Critical vulnerability archive — page 205

siteboon2 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2026-31975 · siteboon claudecodeui

Cloud CLI WebSocket shell injection

EPSS 4%public exploit CVSS 9.8

CVE-2026-31862 · siteboon claudecodeui

Cloud CLI has Command Injection via Multiple Parameters

EPSS 0.5%CVSS 9.1

mitre7 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-26793 · mitre

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function.

EPSS 3%public exploit CVSS 9.8

CVE-2025-70245 · mitre

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.

EPSS 0.7%public exploit CVSS 9.8

CVE-2026-26791 · mitre

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_…

EPSS 3%CVSS 9.8

CVE-2026-26792 · mitre

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the mode…

EPSS 3%CVSS 9.8

CVE-2026-26795 · mitre

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log…

EPSS 3%CVSS 9.8

CVE-2026-25823 · mitre

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3…

EPSS 0.8%CVSS 9.8

CVE-2026-25818 · mitre

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3…

EPSS 0.2%CVSS 9.1

SGLang2 vulnerabilities on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2026-3059 · SGLang SGLang

CVE-2026-3059

EPSS 2%public exploit CVSS 9.8

CVE-2026-3060 · SGLang SGLang

CVE-2026-3060

EPSS 1%public exploit CVSS 9.8

AdguardTeam1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-32136 · AdguardTeam AdGuardHome

AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

EPSS 0.8%public exploit CVSS 9.8

Canonical1 vulnerability on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2026-28384 · Canonical lxd

Authenticated RCE via unsanitized compression_algorithm

EPSS 0.8%public exploit CVSS 9.9

Taskosaur1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-31874 · Taskosaur Taskosaur

Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration

EPSS 0.7%public exploit CVSS 9.8

@tinacms1 vulnerability on this pageMax CVSS 9.7Priority 49KEV 0

CVE-2026-28792 · @tinacms cli

Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

EPSS 0.6%public exploit CVSS 9.7

dataease2 vulnerabilities on this pageMax CVSS 9.3Priority 49KEV 0

CVE-2026-32140 · dataease dataease

Dataease: Redshift JDBC RCE Bypass

EPSS 0.8%public exploit CVSS 9.3

CVE-2026-32137 · dataease dataease

DataEase SQL Injection Vulnerability

EPSS 0.5%public exploit CVSS 9.3

Honeywell1 vulnerability on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2026-3611 · Honeywell IQ4E

Honeywell IQ4x BMS Controller Missing authentication for critical function

EPSS 6%CVSS 10.0

RIOT-OS1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-27703 · RIOT-OS RIOT

RIOT has an Out-of-Bounds Write in nanoCoAP Handler

EPSS 0.5%public exploit CVSS 9.8

undici1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-1525 · undici undici

undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS 0.6%public exploit CVSS 9.8

runtipi1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-31881 · runtipi runtipi

Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window

EPSS 0.5%public exploit CVSS 9.8

Bubka1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2026-32133 · Bubka 2FAuth

2FAuth has Blind SSRF in image parameter allows internal network access and more

EPSS 0.6%public exploit CVSS 9.1

itsourcecode3 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-3980 · itsourcecode Online Doctor Appointment System

itsourcecode Online Doctor Appointment System patient_action.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-3981 · itsourcecode Online Doctor Appointment System

itsourcecode Online Doctor Appointment System doctor_action.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-4014 · itsourcecode Cafe Reservation System

itsourcecode Cafe Reservation System Registration signup.php sql injection

EPSS 0.4%public exploit CVSS 9.8

LabRedesCefetRJ1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-31896 · LabRedesCefetRJ WeGIA

WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php

EPSS 0.4%public exploit CVSS 9.8

tolgee1 vulnerability on this pageMax CVSS 9.3Priority 46KEV 0

CVE-2026-32251 · tolgee tolgee-platform

Tolgee has an XXE Injection in Translation Import

EPSS 0.5%public exploit CVSS 9.3

denoland1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-32260 · denoland deno

Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)

EPSS 2%CVSS 9.8

Veeam5 vulnerabilities on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2026-21666 · Veeam Backup and Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

EPSS 1%CVSS 10.0

CVE-2026-21667 · Veeam Backup and Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

EPSS 1%CVSS 10.0

CVE-2026-21669 · Veeam Backup and Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

EPSS 1%CVSS 10.0

CVE-2026-21708 · Veeam Backup and Replication

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

EPSS 1%CVSS 9.9

CVE-2026-21671 · Veeam Software Appliance

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availabi…

EPSS 1%CVSS 9.1

openemr1 vulnerability on this pageMax CVSS 9.0Priority 42KEV 0

CVE-2026-32118 · openemr openemr

OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text

EPSS 0.3%public exploit CVSS 9.0

wintercms1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2026-27591 · wintercms winter

Winter: Privilege escalation by authenticated backend users

EPSS 0.8%CVSS 10.0

himmelblau-idm1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-31957 · himmelblau-idm himmelblau

Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments

EPSS 0.6%CVSS 10.0

parse-community3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-32248 · parse-community parse-server

Parse Server: Account takeover via operator injection in authentication data identifier

EPSS 0.7%CVSS 9.8

CVE-2026-31871 · parse-community parse-server

Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

EPSS 0.5%CVSS 9.8

CVE-2026-32242 · parse-community parse-server

Parse Server OAuth2 adapter shares mutable state across providers via singleton instance

EPSS 0.3%CVSS 9.1

qhkm1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-32232 · qhkm zeptoclaw

ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink

EPSS 0.7%CVSS 9.8

QNAP Systems Inc.1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-59388 · QNAP Systems Inc. Hyper Data Protector

Hyper Data Protector

EPSS 0.5%CVSS 9.8

xygeni1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-31976 · xygeni xygeni-action

xygeni-action v5 tag poisoned with C2 backdoor

EPSS 0.6%CVSS 9.8

psf1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-31900 · psf black

Black's vulnerable version parsing leads to RCE in GitHub Action

EPSS 0.5%CVSS 9.8

Google1 vulnerability on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2026-3916 · Google Chrome

Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escap…

EPSS 0.4%CVSS 9.6

frappe1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-31877 · frappe frappe

Frappe SQL Injection due to improper field sanitization

EPSS 0.3%CVSS 9.8

Trane3 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-28255 · Trane Tracer SC

Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

EPSS 0.3%CVSS 9.8

CVE-2026-28256 · Trane Tracer SC

Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

EPSS 0.3%CVSS 9.8

CVE-2026-28252 · Trane Tracer SC

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

EPSS 0.2%CVSS 9.8

useplunk1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2026-32096 · useplunk plunk

Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

EPSS 0.3%CVSS 9.3

unitycatalog1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2026-27478 · unitycatalog unitycatalog

Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation

EPSS 0.2%CVSS 9.1

The archive.