Critical vulnerability archive — page 215

Cisco2 vulnerabilities on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2026-20127 · Cisco Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

KEV · due 27 Feb EPSS 88%public exploit SSVC act CVSS 10.0

CVE-2026-20129 · Cisco Cisco Catalyst SD-WAN Manager

Cisco Catayst SD-WAN Authentication Bypass Vulnerability

EPSS 0.8%CVSS 9.8

Juniper Networks1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2026-21902 · Juniper Networks Junos OS Evolved

Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

EPSS 18%public exploit CVSS 9.8

OneUptime1 vulnerability on this pageMax CVSS 10.0Priority 56KEV 0

CVE-2026-27728 · OneUptime oneuptime

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

EPSS 2%public exploit CVSS 10.0

agentfront1 vulnerability on this pageMax CVSS 10.0Priority 53KEV 0

CVE-2026-27597 · agentfront enclave

@enclave-vm/core is vulnerable to Sandbox Escape

EPSS 1%public exploit CVSS 10.0

patrickjuchli1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2026-27699 · patrickjuchli basic-ftp

Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

EPSS 0.9%public exploit CVSS 9.8

SPIP2 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2026-27744 · SPIP tickets

SPIP tickets < 4.3.3 Unauthenticated RCE

EPSS 1%public exploit CVSS 9.8

CVE-2026-27743 · SPIP referer_spam

SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection

EPSS 0.7%public exploit CVSS 9.8

swaldman1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2026-27727 · swaldman mchange-commons-java

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

EPSS 1.0%public exploit CVSS 9.8

freescout-help-desk1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-27637 · freescout-help-desk freescout

FreeScout's Predictable Authentication Token Enables Account Takeover

EPSS 0.8%public exploit CVSS 9.8

FreeRDP5 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

OliveTin1 vulnerability on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2026-27626 · OliveTin OliveTin

OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

EPSS 0.6%public exploit CVSS 10.0

n8n-io6 vulnerabilities on this pageMax CVSS 9.9Priority 49KEV 0

openemr1 vulnerability on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2026-24908 · openemr openemr

OpenEMR has SQL Injection in Patient API Sort Parameter

EPSS 0.5%public exploit CVSS 10.0

itsourcecode4 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-3151 · itsourcecode College Management System

itsourcecode College Management System login.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-3152 · itsourcecode College Management System

itsourcecode College Management System teacher-salary.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-3153 · itsourcecode Document Management System

itsourcecode Document Management System register.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-3164 · itsourcecode News Portal Project

itsourcecode News Portal Project contactus.php sql injection

EPSS 0.4%public exploit CVSS 9.8

SourceCodester1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-3148 · SourceCodester Simple and Nice Shopping Cart Script

SourceCodester Simple and Nice Shopping Cart Script signup.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Budibase1 vulnerability on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2026-27702 · Budibase budibase

Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

EPSS 0.4%public exploit CVSS 9.9

ePati Cyber Security Technologies Inc.1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-2624 · ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW)

Authentication Bypass in ePati's Antikor NGFW

EPSS 2%CVSS 9.8

go-vikunja1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-27575 · go-vikunja vikunja

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

EPSS 0.5%public exploit CVSS 9.1

Linksys3 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-27847 · Linksys MR9600

Missing authentication in Linksys MR9600, Linksys MX4200

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-27848 · Linksys MR9600

Missing neutralization in Linksys MR9600, Linksys MX4200

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-27849 · Linksys MR9600

Missing neutralization in Linksys MR9600, Linksys MX4200

EPSS 0.4%public exploit CVSS 9.8

rustfs2 vulnerabilities on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-27822 · rustfs rustfs

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

EPSS 5%CVSS 9.1

CVE-2026-27607 · rustfs rustfs

RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

EPSS 0.4%CVSS 9.1

feiyuchuixue1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-3187 · feiyuchuixue sz-boot-parent

feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload

EPSS 0.4%public exploit CVSS 9.8

jugmac001 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2026-27641 · jugmac00 flask-reuploaded

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

EPSS 1%CVSS 9.8

bugsink1 vulnerability on this pageMax CVSS 9.3Priority 43KEV 0

CVE-2026-27614 · bugsink bugsink

Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

EPSS 0.3%public exploit CVSS 9.3

SUSE1 vulnerability on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2025-62878 · SUSE Rancher

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

EPSS 0.6%CVSS 9.9

MOTEX Inc.1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-25785 · MOTEX Inc. Lanscope Endpoint Manager (On-Premises) Sub-Manager Server

Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allo…

EPSS 0.6%CVSS 9.8

parse-community2 vulnerabilities on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-27595 · parse-community parse-dashboard

Parse Dashboard has incomplete authentication on AI Agent endpoint

EPSS 0.5%CVSS 9.9

CVE-2026-27608 · parse-community parse-dashboard

Parse Dashboard Missing Authorization on Agent Endpoint

EPSS 0.3%CVSS 9.3

storybookjs1 vulnerability on this pageMax CVSS 9.6Priority 39KEV 0

CVE-2026-27148 · storybookjs storybook

Storybook Dev Server Vulnerable to WebSocket Hijacking

EPSS 0.6%CVSS 9.6

ServiceNow1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-0542 · ServiceNow ServiceNow AI Platform

Remote Code Execution in ServiceNow AI Platform

EPSS 0.7%CVSS 9.2

angular1 vulnerability on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2026-27739 · angular angular-cli

Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

EPSS 0.6%CVSS 9.2

ASUSTOR1 vulnerability on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2026-3179 · ASUSTOR ADM

A path traversal vulnerability was found in the FTP Backup on the ADM.

EPSS 0.6%CVSS 9.2

Gardyn1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2025-1242 · Gardyn Home Kit

Administrative Credentials Can Be Extracted Through Gardyn API Responses

EPSS 0.6%CVSS 9.3

VMware1 vulnerability on this pageMax CVSS 9.0Priority 35KEV 0

CVE-2026-22720 · VMware VMware Aria Operations

VMware Aria Operations stored cross-site scripting vulnerability

EPSS 0.4%CVSS 9.0

Octopus Deploy1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2026-0704 · Octopus Deploy Octopus Server

In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint.

EPSS 0.4%CVSS 9.1

The archive.