Critical vulnerability archive — page 200

NetScaler1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2026-3055 · NetScaler ADC

Insufficient input validation leading to memory overread

KEV · due 2 Apr EPSS 91%public exploit SSVC act CVSS 9.8

aquasecurity1 vulnerability on this pageMax CVSS 9.4Priority 98KEV 1

CVE-2026-33634 · aquasecurity setup-trivy

Trivy ecosystem supply chain briefly compromised

KEV · due 9 Apr EPSS 60%public exploit SSVC act CVSS 9.4

WWBN6 vulnerabilities on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2026-33478 · WWBN AVideo

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

EPSS 14%public exploit CVSS 10.0

CVE-2026-33352 · WWBN AVideo

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-33502 · WWBN AVideo

AVideo has Unauthenticated SSRF via plugin/Live/test.php

EPSS 0.5%public exploit CVSS 9.3

CVE-2026-33716 · WWBN AVideo

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

EPSS 0.5%public exploit CVSS 9.4

CVE-2026-33351 · WWBN AVideo

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-33297 · WWBN AVideo

AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

EPSS 0.4%public exploit CVSS 9.1

Tenda1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-4567 · Tenda A15

Tenda A15 UploadCfg stack-based overflow

EPSS 4%public exploit CVSS 9.8

Tiandy1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-4585 · Tiandy Easy7 Integrated Management Platform

Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection

EPSS 5%CVSS 9.8

code-projects3 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-4579 · code-projects Simple Laundry System

code-projects Simple Laundry System Parameters viewdetail.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-4581 · code-projects Simple Laundry System

code-projects Simple Laundry System Parameters checklogin.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-4580 · code-projects Simple Laundry System

code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection

EPSS 0.3%public exploit CVSS 9.8

mantisbt1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-30849 · mantisbt mantisbt

MantisBT SOAP API has an authentication bypass vulnerability on MySQL

EPSS 2%CVSS 9.8

Red Hat3 vulnerabilities on this pageMax CVSS 9.4Priority 43KEV 0

CVE-2026-4600 · Red Hat Migration Toolkit for Virtualization 2.1

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-par…

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-4599 · Red Hat Migration Toolkit for Virtualization 2.1

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRa…

EPSS 0.5%CVSS 9.3

CVE-2026-4601 · Red Hat Migration Toolkit for Virtualization 2.1

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash…

EPSS 0.3%CVSS 9.4

acowebs1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-4001 · acowebs Woocommerce Custom Product Addons Pro

Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula

EPSS 0.9%CVSS 9.8

WAGO1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2026-3587 · WAGO Lean Managed Switch 852-1812

Hidden CLI Function Allows Root Access

EPSS 0.7%CVSS 10.0

MB connect line1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-32968 · MB connect line MB connect line mbCONNECT24

Unauthenticated RCE in com_mb24sysapi

EPSS 0.6%CVSS 9.8

Mozilla2 vulnerabilities on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-4688 · Mozilla Firefox

Sandbox escape due to use-after-free in the Disability Access APIs component

EPSS 0.6%CVSS 10.0

CVE-2026-4687 · Mozilla Firefox

Sandbox escape due to incorrect boundary conditions in the Telemetry component

EPSS 0.6%CVSS 9.6

OpenClaw3 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-32056 · OpenClaw OpenClaw

OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run

EPSS 0.6%CVSS 9.8

CVE-2026-32064 · OpenClaw OpenClaw

OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer

EPSS 0.5%CVSS 9.1

CVE-2026-32913 · OpenClaw OpenClaw

OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

EPSS 0.3%CVSS 9.3

PTC1 vulnerability on this pageMax CVSS 9.3Priority 39KEV 0

CVE-2026-4681 · PTC Windchill PDMLink

Critical Remote Code Execution vulnerability reported in Windchill

EPSS 0.7%CVSS 9.3

rails2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-33195 · rails activestorage

Rails Active Storage has possible Path Traversal in DiskService

EPSS 0.6%CVSS 9.8

CVE-2026-33202 · rails activestorage

Rails Active Storage has possible glob injection in its DiskService

EPSS 0.7%CVSS 9.1

tektoncd1 vulnerability on this pageMax CVSS 9.6Priority 39KEV 0

CVE-2026-33211 · tektoncd pipeline

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

EPSS 0.6%CVSS 9.6

graphiti-api1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-33286 · graphiti-api graphiti

Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

EPSS 0.7%CVSS 9.1

Harbor1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2026-4404 · Harbor Harbor

Use of hard coded credentials in GoHarbor Harbor

EPSS 0.5%CVSS 9.4

Salesforce1 vulnerability on this pageMax CVSS 9.4Priority 36KEV 0

CVE-2026-2298 · Salesforce Marketing Cloud Engagement

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement…

EPSS 0.4%CVSS 9.4

Census1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-60949 · Census CSWeb

Census CSWeb leaked configuration files

EPSS 0.4%CVSS 9.3

legalweb1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-4283 · legalweb WP DSGVO Tools (GDPR)

WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users

EPSS 0.4%CVSS 9.1

Nexxt Solutions2 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-31851 · Nexxt Solutions Nebula 300+

Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks

EPSS 0.3%CVSS 9.8

CVE-2026-31848 · Nexxt Solutions Nebula 300+

Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+

EPSS 0.3%CVSS 9.8

slajerek1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-4753 · slajerek RetroDebugger

Out-of-bounds Read in slajerek RetroDebugger

EPSS 0.4%CVSS 9.1

dendibakh1 vulnerability on this pageMax CVSS 10.0Priority 34KEV 0

CVE-2026-4745 · dendibakh perf-ninja

Arbitrary Code Execution via Crafted Bytecode in dendibakh/perf-ninja

EPSS 0.3%CVSS 10.0

fabiangreffrath1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2026-4750 · fabiangreffrath woof

Out-of-bounds Read in fabiangreffrath woof

EPSS 0.4%CVSS 9.1

GeoVision1 vulnerability on this pageMax CVSS 10.0Priority 34KEV 0

CVE-2026-4606 · GeoVision GV-Edge Recording Manager

GeoVision ERM Improper Privilege Assignment Leads to SYSTEM-Level Privilege

EPSS 0.3%CVSS 10.0

MolotovCherry2 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-4755 · MolotovCherry Android-ImageMagick7

CWE-20 in MolotovCherry Android-ImageMagick7

EPSS 0.3%CVSS 9.8

CVE-2026-33854 · MolotovCherry Android-ImageMagick7

Out-of-bounds Write in MolotovCherry Android-ImageMagick7

EPSS 0.2%CVSS 9.8

timeplus-io1 vulnerability on this pageMax CVSS 10.0Priority 34KEV 0

CVE-2026-4746 · timeplus-io proton

Heap Buffer Over-Write Vulenrabilty in timeplus-io/proton

EPSS 0.3%CVSS 10.0

Pegasystems1 vulnerability on this pageMax CVSS 9.0Priority 33KEV 0

CVE-2026-0898 · Pegasystems Pega Robot Studio

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.

EPSS 0.3%CVSS 9.0

Cuantis1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2025-41007 · Cuantis Cuantis

SQL Injection in Cuantis

EPSS 0.3%CVSS 9.3

InsightSoftwareConsortium1 vulnerability on this pageMax CVSS 9.4Priority 32KEV 0

CVE-2026-4739 · InsightSoftwareConsortium ITK

Integer overflow vulnerabilities in InsightSoftwareConsortium/ITK

EPSS 0.3%CVSS 9.4

OSGeo1 vulnerability on this pageMax CVSS 9.4Priority 32KEV 0

CVE-2026-4738 · OSGeo gdal

GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution

EPSS 0.3%CVSS 9.4

yoyofr1 vulnerability on this pageMax CVSS 9.4Priority 32KEV 0

CVE-2026-4734 · yoyofr modizer

Heap Buffer Overflow in yoyofr/modizer

EPSS 0.3%CVSS 9.4

Sinturno1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2025-41008 · Sinturno Sinturno

SQL Injection in Sinturno

EPSS 0.2%CVSS 9.3

rizonesoft1 vulnerability on this pageMax CVSS 9.3Priority 28KEV 0

CVE-2026-4744 · rizonesoft Notepad3

Notepad3 Bundled Oniguruma compile_string_node() Heap Buffer Overflow via Crafted Regex Pattern Allows Arbitrary Code Execution

EPSS 0.1%CVSS 9.3

The archive.