Critical vulnerability archive — page 201

langflow-ai1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2026-33017 · langflow-ai langflow

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

KEV · due 8 Apr EPSS 96%public exploit SSVC act CVSS 9.8

mesop-dev2 vulnerabilities on this pageMax CVSS 10.0Priority 58KEV 0

CVE-2026-33057 · mesop-dev mesop

Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

EPSS 7%public exploit CVSS 9.8

CVE-2026-33054 · mesop-dev mesop

Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

EPSS 0.7%public exploit CVSS 10.0

D-Link1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-4499 · D-Link DIR-820LW

D-Link DIR-820LW SSDP ssdpcgi_main os command injection

EPSS 4%public exploit CVSS 9.8

Totolink1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2026-4497 · Totolink WA300

Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection

EPSS 2%public exploit CVSS 9.8

WebReflection1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-33228 · WebReflection flatted

flatted: Prototype Pollution via parse()

EPSS 0.9%public exploit CVSS 9.8

h3js2 vulnerabilities on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2026-33128 · h3js h3

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

EPSS 0.6%public exploit CVSS 10.0

CVE-2026-33131 · h3js h3

h3 has a middleware bypass with one gadget

EPSS 0.4%public exploit CVSS 9.1

wpchill1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-3584 · wpchill Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process

EPSS 7%CVSS 9.8

openVESSL2 vulnerabilities on this pageMax CVSS 9.7Priority 47KEV 0

CVE-2026-32890 · openVESSL Anchorr

Anchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config

EPSS 0.4%public exploit CVSS 9.7

CVE-2026-32891 · openVESSL Anchorr

Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS

EPSS 0.2%public exploit CVSS 9.1

siyuan-note4 vulnerabilities on this pageMax CVSS 9.9Priority 47KEV 0

itsourcecode5 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-4471 · itsourcecode Online Frozen Foods Ordering System

itsourcecode Online Frozen Foods Ordering System admin_edit_employee.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-4469 · itsourcecode Online Frozen Foods Ordering System

itsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injection

EPSS 0.3%public exploit CVSS 9.8

CVE-2026-4470 · itsourcecode Online Frozen Foods Ordering System

itsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injection

EPSS 0.3%public exploit CVSS 9.8

CVE-2026-4472 · itsourcecode Online Frozen Foods Ordering System

itsourcecode Online Frozen Foods Ordering System admin_edit_supplier.php sql injection

EPSS 0.3%public exploit CVSS 9.8

CVE-2026-4473 · itsourcecode Online Doctor Appointment System

itsourcecode Online Doctor Appointment System appointment_action.php sql injection

EPSS 0.3%public exploit CVSS 9.8

TP-Link Systems Inc.2 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-15607 · TP-Link Systems Inc. AX53 v1

Authenticated Command Injection in mcsd Service of TP-Link Archer AX53

EPSS 2%CVSS 9.8

CVE-2025-15608 · TP-Link Systems Inc. AX53 v1

Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55

EPSS 0.6%CVSS 9.8

Admidio1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2026-32817 · Admidio admidio

Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

EPSS 0.3%public exploit CVSS 9.1

grpc1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2026-33186 · grpc grpc-go

gRPC-Go has an authorization bypass via missing leading slash in :path

EPSS 2%CVSS 9.1

LabRedesCefetRJ3 vulnerabilities on this pageMax CVSS 9.3Priority 43KEV 0

CVE-2026-33134 · LabRedesCefetRJ WeGIA

WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter

EPSS 0.3%public exploit CVSS 9.3

CVE-2026-33135 · LabRedesCefetRJ WeGIA

WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter

EPSS 0.2%public exploit CVSS 9.3

CVE-2026-33136 · LabRedesCefetRJ WeGIA

WeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameter

EPSS 0.2%public exploit CVSS 9.3

QNAP Systems Inc.5 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-22897 · QNAP Systems Inc. QuNetSwitch

QuNetSwitch

EPSS 1%CVSS 9.8

CVE-2026-22901 · QNAP Systems Inc. QuNetSwitch

QuNetSwitch

EPSS 1%CVSS 9.8

CVE-2026-22898 · QNAP Systems Inc. QVR Pro

QVR Pro

EPSS 0.7%CVSS 9.8

CVE-2026-22900 · QNAP Systems Inc. QuNetSwitch

QuNetSwitch

EPSS 0.3%CVSS 9.8

CVE-2025-59383 · QNAP Systems Inc. Media Streaming Add-on

Media Streaming Add-on

EPSS 0.3%CVSS 9.1

MariaDB1 vulnerability on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2026-32710 · MariaDB server

Heap-based Buffer Overflow in MariaDB

EPSS 0.9%CVSS 9.9

OpenClaw5 vulnerabilities on this pageMax CVSS 9.9Priority 42KEV 0

Oracle Corporation1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-21992 · Oracle Corporation Oracle Identity Manager

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Ma…

EPSS 1%CVSS 9.8

Yi Technology1 vulnerability on this pageMax CVSS 9.2Priority 42KEV 0

CVE-2026-4478 · Yi Technology YI Home Camera

Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification

EPSS 0.3%public exploit CVSS 9.2

ruby1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-33210 · ruby json

Ruby JSON has a format string injection vulnerability

EPSS 0.9%CVSS 9.1

CTEK1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-25192 · CTEK Chargeportal

CTEK Chargeportal Missing Authentication for Critical Function

EPSS 0.5%CVSS 9.8

IGL-Technologies1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-29796 · IGL-Technologies eParking.fi

IGL-Technologies eParking.fi Missing Authentication for Critical Function

EPSS 0.5%CVSS 9.8

WWBN1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2026-33024 · WWBN AVideo-Encoder

AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator

EPSS 0.5%CVSS 9.3

pjsip1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-32945 · pjsip pjproject

PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser

EPSS 0.3%CVSS 9.8

CodeRevolution1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-4038 · CodeRevolution Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit

Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call

EPSS 0.3%CVSS 9.8

ctfer-io1 vulnerability on this pageMax CVSS 9.9Priority 34KEV 0

CVE-2026-32768 · ctfer-io chall-manager

Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

EPSS 0.3%CVSS 9.9

Imagination Technologies1 vulnerability on this pageMax CVSS 9.6Priority 34KEV 0

CVE-2026-21732 · Imagination Technologies Graphics DDK

GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation

EPSS 0.3%CVSS 9.6

labring1 vulnerability on this pageMax CVSS 9.4Priority 33KEV 0

CVE-2026-33075 · labring FastGPT

FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml

EPSS 0.3%CVSS 9.4

Automated Logic1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2026-24060 · Automated Logic WebCTRL Premium Server

Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information

EPSS 0.2%CVSS 9.1

The archive.