Critical vulnerability archive — page 220

Dell1 vulnerability on this pageMax CVSS 10.0Priority 99KEV 1

CVE-2026-22769 · Dell RecoverPoint for Virtual Machines

Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

KEV · due 21 Feb EPSS 14%public exploit SSVC act CVSS 10.0

Grandstream1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2026-2329 · Grandstream GXP1610

Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow

EPSS 42%public exploit CVSS 9.8

Wavlink3 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2026-2527 · Wavlink WL-WN579A3

Wavlink WL-WN579A3 login.cgi command injection

EPSS 9%public exploit CVSS 9.8

CVE-2026-2528 · Wavlink WL-WN579A3

Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injection

EPSS 9%public exploit CVSS 9.8

CVE-2026-2529 · Wavlink WL-WN579A3

Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection

EPSS 9%public exploit CVSS 9.8

sergejey4 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2026-27174 · sergejey MajorDoMo

MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval

EPSS 7%public exploit CVSS 9.8

CVE-2026-27175 · sergejey MajorDoMo

MajorDoMo Command Injection in rc/index.php via Race Condition

EPSS 7%public exploit CVSS 9.8

CVE-2026-27180 · sergejey MajorDoMo

MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning

EPSS 1%CVSS 9.8

CVE-2026-27179 · sergejey MajorDoMo

MajorDoMo Unauthenticated SQL Injection in Commands Module

EPSS 0.5%CVSS 9.8

InvoicePlane2 vulnerabilities on this pageMax CVSS 9.3Priority 56KEV 0

CVE-2026-23491 · InvoicePlane InvoicePlane

InvoicePlane has Unauthenticated Path Traversal in Guest Controller

EPSS 5%public exploit CVSS 9.3

CVE-2026-25548 · InvoicePlane InvoicePlane

InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

EPSS 0.9%CVSS 9.1

SECCN Dingcheng1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2026-2686 · SECCN Dingcheng G10

SECCN Dingcheng G10 session_login.cgi qq os command injection

EPSS 3%public exploit CVSS 9.8

mitre12 vulnerabilities on this pageMax CVSS 9.9Priority 55KEV 0

CVE-2025-65791 · mitre

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.

EPSS 2%public exploit CVSS 9.8

CVE-2025-59793 · mitre

Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be a…

EPSS 1%public exploit CVSS 9.9

CVE-2025-70830 · mitre

A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attack…

EPSS 1%public exploit CVSS 9.9

CVE-2025-70150 · mitre

CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthentica…

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-67304 · mitre

In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user.

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-67305 · mitre

In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user.

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-70141 · mitre

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php.

EPSS 0.8%public exploit CVSS 9.4

CVE-2025-70146 · mitre

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows re…

EPSS 0.6%public exploit CVSS 9.1

CVE-2025-70152 · mitre

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin…

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-70998 · mitre

UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, poss…

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-70149 · mitre

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-55853 · mitre

SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF).

EPSS 0.4%public exploit CVSS 9.1

Beetel1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2026-2616 · Beetel 777VR1

Beetel 777VR1 Web Management hard-coded credentials

EPSS 1%public exploit CVSS 9.8

nltk1 vulnerability on this pageMax CVSS 10.0Priority 53KEV 0

CVE-2025-14009 · nltk nltk/nltk

Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

EPSS 1%public exploit CVSS 10.0

OpenS100 Project1 vulnerability on this pageMax CVSS 9.6Priority 52KEV 0

CVE-2026-22208 · OpenS100 Project OpenS100

OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access

EPSS 1%public exploit CVSS 9.6

EFM1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-2550 · EFM iptime A6004MX

EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload

EPSS 0.7%public exploit CVSS 9.8

itsourcecode3 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-2689 · itsourcecode Event Management System

itsourcecode Event Management System manage_booking.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-2690 · itsourcecode Event Management System

itsourcecode Event Management System Admin Login ajax.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-2691 · itsourcecode Event Management System

itsourcecode Event Management System manage_register.php sql injection

EPSS 0.5%public exploit CVSS 9.8

ModelTC1 vulnerability on this pageMax CVSS 9.3Priority 50KEV 0

CVE-2026-26220 · ModelTC LightLLM

LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

EPSS 1.0%public exploit CVSS 9.3

VulDB1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-2522 · VulDB

Open5GS MME esm-build.c memory corruption

EPSS 0.6%public exploit CVSS 9.8

Tsinghua Unigroup2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-2684 · Tsinghua Unigroup Electronic Archives System

Tsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-2682 · Tsinghua Unigroup Electronic Archives System

Tsinghua Unigroup Electronic Archives System prinReport.html sql injection

EPSS 0.4%public exploit CVSS 9.8

huggingface1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-2654 · huggingface smolagents

huggingface smolagents LocalPythonExecutor requests.post server-side request forgery

EPSS 0.4%public exploit CVSS 9.8

Honeywell1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-1670 · Honeywell I-HIB2PI-UL 2MP IP

Honeywell CCTV Products Missing Authentication for Critical Function

EPSS 0.8%CVSS 9.8

Glory Global Solutions1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-23647 · Glory Global Solutions RBG-100

Glory RBG-100 Recycler System Hard-coded OS Credentials

EPSS 0.7%CVSS 9.8

gogs1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-25242 · gogs gogs

Gogs allows unauthenticated file uploads

EPSS 0.7%CVSS 9.8

HKUDS1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-2577 · HKUDS nanobot

Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge

EPSS 0.7%CVSS 10.0

BVA1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-2439 · BVA Concierge::Sessions

Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids

EPSS 0.5%CVSS 9.8

GitHub1 vulnerability on this pageMax CVSS 9.0Priority 38KEV 0

CVE-2026-0573 · GitHub Enterprise Server

Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution

EPSS 0.7%CVSS 9.0

Graylog1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-1435 · Graylog Graylog Web Interface

Incorrect management of session invalidation vulnerability in Graylog Web Interface

EPSS 0.4%CVSS 9.8

Intelbras1 vulnerability on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2026-2564 · Intelbras VIP 3260 Z IA

Intelbras VIP 3260 Z IA OutsideCmd password recovery

EPSS 0.5%CVSS 9.2

OpenText™1 vulnerability on this pageMax CVSS 9.5Priority 36KEV 0

CVE-2025-15579 · OpenText™ Directory Services

An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.

EPSS 0.4%CVSS 9.5

WeblateOrg1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-24126 · WeblateOrg weblate

Weblate has an argument injection in management console

EPSS 0.5%CVSS 9.1

TEEJAY1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-15578 · TEEJAY Maypole

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely

EPSS 0.3%CVSS 9.8

lintsinghua1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-2532 · lintsinghua DeepAudit

lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery

EPSS 0.3%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2025-33089 · IBM Concert

Multiple Vulnerabilities in IBM Concert Software.

EPSS 0.3%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2025-66614 · Apache Software Foundation Apache Tomcat

Apache Tomcat: Client certificate verification bypass due to virtual host mapping

EPSS 0.3%CVSS 9.1

The archive.