Critical vulnerability archive — page 190

MervinPraison2 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2026-39888 · MervinPraison praisonaiagents

PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

EPSS 0.5%public exploit CVSS 10.0

CVE-2026-39890 · MervinPraison PraisonAI

PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading

EPSS 0.6%public exploit CVSS 9.8

mitre6 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-31040 · mitre

A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lea…

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-30479 · mitre

A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a cr…

EPSS 0.3%public exploit CVSS 9.1

CVE-2025-52221 · mitre

Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parame…

EPSS 0.4%CVSS 9.8

CVE-2025-50228 · mitre

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

EPSS 0.3%CVSS 9.1

CVE-2023-46945 · mitre

QD 20230821 is vulnerable to Server-side request forgery (SSRF) via a crafted request

EPSS 0.3%CVSS 9.1

CVE-2026-31017 · mitre

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1…

EPSS 0.2%CVSS 9.1

OpenIdentityPlatform1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-33439 · OpenIdentityPlatform OpenAM

Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

EPSS 9%CVSS 9.8

ci4-cms-erp1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-39394 · ci4-cms-erp ci4ms

CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

EPSS 0.5%public exploit CVSS 9.8

obsidianforensics1 vulnerability on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2026-40035 · obsidianforensics unfurl

Unfurl - Werkzeug Debugger Exposure via String Config Parsing

EPSS 0.6%public exploit CVSS 9.3

siyuan-note1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2026-39846 · siyuan-note siyuan

SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

EPSS 0.6%public exploit CVSS 9.1

wpeverest1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-3296 · wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata

EPSS 4%CVSS 9.8

flatpak1 vulnerability on this pageMax CVSS 10.0Priority 46KEV 0

CVE-2026-34078 · flatpak flatpak

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

EPSS 2%CVSS 10.0

podman-desktop1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-34045 · podman-desktop podman-desktop

Podman Desktop WebView Server Exposed

EPSS 0.5%public exploit CVSS 9.1

MGeurts1 vulnerability on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2026-39355 · MGeurts genealogy

Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)

EPSS 0.3%public exploit CVSS 10.0

mlfactory1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-3535 · mlfactory DSGVO Google Web Fonts GDPR

DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter

EPSS 0.9%CVSS 9.8

felixmartinez1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-4003 · felixmartinez Users manager – PN

Users manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action

EPSS 0.9%CVSS 9.8

pyca1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-39892 · pyca cryptography

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

EPSS 0.7%CVSS 9.8

Six Apart Ltd.2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-25776 · Six Apart Ltd. Movable Type

Movable Type provided by Six Apart Ltd.

EPSS 0.7%CVSS 9.8

CVE-2026-33088 · Six Apart Ltd. Movable Type

Movable Type provided by Six Apart Ltd.

EPSS 0.4%CVSS 9.8

Elastic1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-33466 · Elastic Logstash

Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write

EPSS 0.6%CVSS 9.8

Go toolchain2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-27143 · Go toolchain cmd/compile

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

EPSS 0.5%CVSS 9.8

CVE-2026-27140 · Go toolchain cmd/go

Code execution vulnerability in SWIG code generation in cmd/go

EPSS 0.7%CVSS 9.0

prosolution1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-2942 · prosolution ProSolution WP Client

ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess

EPSS 0.6%CVSS 9.8

xwiki1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-33229 · xwiki xwiki-platform

XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

EPSS 0.5%CVSS 9.8

Sonatype1 vulnerability on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-3199 · Sonatype Nexus Repository

Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

EPSS 0.6%CVSS 9.4

delmaredigital1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-39397 · delmaredigital payload-puck

@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

EPSS 0.4%CVSS 9.8

emmett-framework1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-39847 · emmett-framework emmett

Emmett has a path traversal in internal assets handler

EPSS 0.5%CVSS 9.1

OpenSSL2 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-28386 · OpenSSL OpenSSL

Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support

EPSS 0.5%CVSS 9.1

CVE-2026-31789 · OpenSSL OpenSSL

Heap Buffer Overflow in Hexadecimal Conversion

EPSS 0.3%CVSS 9.8

randombit2 vulnerabilities on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2026-34580 · randombit botan

Botan has a certificate authentication bypass due to trust anchor confusion

EPSS 0.5%CVSS 9.3

CVE-2026-34582 · randombit botan

Botan has a TLS 1.3 certificate authentication bypass

EPSS 0.2%CVSS 9.1

dbt-labs1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-39382 · dbt-labs dbt-core

dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

EPSS 0.4%CVSS 9.3

kcp-dev1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-39429 · kcp-dev kcp

kcp's cache server is accessible without authentication or authorization checks

EPSS 0.4%CVSS 9.1

inventree1 vulnerability on this pageMax CVSS 9.9Priority 34KEV 0

CVE-2026-35477 · inventree InvenTree

InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape

EPSS 0.3%CVSS 9.9

rack1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-39324 · rack rack-session

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

EPSS 0.3%CVSS 9.8

Google2 vulnerabilities on this pageMax CVSS 9.8Priority 32KEV 0

CVE-2026-5874 · Google Chrome

Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific…

EPSS 0.3%CVSS 9.6

CVE-2026-5902 · Google Chrome

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to co…

EPSS 0.2%CVSS 9.8

frappe1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2026-39351 · frappe frappe

Frappe allows unrestricted Doctype access via API exploit

EPSS 0.3%CVSS 9.1

IBM1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-1346 · IBM Verify Identity Access Container

Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

EPSS 0.2%CVSS 9.3

polarnl1 vulnerability on this pageMax CVSS 9.2Priority 31KEV 0

CVE-2026-39322 · polarnl PolarLearn

PolarLearn: Any password authenticates banned accounts and grants API access

EPSS 0.2%CVSS 9.2

CoolerControl1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2026-5300 · CoolerControl coolercontrold

Missing Authentication for Critical Function in coolercontrold

EPSS 0.2%CVSS 9.1

mndpsingh2871 vulnerability on this pageMax CVSS 9.6Priority 30KEV 0

CVE-2026-39640 · mndpsingh287 Theme Editor

WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability

EPSS 0.1%CVSS 9.6

priyanshumittal3 vulnerabilities on this pageMax CVSS 9.6Priority 30KEV 0

CVE-2026-39617 · priyanshumittal Bluestreet

WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability

EPSS 0.1%CVSS 9.6

CVE-2026-39619 · priyanshumittal Busiprof

WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability

EPSS 0.1%CVSS 9.6

CVE-2026-39620 · priyanshumittal Appointment

WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability

EPSS 0.1%CVSS 9.6

NixOS1 vulnerability on this pageMax CVSS 9.0Priority 29KEV 0

CVE-2026-39860 · NixOS nix

Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination

EPSS 0.2%CVSS 9.0

Mitsubishi Electric Corporation2 vulnerabilities on this pageMax CVSS 9.3Priority 28KEV 0

CVE-2025-14815 · Mitsubishi Electric Corporation GENESIS64

Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64

EPSS 0.1%CVSS 9.3

CVE-2025-14816 · Mitsubishi Electric Corporation GENESIS64

Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64

EPSS 0.1%CVSS 9.3

The archive.