Critical vulnerability archive — page 20

Adobe5 vulnerabilities on this pageMax CVSS 10.0Priority 54KEV 0

CVE-2026-103849 · Adobe Adobe Commerce

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

EPSS 1%public exploit CVSS 10.0

CVE-2026-100133 · Adobe Adobe Commerce

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 1%CVSS 9.3

CVE-2026-92909 · Adobe Adobe Commerce

Adobe Commerce | Incorrect Authorization (CWE-863)

EPSS 0.8%CVSS 9.8

CVE-2026-91013 · Adobe Adobe Commerce

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 0.9%CVSS 9.3

CVE-2026-92464 · Adobe Adobe Commerce

Adobe Commerce | Improper Input Validation (CWE-20)

EPSS 0.9%CVSS 9.1

Fortinet1 vulnerability on this pageMax CVSS 9.4Priority 51KEV 0

CVE-2026-106173 · Fortinet FortiSIEM

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow atta…

EPSS 1.0%public exploit CVSS 9.4

IBM1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-53709 · IBM mcp-context-forge

MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

EPSS 0.6%public exploit CVSS 9.8

Wazuh2 vulnerabilities on this pageMax CVSS 9.4Priority 49KEV 0

CVE-2026-74040 · Wazuh wazuh-manager

Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker

EPSS 0.7%public exploit CVSS 9.4

CVE-2026-74043 · Wazuh wazuh-manager

Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

EPSS 0.4%CVSS 9.0

saltyorg1 vulnerability on this pageMax CVSS 10.0Priority 47KEV 0

CVE-2026-55675 · saltyorg docs

Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

EPSS 0.4%public exploit CVSS 10.0

Zarestia-Dev1 vulnerability on this pageMax CVSS 9.6Priority 46KEV 0

CVE-2026-55183 · Zarestia-Dev rclone-manager

RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

EPSS 0.4%public exploit CVSS 9.6

fearlessgeekmedia1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2026-55695 · fearlessgeekmedia FearlessCMS

FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater

EPSS 0.5%public exploit CVSS 9.1

jhuckaby1 vulnerability on this pageMax CVSS 9.0Priority 45KEV 0

CVE-2026-55562 · jhuckaby Cronicle

Cronicle: Stored XSS in admin Activity Log via account full_name field

EPSS 0.5%public exploit CVSS 9.0

Microsoft14 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2026-105723 · Microsoft Windows 10 Version 1607

Windows Distributed File System (DFS) Elevation of Privilege Vulnerability

EPSS 1%CVSS 9.8

CVE-2026-83693 · Microsoft Windows 10 Version 1607

Windows Error Reporting Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

CVE-2026-69634 · Microsoft Windows 10 Version 1607

Windows iSCSI Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.8

CVE-2026-69639 · Microsoft Windows 10 Version 1809

Windows libarchive Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.8

CVE-2026-69705 · Microsoft Windows 10 Version 1607

Windows iSCSI Remote Code Execution Vulnerability

EPSS 1.0%CVSS 9.8

CVE-2026-69883 · Microsoft Windows 10 Version 1607

Windows iSCSI Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.8

CVE-2026-70096 · Microsoft Microsoft 365 Apps for Enterprise

Windows Rich Text Edit Control Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

CVE-2026-70275 · Microsoft Windows 10 Version 1607

Windows CD-ROM File System Driver Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.8

CVE-2026-83578 · Microsoft Windows 10 Version 1607

Microsoft PowerShell Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

CVE-2026-83780 · Microsoft Windows 10 Version 1607

Windows CCFFilter Driver Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

CVE-2026-83782 · Microsoft Windows 10 Version 1607

Windows Shell Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

CVE-2026-83748 · Microsoft Windows 10 Version 1607

Windows Error Reporting Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.8

CVE-2026-83869 · Microsoft Windows 10 Version 1607

Windows Domain Name Service Remote Code Execution Vulnerability

EPSS 0.8%CVSS 9.8

CVE-2026-102238 · Microsoft Visual Studio Code

Visual Studio Code Remote Code Execution Vulnerability

EPSS 0.8%CVSS 9.6

Ivanti2 vulnerabilities on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2026-109412 · Ivanti Neurons Patch for Intune

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication…

EPSS 0.9%CVSS 9.9

CVE-2026-106042 · Ivanti Xtraction

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker t…

EPSS 0.8%CVSS 9.9

NVIDIA2 vulnerabilities on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-65162 · NVIDIA AIStore framework

NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may sup…

EPSS 0.7%CVSS 10.0

CVE-2026-65173 · NVIDIA AIStore framework

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote…

EPSS 0.5%CVSS 9.1

podman-container-tools1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-94603 · podman-container-tools podman

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

EPSS 0.5%CVSS 10.0

argoproj1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-77459 · argoproj argo-cd

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

EPSS 0.5%CVSS 9.9

Colorful1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2026-109520 · Colorful iGameCenter

Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions

EPSS 0.1%public exploit CVSS 9.3

risesoft-y91 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-110116 · risesoft-y9 Digital-Infrastructure

Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile

EPSS 0.6%CVSS 9.1

TanStack1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-102989 · TanStack router

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

EPSS 0.5%CVSS 9.3

Docker1 vulnerability on this pageMax CVSS 9.4Priority 36KEV 0

CVE-2026-105445 · Docker Docker Hub

Docker Hub account conversion could reassign an active personal access token to another user

EPSS 0.4%CVSS 9.4

Commvault1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-77099 · Commvault Commvault Cloud

CVFS Command Execution

EPSS 0.4%CVSS 9.3

Esri1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-69227 · Esri Portal for ArcGIS

BUG-000187331 Portal for ArcGIS has a security vulnerability

EPSS 0.3%CVSS 9.8

metabase1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-103928 · metabase metabase

Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

EPSS 0.4%CVSS 9.3

Mozilla4 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-109774 · Mozilla Firefox

Invalid pointer, undefined behavior in the DOM: Notifications component

EPSS 0.3%CVSS 9.8

CVE-2026-109780 · Mozilla Firefox

Mitigation bypass in the DOM: Core & HTML component

EPSS 0.4%CVSS 9.8

CVE-2026-109755 · Mozilla Firefox

Sandbox escape in the DOM: Content Processes component

EPSS 0.3%CVSS 9.6

CVE-2026-109772 · Mozilla Firefox

Same-origin policy bypass in the DevTools component

EPSS 0.2%CVSS 9.1

OpenText1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-75120 · OpenText Endpoint Investigator

Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents

EPSS 0.4%CVSS 9.3

Xen1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-79608 · Xen Xen

x86/AMD: ineffectual Zenbleed workaround

EPSS 0.4%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2026-107460 · Apache Software Foundation Apache Fesod (Incubating)

Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

EPSS 0.4%CVSS 9.1

opencats1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2026-54454 · opencats OpenCATS

OpenCATS: Authenticated RCE in the Import module

EPSS 0.4%CVSS 9.1

dragonflydb1 vulnerability on this pageMax CVSS 9.6Priority 33KEV 0

CVE-2026-104192 · dragonflydb dragonfly

DragonflyDB stream RDB deserialization double-free

EPSS 0.3%CVSS 9.6

jfrog1 vulnerability on this pageMax CVSS 9.0Priority 33KEV 0

CVE-2026-92892 · jfrog jfrog-cli

Potential command execution on the host running JFrog CLI.

EPSS 0.3%CVSS 9.0

The archive.