336 · Directorist Booking Directorist Booking

WordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

pjsip1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-41415 · pjsip pjproject

PJSIP: SIP Multipart CID URI Length Underflow

EPSS 0.3%CVSS 9.1

rust-openssl1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-41677 · rust-openssl rust-openssl

rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length

EPSS 0.3%CVSS 9.1

GeoVision Inc.1 vulnerability on this pageMax CVSS 9.3Priority 30KEV 0

CVE-2026-42363 · GeoVision Inc. GV-IP Device Utility

GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability

EPSS 0.2%CVSS 9.3

SmarterTools Inc.1 vulnerability on this pageMax CVSS 9.1Priority 28KEV 0

CVE-2026-40514 · SmarterTools Inc. SmarterMail

SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG

EPSS 0.2%CVSS 9.1

The archive.