The archive.

CVE-2026-102149 · Kiteworks Email Protection Gateway

Kiteworks Email Protection Gateway Improper Access Control

EPSS 0.2%CVSS 9.4

ordasoft.com1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-102427 · ordasoft.com OrdaSoft Joomla CCK

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

EPSS 0.9%CVSS 10.0

SiteSkite1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2026-96349 · SiteSkite SiteSkite

WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

EPSS 0.7%CVSS 10.0

Soft-Machine-io1 vulnerability on this pageMax CVSS 9.0Priority 41KEV 0

CVE-2026-55176 · Soft-Machine-io security

Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

EPSS 0.3%public exploit CVSS 9.0

Apache Software Foundation6 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-88920 · Apache Software Foundation Apache WSS4J

Apache WSS4J: SAML Sender-Vouches Authentication Bypass

EPSS 0.6%CVSS 9.8

CVE-2026-77185 · Apache Software Foundation Apache MINA SSHD

Apache MINA SSHD: Asynchronous authentication can bypass signature verification

CVE-2026-89238 · Apache Software Foundation Apache WSS4J

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

EPSS 0.3%CVSS 9.1

CVE-2026-94052 · Apache Software Foundation Apache MINA SSHD

Apache MINA SSHD: LDAP password authentication ineffective

CVE-2026-94053 · Apache Software Foundation Apache MINA SSHD

Apache MINA SSHD: LDAP injection in sshd-ldap

CVE-2026-87830 · Apache Software Foundation Apache WSS4J

Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.

EPSS 0.2%CVSS 9.1

DigiWin2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-102455 · DigiWin EasyFlow .NET

DigiWin｜EasyFlow .NET - Insecure Deserialization

EPSS 0.5%CVSS 9.8

CVE-2026-102458 · DigiWin EasyFlow .NET

DigiWin｜EasyFlow .NET - Missing Authentication

joomcode.com1 vulnerability on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2026-76570 · joomcode.com JCTables extension for Joomla

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

EPSS 0.5%CVSS 10.0

Trex Digital Smart Manufacturing Systems Inc.1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-18782 · Trex Digital Smart Manufacturing Systems Inc. Trex MES

SQL Injection in Trex Digital Manufacturing's Trex MES

EPSS 0.5%CVSS 9.8

Estatik1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-96350 · Estatik Estatik

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Python Software Foundation1 vulnerability on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2026-19445 · Python Software Foundation CPython

Use-after-free of a server-side SSLContext when sni_callback switches contexts

EPSS 0.5%CVSS 9.2

Booking Activities Team1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-97248 · Booking Activities Team Booking Activities

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

AcyMailing Newsletter Team1 vulnerability on this pageMax CVSS 9.0Priority 35KEV 0

CVE-2026-94389 · AcyMailing Newsletter Team AcyMailing SMTP Newsletter

WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability

EPSS 0.4%CVSS 9.0

JetBrains3 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-100255 · JetBrains TeamCity

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

CVE-2026-100273 · JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

CVE-2026-100277 · JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

yii2-starter-kit1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-103475 · yii2-starter-kit yii2-starter-kit

yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

EPSS 0.4%CVSS 9.3

YunoHost-Apps2 vulnerabilities on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-74864 · YunoHost-Apps sogo_yhn

Authentication Bypass in sogo_yhn

EPSS 0.4%CVSS 9.3

CVE-2026-74865 · YunoHost-Apps sogo_yhn

Authentication Bypass in sogo_yhn

EPSS 0.4%CVSS 9.2

Hook & Filter1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-100512 · Hook & Filter Nested Pages

WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

miniOrange1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-97274 · miniOrange OAuth Single Sign On – SSO (OAuth Client)

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

OpenBSD1 vulnerability on this pageMax CVSS 9.2Priority 34KEV 0

CVE-2026-103547 · OpenBSD OpenBSD

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP…

EPSS 0.4%CVSS 9.2

Dolusoft Software Technologies1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2026-82307 · Dolusoft Software Technologies SOPLOG

Multiple Vulnerabilities in Dolusoft Software's SOPLOG

PTZOptics1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2026-75969 · PTZOptics Move 4K 12X

PTZOptics Missing Authentication in Firmware Upload