Critical vulnerability archive — page 46

patriksimek19 vulnerabilities on this pageMax CVSS 10.0Priority 53KEV 0

CVE-2026-92937 · patriksimek vm2

vm2 3.11.6 Remote Code Execution via Promise call/apply

EPSS 1%public exploit CVSS 10.0

CVE-2026-92944 · patriksimek vm2

vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-92955 · patriksimek vm2

vm2 before 3.11.8 Sandbox Escape via NodeVM

EPSS 0.7%public exploit CVSS 10.0

CVE-2026-92934 · patriksimek vm2

vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

EPSS 0.8%public exploit CVSS 9.5

CVE-2026-92938 · patriksimek vm2

vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

EPSS 0.6%public exploit CVSS 9.9

CVE-2026-92939 · patriksimek vm2

vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

EPSS 0.6%public exploit CVSS 9.9

CVE-2026-92948 · patriksimek vm2

vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test

EPSS 0.7%public exploit CVSS 9.9

CVE-2026-92953 · patriksimek vm2

vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

EPSS 0.5%public exploit CVSS 10.0

CVE-2026-92957 · patriksimek vm2

vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

EPSS 0.5%public exploit CVSS 9.9

CVE-2026-92947 · patriksimek vm2

vm2 before 3.11.7 Memory Disclosure via Buffer Pool

EPSS 0.5%public exploit CVSS 10.0

CVE-2026-92960 · patriksimek vm2

vm2 before 3.11.6 Process-wide State Exposure via os and dns

EPSS 0.5%public exploit CVSS 10.0

CVE-2026-92954 · patriksimek vm2

vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise

EPSS 0.5%public exploit CVSS 9.2

CVE-2026-92941 · patriksimek vm2

vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

EPSS 0.3%public exploit CVSS 10.0

CVE-2026-92946 · patriksimek vm2

vm2 before 3.11.7 Remote Code Execution via require.external

EPSS 0.8%CVSS 10.0

CVE-2026-92950 · patriksimek vm2

vm2 before 3.11.7 Sandbox Escape via CLI require

EPSS 0.2%public exploit CVSS 9.3

CVE-2026-92935 · patriksimek vm2

vm2 NodeVM Remote Code Execution via Array-Shaped Require

EPSS 0.6%CVSS 9.5

CVE-2026-92956 · patriksimek vm2

vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

EPSS 0.5%CVSS 10.0

CVE-2026-92951 · patriksimek vm2

vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

EPSS 0.5%CVSS 9.9

CVE-2026-92940 · patriksimek vm2

vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent

EPSS 0.4%CVSS 10.0

rcourtman1 vulnerability on this pageMax CVSS 9.4Priority 50KEV 0

CVE-2026-92860 · rcourtman Pulse

rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation

EPSS 0.9%public exploit CVSS 9.4

vendurehq1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2026-63472 · vendurehq vendure

Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

EPSS 0.6%public exploit CVSS 9.1

WWBN1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-92913 · WWBN AVideo

AVideo Weak PRNG Activation Code Authentication Bypass

EPSS 0.5%public exploit CVSS 9.1

FatPipe Networks2 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2026-90822 · FatPipe Networks MPVPN

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerab…

EPSS 1%CVSS 9.8

CVE-2026-90823 · FatPipe Networks MPVPN

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in…

EPSS 0.7%CVSS 9.8

Dell4 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-81476 · Dell OpenManage Server Administrator Managed Node (Patch) for Windows

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS C…

EPSS 0.9%CVSS 9.8

CVE-2026-81475 · Dell OpenManage Server Administrator Managed Node (Patch) for Windows

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability.

EPSS 0.5%CVSS 9.8

CVE-2026-81478 · Dell OpenManage Server Administrator Managed Node (Patch) for Windows

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability.

EPSS 0.3%CVSS 9.8

CVE-2026-81440 · Dell OpenManage Server Administrator Managed Node (Patch) for Windows

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability.

EPSS 0.2%CVSS 9.8

superweby1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-62104 · superweby Migratico Lite

WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability

EPSS 0.9%CVSS 10.0

Linux7 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-90104 · Linux Linux

NFSv4.1: zero referring call lists before decoding

EPSS 0.7%CVSS 9.8

CVE-2026-90151 · Linux Linux

NFSv4: remove callback IDR entry on client allocation failure

EPSS 0.7%CVSS 9.8

CVE-2026-90235 · Linux Linux

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

EPSS 0.7%CVSS 9.8

CVE-2026-90173 · Linux Linux

smb: smbdirect: free completion queues with ib_free_cq()

EPSS 0.6%CVSS 9.8

CVE-2026-90413 · Linux Linux

IB/isert: reject login PDUs declaring more data than was received

EPSS 0.8%CVSS 9.1

CVE-2026-90110 · Linux Linux

inetpeer: randomize RB-tree node comparison using SipHash

EPSS 0.6%CVSS 9.4

CVE-2026-90230 · Linux Linux

nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

EPSS 0.5%CVSS 9.1

b2evolution1 vulnerability on this pageMax CVSS 9.2Priority 39KEV 0

CVE-2026-76834 · b2evolution b2evolution CMS

b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key

EPSS 0.8%CVSS 9.2

Chris Åkerfeldt Wendel1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-62101 · Chris Åkerfeldt Wendel EduAdmin Booking

WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability

EPSS 0.6%CVSS 9.8

miniOrange1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-62108 · miniOrange Headless Single Sign On

WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

EPSS 0.6%CVSS 9.8

pgadmin.org1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-86863 · pgadmin.org pgAdmin 4

pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

EPSS 0.6%CVSS 9.8

team-alembic5 vulnerabilities on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-86533 · team-alembic ash_authentication

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

EPSS 0.9%CVSS 9.1

CVE-2026-85500 · team-alembic ash_authentication

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

EPSS 0.8%CVSS 9.1

CVE-2026-88952 · team-alembic ash_authentication

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

EPSS 0.7%CVSS 9.1

CVE-2026-91039 · team-alembic ash_authentication

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

EPSS 0.7%CVSS 9.1

CVE-2026-82761 · team-alembic ash_authentication

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

EPSS 0.6%CVSS 9.1

Unknown3 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-86709 · Unknown The Pressengine

The Pressengine <= 1.0 - Unauthenticated Authentication Bypass

EPSS 0.6%CVSS 9.8

CVE-2026-86710 · Unknown Login with QR

Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

EPSS 0.5%CVSS 9.8

CVE-2026-88795 · Unknown wpShopGermany IT-RECHT KANZLEI

wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

EPSS 0.8%CVSS 9.0

cakephp1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-79752 · cakephp cakephp

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

EPSS 0.6%CVSS 9.2

Mitsubishi Electric Corporation1 vulnerability on this pageMax CVSS 9.2Priority 29KEV 0

CVE-2026-15688 · Mitsubishi Electric Corporation GX Works3

Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting

EPSS 0.2%CVSS 9.2

The archive.