Critical vulnerability archive — page 33

Zammad GmbH2 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 2

CVE-2026-102489 · Zammad GmbH Zammad

Undisclosed RCE in Zammad v6.3 and higher

KEV · due 5 Oct EPSS 22%public exploit SSVC act CVSS 9.8

CVE-2026-102490 · Zammad GmbH Zammad

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

KEV · due 5 Oct EPSS 11%public exploit SSVC act CVSS 9.4

elct96201 vulnerability on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2026-55107 · elct9620 kobako

Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

EPSS 0.8%public exploit CVSS 10.0

mitre11 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-51897 · mitre

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).

EPSS 0.9%public exploit CVSS 9.8

CVE-2026-51884 · mitre

The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal.

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-51886 · mitre

langflow-ai langflow v1.9.3 is affected by: Code Injection.

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-51880 · mitre

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute.

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-51881 · mitre

deeptutor 1.4.0 contains code injection in ExecTool.execute.

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-51882 · mitre

The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal.

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-51875 · mitre

In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write fi…

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-51883 · mitre

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal.

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-51893 · mitre

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap.

EPSS 0.3%public exploit CVSS 9.8

CVE-2026-51879 · mitre

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file.

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-51876 · mitre

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow.

EPSS 0.3%public exploit CVSS 9.1

Quenary3 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-55494 · Quenary tugtainer

Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-55181 · Quenary tugtainer

Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

EPSS 0.6%public exploit CVSS 9.4

CVE-2026-62308 · Quenary tugtainer

Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

EPSS 0.3%public exploit CVSS 9.1

ModelTC1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-103395 · ModelTC LightLLM

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

EPSS 0.6%public exploit CVSS 9.8

piscinajs1 vulnerability on this pageMax CVSS 9.2Priority 46KEV 0

CVE-2026-102992 · piscinajs piscina

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

EPSS 0.5%public exploit CVSS 9.2

denoland1 vulnerability on this pageMax CVSS 9.2Priority 42KEV 0

CVE-2026-103473 · denoland deno

Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

EPSS 1%CVSS 9.2

Kiteworks9 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-102115 · Kiteworks Core

Kiteworks Core Authentication Bypass in the Password Reset Workflow

EPSS 1%CVSS 9.8

CVE-2026-102106 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway improper authentication

EPSS 1%CVSS 9.1

CVE-2026-102102 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway server-side request forgery

EPSS 0.8%CVSS 9.1

CVE-2026-102103 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway server-side request forgery

EPSS 0.7%CVSS 9.1

CVE-2026-102104 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway server-side request forgery

EPSS 0.7%CVSS 9.1

CVE-2026-102105 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway server-side request forgery

EPSS 0.5%CVSS 9.1

CVE-2026-102147 · Kiteworks Core

Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

EPSS 0.5%CVSS 9.3

CVE-2026-102095 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway server-side request forgery

EPSS 0.4%CVSS 9.1

CVE-2026-102149 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway Improper Access Control

EPSS 0.2%CVSS 9.4

ordasoft.com1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-102427 · ordasoft.com OrdaSoft Joomla CCK

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

EPSS 0.9%CVSS 10.0

Soft-Machine-io1 vulnerability on this pageMax CVSS 9.0Priority 41KEV 0

CVE-2026-55176 · Soft-Machine-io security

Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

EPSS 0.3%public exploit CVSS 9.0

ASUS1 vulnerability on this pageMax CVSS 9.4Priority 39KEV 0

CVE-2026-14157 · ASUS Router

Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands…

EPSS 0.8%CVSS 9.4

latepoint1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-92966 · latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

EPSS 0.7%CVSS 9.1

Python Software Foundation1 vulnerability on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2026-19445 · Python Software Foundation CPython

Use-after-free of a server-side SSLContext when sni_callback switches contexts

EPSS 0.5%CVSS 9.2

Hitachi Industrial Equipment Systems4 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-82824 · Hitachi Industrial Equipment Systems Hitachi Coding Software Suite

Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

EPSS 0.4%CVSS 9.8

CVE-2026-82825 · Hitachi Industrial Equipment Systems Hitachi Coding Software Suite

Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

EPSS 0.3%CVSS 9.8

CVE-2026-82829 · Hitachi Industrial Equipment Systems Hitachi Coding Software Suite

Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process

EPSS 0.3%CVSS 9.8

CVE-2026-82827 · Hitachi Industrial Equipment Systems Hitachi Coding Software Suite

A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

EPSS 0.3%CVSS 9.8

JetBrains3 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-100255 · JetBrains TeamCity

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

EPSS 0.4%CVSS 9.8

CVE-2026-100273 · JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

EPSS 0.3%CVSS 9.8

CVE-2026-100277 · JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

EPSS 0.3%CVSS 9.8

yii2-starter-kit1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-103475 · yii2-starter-kit yii2-starter-kit

yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

EPSS 0.4%CVSS 9.3

esnet2 vulnerabilities on this pageMax CVSS 9.2Priority 34KEV 0

CVE-2026-101276 · esnet iperf3

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() free…

EPSS 0.4%CVSS 9.2

CVE-2026-101283 · esnet iperf3

iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the a…

EPSS 0.4%CVSS 9.2

Hook & Filter1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-100512 · Hook & Filter Nested Pages

WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

OpenBSD1 vulnerability on this pageMax CVSS 9.2Priority 34KEV 0

CVE-2026-103547 · OpenBSD OpenBSD

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP…

EPSS 0.4%CVSS 9.2

Genians, Inc1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2026-76142 · Genians, Inc Genian NAC 5.0.75 LTS Release

Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

EPSS 0.3%CVSS 9.3

PTZOptics1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2026-75969 · PTZOptics Move 4K 12X

PTZOptics Missing Authentication in Firmware Upload

EPSS 0.4%CVSS 9.1

Meta Platforms, Inc1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-92173 · Meta Platforms, Inc Meta Horizon OS

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oc…

EPSS 0.3%CVSS 9.1

Internet21 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-103470 · Internet2 Grouper

In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escal…

EPSS 0.3%CVSS 9.3

The archive.