The archive.

CVE-2026-31177 · mitre

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun…

CVE-2026-31178 · mitre

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun…

CVE-2026-31181 · mitre

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun…

CVE-2025-50229 · mitre

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

EPSS 0.4%public exploit CVSS 9.8

CyferShepard1 vulnerability on this pageMax CVSS 9.1Priority 48KEV 0

CVE-2026-41167 · CyferShepard Jellystat

Jellystat has SQL Injection that leads to to Remote Code Execution

EPSS 0.6%public exploit CVSS 9.1

thexerteproject1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-34415 · thexerteproject xerteonlinetoolkits

Xerte Online Toolkits File Upload RCE via elfinder Connector

EPSS 4%CVSS 9.8

espocrm1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-33656 · espocrm espocrm

EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user

EPSS 0.5%public exploit CVSS 9.1

Beghelli1 vulnerability on this pageMax CVSS 9.3Priority 45KEV 0

CVE-2026-41468 · Beghelli SicuroWeb (Sicuro24)

Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection

EPSS 0.4%public exploit CVSS 9.3

ddev1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2026-32885 · ddev ddev

DDEV has ZipSlip path traversal in tar and zip archive extraction

EPSS 0.4%public exploit CVSS 9.1

voidzero-dev1 vulnerability on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2026-41211 · voidzero-dev vite-plus

`vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

EPSS 0.3%public exploit CVSS 10.0

Augmentt1 vulnerability on this pageMax CVSS 9.6Priority 43KEV 0

CVE-2026-6356 · Augmentt Augmentt

CVE-2026-6356

EPSS 0.3%public exploit CVSS 9.6

PowerDNS2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-33598 · PowerDNS DNSdist

Out-of-bounds read in cache inspection via Lua

EPSS 1%CVSS 9.1

CVE-2026-33608 · PowerDNS Authoritative

Incomplete domain name sanitization during

Progress Software1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-6023 · Progress Software Telerik UI for ASP.NET AJAX

Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX

sendmachine1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-6235 · sendmachine Sendmachine for WordPress

Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests

EPSS 0.6%CVSS 9.8

BorG Technology Corporation3 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-6885 · BorG Technology Corporation Borg SPM 2007

BorG Technology Corporation｜Borg SPM 2007 - Arbitrary File Upload

CVE-2026-6886 · BorG Technology Corporation Borg SPM 2007

BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass

CVE-2026-6887 · BorG Technology Corporation Borg SPM 2007

BorG Technology Corporation｜Borg SPM 2007 - SQL Injection

Dell1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-26354 · Dell PowerProtect Data Domain

Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release versi…

jppreus1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-4119 · jppreus Create DB Tables

Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php

EPSS 0.7%CVSS 9.1

Linux6 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-31478 · Linux Linux

ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()

CVE-2026-31436 · Linux Linux

dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()

CVE-2026-31444 · Linux Linux

ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

CVE-2026-31448 · Linux Linux

ext4: avoid infinite loops caused by residual data

EPSS 0.5%CVSS 9.4

CVE-2026-31501 · Linux Linux

net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path

CVE-2026-31463 · Linux Linux

iomap: fix invalid folio access when i_blkbits differs from I/O granularity

nasa1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-41144 · nasa fprime

F´ (F Prime) has Integer Overflow in FileUplink

Rocket.Chat1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-29198 · Rocket.Chat Rocket.Chat

In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to accoun…