The archive.

CVE-2026-6140 · Totolink A7100RU

Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection

CVE-2026-6138 · Totolink A7100RU

Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection

CVE-2026-6139 · Totolink A7100RU

Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection

CVE-2026-6154 · Totolink A7100RU

Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection

CVE-2026-6155 · Totolink A7100RU

Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection

CVE-2026-6156 · Totolink A7100RU

Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection

mitre10 vulnerabilities on this pageMax CVSS 9.9Priority 58KEV 0

CVE-2025-61260 · mitre

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Pr…

EPSS 7%public exploit CVSS 9.8

CVE-2026-38526 · mitre

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers t…

EPSS 4%public exploit CVSS 9.9

CVE-2026-31049 · mitre

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV r…

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-65133 · mitre

A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-65135 · mitre

In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-rep…

EPSS 0.3%public exploit CVSS 9.8

CVE-2026-31048 · mitre

An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled stri…

EPSS 0.6%CVSS 9.8

CVE-2025-70023 · mitre

An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.

CVE-2026-31282 · mitre

Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control.

CVE-2026-31283 · mitre

In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address.

CVE-2025-63939 · mitre

Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injectio…

EPSS 0.3%CVSS 9.8

Eclipse Foundation1 vulnerability on this pageMax CVSS 9.1Priority 51KEV 0

CVE-2026-2332 · Eclipse Foundation Eclipse Jetty

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

EPSS 1%public exploit CVSS 9.1

MervinPraison4 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-40288 · MervinPraison PraisonAI

PraisonAI: Critical RCE via `type: job` workflow YAML

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-40289 · MervinPraison PraisonAI

PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-40315 · MervinPraison PraisonAI

PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries

EPSS 0.3%public exploit CVSS 9.8

CVE-2026-40313 · MervinPraison PraisonAI

PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence

EPSS 0.3%CVSS 9.1

Google Cloud1 vulnerability on this pageMax CVSS 9.3Priority 44KEV 0

CVE-2026-4810 · Google Cloud Agent Development Kit (ADK)

Remote Code Execution in Google Agent Development Kit (ADK)

EPSS 2%CVSS 9.3

Ubiquiti Inc3 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-22563 · Ubiquiti Inc UniFi Play PowerAmp

A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play…

EPSS 1%CVSS 9.8

CVE-2026-22562 · Ubiquiti Inc UniFi Play PowerAmp

A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to writ…

EPSS 0.8%CVSS 9.8

CVE-2026-22564 · Ubiquiti Inc UniFi Play PowerAmp

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauth…

Talend1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-6264 · Talend Talend JobServer

Critical Security fix for the Talend JobServer and Talend Runtime

EPSS 0.7%CVSS 9.8

Linux1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-31414 · Linux Linux

netfilter: nf_conntrack_expect: use expect->helper

EPSS 0.6%CVSS 9.8

thimpress1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-4365 · thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion

EPSS 0.9%CVSS 9.1

Pachno2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-40044 · Pachno Pachno

Pachno 1.0.6 FileCache Deserialization Remote Code Execution

EPSS 0.5%CVSS 9.8

CVE-2026-40042 · Pachno Pachno

Pachno 1.0.6 Wiki TextParser XML External Entity Injection

SAP_SE1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-27681 · SAP_SE SAP Business Planning and Consolidation and SAP Business Warehouse

SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse

EPSS 0.5%CVSS 9.9

Python Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-6100 · Python Software Foundation CPython

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

EPSS 0.6%CVSS 9.1

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-31908 · Apache Software Foundation Apache APISIX

Apache APISIX: forward auth plugin allows header injection

EPSS 0.5%CVSS 9.1

decidim1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-23891 · decidim decidim

Decidim has a Cross-site scripting (XSS) vulnerability via user name field

EPSS 0.4%CVSS 9.3

MCRAWFOR1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2026-5085 · MCRAWFOR Solstice::Session

Solstice::Session versions through 1440 for Perl generates session ids insecurely

EPSS 0.3%CVSS 9.1

Samsung Open Source6 vulnerabilities on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-25208 · Samsung Open Source Escargot

Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b…

EPSS 0.3%CVSS 9.8

CVE-2026-40446 · Samsung Open Source Escargot

Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.T…

CVE-2026-25205 · Samsung Open Source Escargot

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit ha…

CVE-2026-25207 · Samsung Open Source Escargot

Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502…

CVE-2026-25209 · Samsung Open Source Escargot

Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110…

EPSS 0.3%CVSS 9.1

CVE-2026-25206 · Samsung Open Source Escargot

Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110…

EPSS 0.2%CVSS 9.1

HCLSoftware1 vulnerability on this pageMax CVSS 9.8Priority 32KEV 0

CVE-2025-31991 · HCLSoftware Velocity

HCL DevOps Velocity is susceptible to brute-force attacks

Huawei1 vulnerability on this pageMax CVSS 10.0Priority 32KEV 0

CVE-2026-34865 · Huawei HarmonyOS

Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and co…

EPSS 0.2%CVSS 10.0

upKeeper Solutions1 vulnerability on this pageMax CVSS 9.0Priority 32KEV 0

CVE-2026-2449 · upKeeper Solutions upKeeper Instant Privilege Access

Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant P…

EPSS 0.3%CVSS 9.0

Foxit Software Inc.1 vulnerability on this pageMax CVSS 9.8Priority 31KEV 0

CVE-2026-5936 · Foxit Software Inc. Foxit PDF Services API

Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API