Critical vulnerability archive — page 193

Progress2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2026-2699 · Progress ShareFile Storage Zones Controller

EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

EPSS 58%public exploit CVSS 9.8

CVE-2026-2701 · Progress ShareFile Storage Zones Controller

RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)

EPSS 55%CVSS 9.1

mlflow1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2026-0545 · mlflow mlflow/mlflow

Missing Authentication for Critical Function in mlflow/mlflow

EPSS 4%public exploit CVSS 9.8

Budibase2 vulnerabilities on this pageMax CVSS 9.9Priority 57KEV 0

CVE-2026-35216 · Budibase budibase

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

EPSS 11%public exploit CVSS 9.1

CVE-2026-31818 · Budibase budibase

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

EPSS 0.4%public exploit CVSS 9.9

DefaultFuction1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-5333 · DefaultFuction Content-Management-System

DefaultFuction Content-Management-System tools.php command injection

EPSS 3%public exploit CVSS 9.8

PrefectHQ1 vulnerability on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2026-32871 · PrefectHQ fastmcp

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

EPSS 0.9%public exploit CVSS 10.0

ci4-cms-erp6 vulnerabilities on this pageMax CVSS 10.0Priority 47KEV 0

CVE-2026-34571 · ci4-cms-erp ci4ms

CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

EPSS 0.4%public exploit CVSS 10.0

CVE-2026-34569 · ci4-cms-erp ci4ms

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

EPSS 0.3%public exploit CVSS 10.0

CVE-2026-34568 · ci4-cms-erp ci4ms

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

EPSS 0.3%public exploit CVSS 9.1

CVE-2026-34565 · ci4-cms-erp ci4ms

CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

EPSS 0.3%public exploit CVSS 9.1

CVE-2026-34566 · ci4-cms-erp ci4ms

CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

EPSS 0.3%public exploit CVSS 9.1

CVE-2026-34567 · ci4-cms-erp ci4ms

CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

EPSS 0.3%public exploit CVSS 9.1

ShaneIsrael1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2026-34745 · ShaneIsrael fireshare

Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public

EPSS 0.6%public exploit CVSS 9.1

Dan McInerney1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-5463 · Dan McInerney pymetasploit3

pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()

EPSS 2%CVSS 9.8

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-5334 · itsourcecode Online Enrollment System

itsourcecode Online Enrollment System Parameter index.php sql injection

EPSS 0.4%public exploit CVSS 9.8

mitre3 vulnerabilities on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2026-28373 · mitre

The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionalit…

EPSS 0.4%public exploit CVSS 9.6

CVE-2026-34877 · mitre

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0.

EPSS 0.4%CVSS 9.8

CVE-2026-25212 · mitre

An issue was discovered in Percona PMM before 3.7.

EPSS 0.3%CVSS 9.9

SignalK1 vulnerability on this pageMax CVSS 9.4Priority 46KEV 0

CVE-2026-33950 · SignalK signalk-server

signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity

EPSS 0.4%public exploit CVSS 9.4

hoppscotch2 vulnerabilities on this pageMax CVSS 9.6Priority 45KEV 0

CVE-2026-34931 · hoppscotch hoppscotch

hoppscotch: Improper loopback redirect_uri validation in device-login flow

EPSS 0.4%public exploit CVSS 9.6

CVE-2026-34932 · hoppscotch hoppscotch

hoppscotch: Stored XSS via mock server responses on backend origin

EPSS 0.3%CVSS 9.3

projectworlds1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-5368 · projectworlds Car Rental Project

projectworlds Car Rental Project Parameter login.php sql injection

EPSS 0.3%public exploit CVSS 9.8

Intermesh1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2026-34838 · Intermesh groupoffice

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

EPSS 1%CVSS 10.0

Linux5 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

OneUptime3 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-34758 · OneUptime oneuptime

OneUptime: Missing Authentication on Notification Endpoints

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-35053 · OneUptime oneuptime

OneUptime: Unauthenticated Workflow Execution via ManualAPI

EPSS 0.6%CVSS 9.8

CVE-2026-34759 · OneUptime oneuptime

OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure

EPSS 0.6%CVSS 9.2

Microsoft6 vulnerabilities on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-32213 · Microsoft Azure AI Foundry

Azure AI Foundry Elevation of Privilege Vulnerability

EPSS 0.9%CVSS 10.0

CVE-2026-32186 · Microsoft Microsoft Bing

Microsoft Bing Elevation of Privilege Vulnerability

EPSS 0.7%CVSS 10.0

CVE-2026-33105 · Microsoft Azure Kubernetes Service

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

EPSS 0.7%CVSS 10.0

CVE-2026-33107 · Microsoft Azure Databricks

Azure Databricks Elevation of Privilege Vulnerability

EPSS 0.7%CVSS 10.0

CVE-2026-26135 · Microsoft Azure Custom Locations Resource Provider

Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability

EPSS 0.6%CVSS 9.6

CVE-2026-32211 · Microsoft Azure Web Apps

Azure MCP Server Information Disclosure Vulnerability

EPSS 0.9%CVSS 9.1

Agno1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-35002 · Agno Agno

Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution

EPSS 0.9%CVSS 9.8

Cesanta1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-5244 · Cesanta Mongoose

Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow

EPSS 0.8%CVSS 9.8

Belden2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-14034 · Belden Hirschmann HiEOS LRS11

Hirschmann HiEOS Authentication Bypass via HTTP Management Module

EPSS 0.5%CVSS 9.8

CVE-2025-15620 · Belden Hirschmann HiOS Switch Platform

HiOS Switch Platform Denial-of-Service via Web Interface

EPSS 0.5%CVSS 9.2

IceWhaleTech1 vulnerability on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2026-28798 · IceWhaleTech ZimaOS

Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS

EPSS 0.4%CVSS 10.0

cloudreve1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-25726 · cloudreve cloudreve

Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)

EPSS 0.4%CVSS 9.8

MB connect line1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-33615 · MB connect line mbCONNECT24

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint

EPSS 0.4%CVSS 9.1

ConvoyPanel1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-33746 · ConvoyPanel panel

Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users

EPSS 0.3%CVSS 9.8

opf1 vulnerability on this pageMax CVSS 9.9Priority 34KEV 0

CVE-2026-34717 · opf openproject

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

EPSS 0.3%CVSS 9.9

SEPPmail3 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-29139 · SEPPmail Secure Email Gateway

GINA State Confusion Account Takeover

EPSS 0.3%CVSS 9.8

CVE-2026-29143 · SEPPmail Secure Email Gateway

S/MIME Decryption Impersonation

EPSS 0.3%CVSS 9.1

CVE-2026-29133 · SEPPmail Secure Email Gateway

UID Regex Bypass

EPSS 0.2%CVSS 9.1

The archive.