Critical vulnerability archive — page 31

Ahsay1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2026-105134 · Ahsay AhsayCBS

Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

KEV · due 17 Oct EPSS 82%public exploit SSVC act CVSS 10.0

InternLM1 vulnerability on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2026-105135 · InternLM MindSearch

InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection

EPSS 0.8%public exploit CVSS 10.0

Tenda2 vulnerabilities on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2026-104610 · Tenda HG7

Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow

EPSS 0.6%public exploit CVSS 10.0

CVE-2026-104611 · Tenda AC9

Tenda AC9 POST Request fast_setting_internet_set stack-based overflow

EPSS 0.5%CVSS 9.4

GitLab1 vulnerability on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2026-90970 · GitLab GitLab AI Gateway

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

EPSS 17%CVSS 9.9

H3C1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2023-54405 · H3C CVM

H3C CVM Unauthenticated File Upload via fileUpload/upload Token

EPSS 0.6%public exploit CVSS 9.8

mitre3 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-88393 · mitre

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-88391 · mitre

Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /norths…

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-37719 · mitre

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

EPSS 0.7%CVSS 9.8

AWS2 vulnerabilities on this pageMax CVSS 10.0Priority 47KEV 0

CVE-2026-103956 · AWS loom

Missing authentication for critical function in Loom for AWS

EPSS 2%CVSS 10.0

CVE-2026-104019 · AWS sagemaker-distribution

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio

EPSS 1%CVSS 9.3

tinylibs2 vulnerabilities on this pageMax CVSS 9.5Priority 47KEV 0

CVE-2026-104848 · tinylibs tinypool

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

EPSS 0.5%public exploit CVSS 9.5

CVE-2026-104849 · tinylibs tinypool

Tinypool: Prototype Pollution Gadget to RCE in run() options

EPSS 0.5%public exploit CVSS 9.5

YesWiki1 vulnerability on this pageMax CVSS 9.2Priority 44KEV 0

CVE-2026-104467 · YesWiki yeswiki

YesWiki before 4.6.7 Authorization Bypass via Public API Mode

EPSS 0.4%public exploit CVSS 9.2

WWBN2 vulnerabilities on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2026-105086 · WWBN AVideo

WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title

EPSS 0.3%public exploit CVSS 9.3

CVE-2026-105089 · WWBN AVideo

WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

EPSS 0.3%public exploit CVSS 9.3

MikroTik1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-84411 · MikroTik RouterOS

MikroTik RouterOS Integer Underflow

EPSS 0.9%CVSS 9.8

NASA-AMMOS1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-105105 · NASA-AMMOS AIT-Core

Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration

EPSS 0.8%CVSS 9.8

parorrey1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-97637 · parorrey JSON API Auth

JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

EPSS 0.6%CVSS 9.8

beaverbuilder1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-92084 · beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder

Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

EPSS 0.8%CVSS 9.1

e4jvikwp1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-87115 · e4jvikwp VikAppointments Services Booking Calendar

VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter

EPSS 0.9%CVSS 9.1

UTMStack2 vulnerabilities on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-82042 · UTMStack UTMStack

UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter

EPSS 0.5%CVSS 9.8

CVE-2026-82041 · UTMStack UTMStack

UTMStack < 11.2.16 Missing Authorization via Command WebSocket

EPSS 0.4%CVSS 9.9

amauric1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-94541 · amauric WPMobile.App – Android and iOS App Builder

WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

EPSS 0.5%CVSS 9.8

Apache Software Foundation4 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-103877 · Apache Software Foundation Apache Directory LDAP API

Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

EPSS 0.5%CVSS 9.8

CVE-2026-91135 · Apache Software Foundation Apache Thrift

Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

EPSS 0.3%CVSS 9.2

CVE-2026-102795 · Apache Software Foundation Apache Traffic Server

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

EPSS 0.3%CVSS 9.3

CVE-2026-83632 · Apache Software Foundation Apache Thrift

Apache Thrift: C++ THttpTransport grows its line buffer without bound

EPSS 0.3%CVSS 9.2

C4illin1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-105080 · C4illin ConvertX

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from C…

EPSS 0.4%CVSS 9.9

demsking1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-103648 · demsking image-downloader

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

EPSS 0.5%CVSS 9.1

Digi International1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2026-75937 · Digi International IX Family

OS Command Injection in Digi Accelerated Linux (DAL OS)

EPSS 0.5%CVSS 9.4

Webpros1 vulnerability on this pageMax CVSS 9.0Priority 36KEV 0

CVE-2026-93029 · Webpros cPanel

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

EPSS 0.5%CVSS 9.0

DiviEngine1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-19652 · DiviEngine Divi Membership

Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

EPSS 0.3%CVSS 9.8

Google3 vulnerabilities on this pageMax CVSS 9.6Priority 35KEV 0

CVE-2026-103628 · Google Chrome

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sand…

EPSS 0.4%CVSS 9.6

CVE-2026-103626 · Google Chrome

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social e…

EPSS 0.3%CVSS 9.6

CVE-2026-103630 · Google Chrome

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox v…

EPSS 0.3%CVSS 9.6

lxsmnsyc1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-104846 · lxsmnsyc seroval

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

EPSS 0.3%CVSS 9.8

Monta1 vulnerability on this pageMax CVSS 9.4Priority 34KEV 0

CVE-2026-95102 · Monta monta.app

Monta monta.app Missing Authentication for Critical Function

EPSS 0.4%CVSS 9.4

Moxa1 vulnerability on this pageMax CVSS 9.4Priority 34KEV 0

CVE-2026-86325 · Moxa MGate MB3170 Series

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface.

EPSS 0.3%CVSS 9.4

Unlimited Elements1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-103355 · Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

zitadel4 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-105207 · zitadel zitadel

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

EPSS 0.3%CVSS 9.8

CVE-2026-105211 · zitadel zitadel

ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

EPSS 0.3%CVSS 9.2

CVE-2026-105215 · zitadel zitadel

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

EPSS 0.3%CVSS 9.3

CVE-2026-105209 · zitadel zitadel

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

EPSS 0.2%CVSS 9.6

Legion of the Bouncy Castle Inc.2 vulnerabilities on this pageMax CVSS 9.2Priority 32KEV 0

CVE-2026-63569 · Legion of the Bouncy Castle Inc. bc-csharp

MTI/A0 DHAgreement does not validate the peer's ephemeral value

EPSS 0.3%CVSS 9.1

CVE-2026-71885 · Legion of the Bouncy Castle Inc. BC-JAVA

MLS X.509 credential not bound to the LeafNode signature key

EPSS 0.2%CVSS 9.2

defunkt1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2026-105221 · defunkt gist

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

EPSS 0.2%CVSS 9.1

alexpechkarev1 vulnerability on this pageMax CVSS 9.1Priority 29KEV 0

CVE-2026-105222 · alexpechkarev google-maps

alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

EPSS 0.2%CVSS 9.1

micro1 vulnerability on this pageMax CVSS 9.1Priority 29KEV 0

CVE-2026-105216 · micro go-micro

go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

EPSS 0.2%CVSS 9.1

go-pay1 vulnerability on this pageMax CVSS 9.1Priority 28KEV 0

CVE-2026-105218 · go-pay gopay

gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

EPSS 0.2%CVSS 9.1

The archive.