The archive.

Browse all tracked critical vulnerabilities, including records outside today's brief.

38,960 matching vulnerabilities · Page 184 of 780

FlowiseAI1 vulnerability on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2026-40933 · FlowiseAI Flowise

Flowise: Authenticated RCE Via MCP Adapters

EPSS 12%public exploit CVSS 10.0

mitre1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2026-38835 · mitre

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbP…

EPSS 2%public exploit CVSS 9.8

OpenAEV-Platform1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-24467 · OpenAEV-Platform openaev

OpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise

EPSS 0.9%public exploit CVSS 9.8

SGLang1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-5760 · SGLang SGLang

CVE-2026-5760

EPSS 0.9%public exploit CVSS 9.8

WWBN1 vulnerability on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2026-40911 · WWBN AVideo

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

EPSS 0.6%public exploit CVSS 10.0

freescout-help-desk4 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-40498 · freescout-help-desk freescout

FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-40496 · freescout-help-desk freescout

FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-41193 · freescout-help-desk freescout

FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-40569 · freescout-help-desk freescout

FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration

EPSS 0.3%public exploit CVSS 9.0

patrickhener2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-40884 · patrickhener goshs

goshs: Empty-username SFTP password authentication bypass in goshs

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-40903 · patrickhener goshs

Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence

EPSS 0.2%CVSS 9.1

reconurge1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-32311 · reconurge flowsint

Command Injection and Docker container escape allows root on host machine

EPSS 0.5%public exploit CVSS 9.8

The GNU C Library1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-5450 · The GNU C Library glibc

scanf %mc off-by-one heap buffer overflow

EPSS 0.5%public exploit CVSS 9.8

Microsoft1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2026-40372 · Microsoft ASP.NET Core 10.0

ASP.NET Core Elevation of Privilege Vulnerability

EPSS 11%CVSS 9.1

haris-musa1 vulnerability on this pageMax CVSS 9.4Priority 46KEV 0

CVE-2026-40576 · haris-musa excel-mcp-server

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server

EPSS 0.5%public exploit CVSS 9.4

Arcadia Technology, LLC1 vulnerability on this pageMax CVSS 9.0Priority 45KEV 0

CVE-2026-5652 · Arcadia Technology, LLC Crafty Controller

Authorization Bypass Through User-Controlled Key in Crafty Controller

EPSS 0.4%public exploit CVSS 9.0

NewSoft1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-5965 · NewSoft NewSoftOA

NewSoft｜NewSoftOA - OS Command Injection

EPSS 2%CVSS 9.8

mailcow1 vulnerability on this pageMax CVSS 9.3Priority 44KEV 0

CVE-2026-40872 · mailcow mailcow-dockerized

mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

EPSS 0.4%public exploit CVSS 9.3

Atlassian1 vulnerability on this pageMax CVSS 9.4Priority 43KEV 0

CVE-2026-21571 · Atlassian Bamboo Data Center

This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0…

EPSS 1%CVSS 9.4

vendurehq1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2026-40887 · vendurehq vendure

@vendure/core has a SQL Injection vulnerability

EPSS 2%CVSS 9.1

anthropics1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2026-39861 · anthropics claude-code

Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

EPSS 0.7%CVSS 10.0

fatedier1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2026-40910 · fatedier frp

frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control

EPSS 0.3%public exploit CVSS 9.1

ATRODO1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2025-15638 · ATRODO Net::Dropbear

Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt

EPSS 0.6%CVSS 10.0

givanz1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-39918 · givanz Vvveb

Vvveb < 1.0.8.1 Code Injection via Installation Endpoint

EPSS 0.7%CVSS 9.8

spinnaker2 vulnerabilities on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-32604 · spinnaker spinnaker

Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

EPSS 0.6%CVSS 10.0

CVE-2026-32613 · spinnaker spinnaker

Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling

EPSS 0.6%CVSS 10.0

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-33557 · Apache Software Foundation Apache Kafka

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

EPSS 0.9%CVSS 9.1

CrowdStrike1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-40050 · CrowdStrike LogScale Self-Hosted

CrowdStrike LogScale Unauthenticated Path Traversal

EPSS 0.6%CVSS 9.8

electric-sql1 vulnerability on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2026-40906 · electric-sql electric

Electric: SQL Injection via ORDER BY Parameter in Shape API

EPSS 0.5%CVSS 10.0

Vvveb1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-6257 · Vvveb Vvveb CMS

Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management

EPSS 0.6%CVSS 9.2

pjsip1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-40892 · pjsip pjproject

PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()

EPSS 0.4%CVSS 9.8

Digiwin2 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-5963 · Digiwin EasyFlow .NET

Digiwin｜EasyFlow .NET - SQL Injection

EPSS 0.4%CVSS 9.8

CVE-2026-5964 · Digiwin EasyFlow .NET

Digiwin｜EasyFlow .NET - SQL Injection

EPSS 0.4%CVSS 9.8

Mozilla4 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-6748 · Mozilla Firefox

Uninitialized memory in the Audio/Video: Web Codecs component

EPSS 0.4%CVSS 9.8

CVE-2026-6760 · Mozilla Firefox

Mitigation bypass in the Networking: Cookies component

EPSS 0.3%CVSS 9.8

CVE-2026-6768 · Mozilla Firefox

Mitigation bypass in the Networking: Cookies component

EPSS 0.3%CVSS 9.8

CVE-2026-6771 · Mozilla Firefox

Mitigation bypass in the DOM: Security component

EPSS 0.3%CVSS 9.8

Oracle Corporation5 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-34275 · Oracle Corporation Oracle Advanced Inbound Telephony

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration).

EPSS 0.4%CVSS 9.8

CVE-2026-34279 · Oracle Corporation Oracle Enterprise Manager Base Platform

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management).

EPSS 0.4%CVSS 9.1

CVE-2026-34285 · Oracle Corporation Oracle Identity Manager Connector

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

EPSS 0.4%CVSS 9.1

CVE-2026-34286 · Oracle Corporation Oracle Identity Manager Connector

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

EPSS 0.4%CVSS 9.1

CVE-2026-34287 · Oracle Corporation Oracle Identity Manager Connector

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

EPSS 0.3%CVSS 9.1

roxy-wi1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-33432 · roxy-wi roxy-wi

Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass

EPSS 0.4%CVSS 9.1

Esri2 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-33518 · Esri Portal for ArcGIS

Incorrect privilege assignment in Portal for ArcGIS

EPSS 0.3%CVSS 9.8

CVE-2026-33519 · Esri Portal for ArcGIS

Incorrect privilege assignment in Portal for ArcGIS

EPSS 0.3%CVSS 9.8

OpenClaw1 vulnerability on this pageMax CVSS 9.9Priority 34KEV 0

CVE-2026-41329 · OpenClaw OpenClaw

OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation

EPSS 0.3%CVSS 9.9

GitHub1 vulnerability on this pageMax CVSS 9.6Priority 33KEV 0

CVE-2026-5845 · GitHub Enterprise Server

Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server

EPSS 0.3%CVSS 9.6

junrar1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2026-41245 · junrar junrar

Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

EPSS 0.3%CVSS 9.3

oxia-db1 vulnerability on this pageMax CVSS 9.2Priority 31KEV 0

CVE-2026-40946 · oxia-db oxia

Oxia: OIDC token audience validation bypass via SkipClientIDCheck

EPSS 0.3%CVSS 9.2

Zeon Global Tech1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2025-41029 · Zeon Global Tech Zeon Academy Pro

SQL injection in Zeon Academy Pro by Zeon Global Tech

EPSS 0.2%CVSS 9.3