The archive.

Browse all tracked critical vulnerabilities, including records outside today's brief.

38,974 matching vulnerabilities · Page 222 of 780

mitre4 vulnerabilities on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2025-69874 · mitre

nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary…

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-64075 · mitre

A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers…

EPSS 0.8%CVSS 10.0

CVE-2025-70085 · mitre

An issue was discovered in OpenSatKit 2.2.1.

EPSS 0.6%CVSS 9.8

CVE-2025-67135 · mitre

Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code repl…

EPSS 0.4%CVSS 9.8

frangoteam5 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

karutoil1 vulnerability on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2026-26009 · karutoil catalyst

Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution

EPSS 0.6%public exploit CVSS 10.0

Red Hat1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-69872 · Red Hat Red Hat OpenShift AI 3.3

DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.

EPSS 0.6%public exploit CVSS 9.8

wpvividplugins1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-1357 · wpvividplugins WPvivid — Backup, Migration & Staging

Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload

EPSS 39%CVSS 9.8

code-projects1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-2223 · code-projects Online Reviewer System

code-projects Online Reviewer System index.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Fortinet1 vulnerability on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2025-52436 · Fortinet FortiSandbox

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet…

EPSS 7%CVSS 9.6

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-2225 · itsourcecode News Portal Project

itsourcecode News Portal Project Administrator Login index.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Microsoft1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-21531 · Microsoft Azure AI Language Authoring

Azure SDK for Python Remote Code Execution Vulnerability

EPSS 3%CVSS 9.8

My-Little-Forum1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-25923 · My-Little-Forum mylittleforum

Phar Deserialization leading to Arbitrary File Deletion in my little forum

EPSS 0.5%public exploit CVSS 9.1

MacWarrior1 vulnerability on this pageMax CVSS 9.3Priority 43KEV 0

CVE-2026-25728 · MacWarrior clipbucket-v5

ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition

EPSS 0.3%public exploit CVSS 9.3

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-23906 · Apache Software Foundation Apache Druid

Apache Druid: Authentication Bypass via LDAP Anonymous Bind

EPSS 1%CVSS 9.8

ZLAN Information Technology Co.1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-25084 · ZLAN Information Technology Co. ZLAN5143D

ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function

EPSS 0.8%CVSS 9.8

CASL Ability1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-1774 · CASL Ability CASL Ability

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

EPSS 0.7%CVSS 9.8

nyariv1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-25881 · nyariv SandboxJS

@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

EPSS 0.6%CVSS 10.0

QNAP Systems Inc.1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-66277 · QNAP Systems Inc. QTS

QTS, QuTS hero

EPSS 0.7%CVSS 9.8

Dinosoft Business Solutions1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-8025 · Dinosoft Business Solutions Dinosoft ERP

Improper Access Control in Dinosoft Business Solutions' Dinosoft ERP

EPSS 0.6%CVSS 9.8

Flowring2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-2095 · Flowring Agentflow

Flowring｜Agentflow - Authentication Bypass

EPSS 0.6%CVSS 9.8

CVE-2026-2096 · Flowring Agentflow

Flowring｜Agentflow - Missing Authenticaton

EPSS 0.6%CVSS 9.8

METIS Cyberspace Technology SA2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-2248 · METIS Cyberspace Technology SA METIS WIC

Unauthenticated Remote Root Shell Access via Web Console in METIS WIC

EPSS 0.6%CVSS 9.8

CVE-2026-2249 · METIS Cyberspace Technology SA METIS DFS

Unauthenticated Remote Command Execution via Web Console in METIS DFS

EPSS 0.6%CVSS 9.8

SAP_SE2 vulnerabilities on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-0488 · SAP_SE SAP CRM and SAP S/4HANA (Scripting Editor)

Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)

EPSS 0.5%CVSS 9.9

CVE-2026-0509 · SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform

Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform

EPSS 0.4%CVSS 9.6

JetBrains1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-25848 · JetBrains Hub

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

EPSS 0.5%CVSS 9.8

FreeRDP2 vulnerabilities on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-24677 · FreeRDP FreeRDP

FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264

EPSS 0.5%CVSS 9.1

CVE-2026-24679 · FreeRDP FreeRDP

FreeRDP has a heap-buffer-overflow in urb_select_interface

EPSS 0.5%CVSS 9.1

gofiber1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2025-66630 · gofiber fiber

Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

EPSS 0.5%CVSS 9.4

MarkUsProject1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-25057 · MarkUsProject Markus

Zip Slip in MarkUs config upload allowing RCE

EPSS 0.5%CVSS 9.1

Xpoda Türkiye Information Technology Inc.1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-6830 · Xpoda Türkiye Information Technology Inc. Password Module

SQLi in Xpoda Türkiye Information Technology's Password Module

EPSS 0.5%CVSS 9.8

evershopcommerce1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-25993 · evershopcommerce evershop

EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

EPSS 0.4%CVSS 9.8

Logo Software Industry and Trade Inc.1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-12059 · Logo Software Industry and Trade Inc. Logo j-Platform

Improper Access Control in Logo Software's Logo j-Platform

EPSS 0.4%CVSS 9.8

polarnl1 vulnerability on this pageMax CVSS 10.0Priority 36KEV 0

CVE-2026-25885 · polarnl PolarLearn

PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats

EPSS 0.3%CVSS 10.0

Praskla-Technology7 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-25809 · Praskla-Technology assessment-placipy

PlaciPy Code Execution Allowed Without Assessment Active State Validation

EPSS 0.4%CVSS 9.8

CVE-2026-25814 · Praskla-Technology assessment-placipy

NoSQL Injection Risk via Unsanitized Query Parameters

EPSS 0.4%CVSS 9.8

CVE-2026-25875 · Praskla-Technology assessment-placipy

PlaciPy Admin Privilege Escalation via Trusted JWT Claims

EPSS 0.3%CVSS 9.8

CVE-2026-25810 · Praskla-Technology assessment-placipy

PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts

EPSS 0.3%CVSS 9.1

CVE-2026-25811 · Praskla-Technology assessment-placipy

PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)

EPSS 0.3%CVSS 9.1

CVE-2026-25876 · Praskla-Technology assessment-placipy

PlaciPy is Missing Authorization on Assessment Results Endpoint

EPSS 0.3%CVSS 9.1

CVE-2026-25812 · Praskla-Technology assessment-placipy

PlaciPy is Missing CSRF Protection on State-Changing Endpoints

EPSS 0.2%CVSS 9.3

E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co.1 vulnerability on this pageMax CVSS 9.4Priority 35KEV 0

CVE-2025-8668 · E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard

Reflected XSS in E-Kalite Software Hardware Engineering's Turboard

EPSS 0.4%CVSS 9.4

Teknolist Computer Systems Software Publishing Industry and Trade Inc.1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-11242 · Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik

SSRF in Teknolist Computer's Okulistik

EPSS 0.4%CVSS 9.8

WAGO1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-22906 · WAGO 0852-1322

Hardcoded Key Allows Credential Disclosure

EPSS 0.4%CVSS 9.8

GitLab1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2025-7659 · GitLab GitLab

Origin Validation Error in GitLab

EPSS 0.2%CVSS 9.1