The archive.

CVE-2026-30304 · mitre

In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands.

EPSS 0.5%public exploit CVSS 9.6

CVE-2026-30533 · mitre

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php file via the "id"…

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-30532 · mitre

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php file via the "id" p…

EPSS 0.3%public exploit CVSS 9.8

OneUptime1 vulnerability on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2026-33396 · OneUptime oneuptime

OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe

EPSS 0.8%public exploit CVSS 10.0

huggingface1 vulnerability on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2026-4963 · huggingface smolagents

huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection

EPSS 0.6%public exploit CVSS 10.0

letta-ai1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-4965 · letta-ai letta

letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection

EPSS 0.6%public exploit CVSS 9.8

siyuan-note2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-33670 · siyuan-note siyuan

SiYuan has directory traversal within its publishing service

EPSS 0.7%public exploit CVSS 9.8

CVE-2026-33669 · siyuan-note siyuan

SiYuan has Arbitrary Document Reading within the Publishing Service

franklioxygen1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-33890 · franklioxygen MyTube

MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration

outline1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-33640 · outline outline

Outline has a rate limit bypass that allows brute force of email login OTP

themactep1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-26213 · themactep thingino-firmware

thingino-firmware api.cgi Unauthenticated Command Injection in Captive Portal

EPSS 5%CVSS 9.8

WWBN2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-33770 · WWBN AVideo

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

CVE-2026-33867 · WWBN AVideo

AVideo has Plaintext Video Password Storage

EPSS 0.2%public exploit CVSS 9.1

code-projects2 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-4908 · code-projects Simple Laundry System

code-projects Simple Laundry System Parameter modstaffinfo.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-4850 · code-projects Simple Laundry System

code-projects Simple Laundry System Parameter checkregisitem.php sql injection

EPSS 0.4%public exploit CVSS 9.8

OpenHands1 vulnerability on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2026-33718 · OpenHands OpenHands

OpenHands is Vulnerable to Command Injection through its Git Diff Handler

EPSS 2%CVSS 9.9

TandoorRecipes1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-33152 · TandoorRecipes recipes

Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication

EPSS 0.5%public exploit CVSS 9.1

Grafana1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2026-27876 · Grafana Grafana

RCE on Grafana via sqlExpressions

EPSS 2%CVSS 9.1

Spring1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-22738 · Spring Spring AI

SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

EPSS 1%CVSS 9.8

TigerVNC1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-34352 · TigerVNC TigerVNC

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an applicat…

EPSS 0.3%public exploit CVSS 9.8

BUFFALO INC.3 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-27650 · BUFFALO INC. BUFFALO Wi-Fi router products

OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products.

CVE-2026-33280 · BUFFALO INC. BUFFALO Wi-Fi router products

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging…

EPSS 0.4%CVSS 9.8

CVE-2026-32669 · BUFFALO INC. BUFFALO Wi-Fi router products

Code injection vulnerability exists in BUFFALO Wi-Fi router products.

HCL4 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-55270 · HCL Aftermarket DPC

HCL Aftermarket DPC is affected by Improper Input Validation

EPSS 1%CVSS 9.8

CVE-2025-55261 · HCL Aftermarket DPC

HCL Aftermarket DPC is affected by Missing Functional Level Access Control

CVE-2025-55267 · HCL Aftermarket DPC

HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability

CVE-2025-55269 · HCL Aftermarket DPC

HCL Aftermarket DPC is affected by Weak Password Policy vulnerability

NEC Platforms, Ltd.3 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-4620 · NEC Platforms, Ltd. Aterm WX1500HP

OS Command Injection vulnerability in NEC Platforms, Ltd.

EPSS 1%CVSS 9.8

CVE-2026-4622 · NEC Platforms, Ltd. Aterm WG2600HS

OS Command Injection vulnerability in NEC Platforms, Ltd.

CVE-2026-4619 · NEC Platforms, Ltd. Aterm WX3600HP

Path Traversal vulnerability in NEC Platforms, Ltd.

open-telemetry1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-33701 · open-telemetry opentelemetry-java-instrumentation

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

plank1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-4809 · plank laravel-mediable

Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable

DataDog1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-33728 · DataDog dd-trace-java

dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

EPSS 0.7%CVSS 9.8

lxc2 vulnerabilities on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-33897 · lxc incus

Incus vulnerable to arbitrary file read and write through pongo templates

EPSS 0.5%CVSS 10.0

CVE-2026-33945 · lxc incus

Abitrary file write through systemd-creds option

EPSS 0.5%CVSS 10.0

ory1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-33494 · ory oathkeeper

Ory Oathkeeper has a path traversal authorization bypass

EPSS 0.5%CVSS 10.0

moby1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-33747 · moby buildkit

BuildKit vulnerable to malicious frontend causing file escape outside of storage root

EPSS 0.5%CVSS 9.8

Red Hat3 vulnerabilities on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-28367 · Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

EPSS 0.7%CVSS 9.1

CVE-2026-28368 · Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6

Undertow: undertow: request smuggling via inconsistent header parsing

EPSS 0.7%CVSS 9.1

CVE-2026-28369 · Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6

Undertow: undertow: request smuggling via malformed http request headers

EPSS 0.7%CVSS 9.1

Black Duck1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-1496 · Black Duck Coverity

Coverity CLI Authentication Bypass

EPSS 0.5%CVSS 9.3

Bludit1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-25101 · Bludit Bludit

Session Fixation in Bludit

EPSS 0.4%CVSS 9.8

openbao2 vulnerabilities on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2026-33757 · openbao openbao

OpenBao lacks user confirmation for OIDC direct callback mode

EPSS 0.4%CVSS 9.6

CVE-2026-33758 · openbao openbao

OpenBao has Reflected XSS in its OIDC authentication error message

EPSS 0.3%CVSS 9.6

openfga1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-33729 · openfga openfga

OpenFGA has an Authorization Bypass through cached keys