Critical vulnerability archive — page 48

Ruijie2 vulnerabilities on this pageMax CVSS 9.4Priority 56KEV 0

CVE-2026-92397 · Ruijie RG-EW3000GX

Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection

EPSS 3%public exploit CVSS 9.4

CVE-2026-92398 · Ruijie RG-EW3000GX

Ruijie RG-EW3000GX user_list_note admin os command injection

EPSS 3%public exploit CVSS 9.4

InternLM1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2025-59953 · InternLM lmdeploy

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

EPSS 0.9%public exploit CVSS 9.8

WNC3 vulnerabilities on this pageMax CVSS 9.4Priority 46KEV 0

CVE-2026-58146 · WNC T-Mobile 5G Box IDU

Unauthorized remote code execution in T-Mobile 5G Box IDU routers

EPSS 3%CVSS 9.4

CVE-2026-40855 · WNC T-Mobile 5G Box IDU

Command Injection in T-Mobile 5G Box IDU router via ping functionality

EPSS 2%CVSS 9.3

CVE-2026-58147 · WNC T-Mobile 5G Box IDU

Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers

EPSS 2%CVSS 9.3

Advantech1 vulnerability on this pageMax CVSS 9.3Priority 44KEV 0

CVE-2026-73172 · Advantech EKI-1242IEIMS

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vuln…

EPSS 2%CVSS 9.3

Apache Software Foundation4 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-76187 · Apache Software Foundation Apache Airflow Keycloak provider

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

EPSS 1.0%CVSS 9.8

CVE-2026-82311 · Apache Software Foundation Apache Airflow FAB provider

Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

EPSS 1.0%CVSS 9.8

CVE-2026-76186 · Apache Software Foundation Apache Airflow Keycloak provider

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

EPSS 0.8%CVSS 9.1

CVE-2026-86462 · Apache Software Foundation Apache Airflow FAB provider

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

EPSS 0.8%CVSS 9.1

Cisco4 vulnerabilities on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2026-20305 · Cisco Cisco Identity Services Engine Software

Cisco Identity Services Engine Command Injection Vulnerability

EPSS 2%CVSS 9.1

CVE-2026-20306 · Cisco Cisco Identity Services Engine Software

Cisco Identity Services Engine Command Injection Vulnerability

EPSS 2%CVSS 9.1

CVE-2026-20307 · Cisco Cisco Identity Services Engine Software

Cisco Identity Services Engine Remote Code Execution Vulnerability

EPSS 1.0%CVSS 9.9

CVE-2026-76420 · Cisco Cisco Secure Firewall Management Center (FMC)

Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability

EPSS 0.4%CVSS 9.0

Dell2 vulnerabilities on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-70416 · Dell ObjectScale

Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability.

EPSS 0.8%CVSS 10.0

CVE-2025-43936 · Dell ObjectScale

Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability.

EPSS 0.5%CVSS 9.1

Arista Networks2 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2026-73453 · Arista Networks EOS

Security Advisory 0174

EPSS 0.7%CVSS 10.0

CVE-2026-86106 · Arista Networks VeloCloud Edge

Security Advisory 0179

EPSS 0.4%CVSS 9.6

Linux24 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-89970 · Linux Linux

nvmet-auth: Synchronize timeout work during SQ teardown

EPSS 0.8%CVSS 9.8

CVE-2026-89783 · Linux Linux

xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

EPSS 0.7%CVSS 9.8

CVE-2026-89788 · Linux Linux

ksmbd: fix tree connection use-after-free in smb2_tree_connect()

EPSS 0.7%CVSS 9.8

CVE-2026-89847 · Linux Linux

scsi: qla2xxx: Avoid double completion in async IOCB timeout

EPSS 0.7%CVSS 9.8

CVE-2026-89969 · Linux Linux

nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

EPSS 0.7%CVSS 9.8

CVE-2026-89972 · Linux Linux

nvme: add missing SRCU grace period in error path

EPSS 0.7%CVSS 9.8

CVE-2026-90048 · Linux Linux

fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

EPSS 0.7%CVSS 9.8

CVE-2026-89857 · Linux Linux

scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject

EPSS 0.6%CVSS 9.8

CVE-2026-89990 · Linux Linux

ceph: lock mutex in ceph_mds_check_access()

EPSS 0.6%CVSS 9.8

CVE-2026-90011 · Linux Linux

scsi: target: iscsi: Reserve a terminator byte for the login payload

EPSS 0.8%CVSS 9.1

CVE-2026-90012 · Linux Linux

spi: Fix DMA mapping ownership on partial map failure

EPSS 0.6%CVSS 9.8

CVE-2026-90038 · Linux Linux

NFSD: Prevent client use-after-free during export state revocation

EPSS 0.6%CVSS 9.8

CVE-2026-89779 · Linux Linux

fs/ntfs3: validate ef->size covers the record's name and value

EPSS 0.7%CVSS 9.1

CVE-2026-89786 · Linux Linux

ext4: fix out-of-bounds read in ext4_read_inline_dir()

EPSS 0.7%CVSS 9.1

CVE-2026-89846 · Linux Linux

scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

EPSS 0.7%CVSS 9.1

CVE-2026-90036 · Linux Linux

NFSD: Prevent client use-after-free during blocked-lock reaping

EPSS 0.5%CVSS 9.8

CVE-2026-90037 · Linux Linux

NFSD: Prevent client use-after-free during close_lru reaping

EPSS 0.5%CVSS 9.8

CVE-2026-90042 · Linux Linux

ceph: properly decrypt filenames in vmalloc() buffers

EPSS 0.5%CVSS 9.8

CVE-2026-89914 · Linux Linux

KVM: arm64: Sign-extend VA for range-based TLBI invalidation

EPSS 0.2%CVSS 9.3

CVE-2026-89915 · Linux Linux

KVM: arm64: Remove VM-wide VNCR mapping counter

EPSS 0.2%CVSS 9.3

CVE-2026-89916 · Linux Linux

KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry

EPSS 0.2%CVSS 9.3

CVE-2026-89918 · Linux Linux

KVM: arm64: Correctly handle end of VA space TLBI invalidation

EPSS 0.2%CVSS 9.3

CVE-2026-89930 · Linux Linux

KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

EPSS 0.2%CVSS 9.3

CVE-2026-90049 · Linux Linux

net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

EPSS 0.2%CVSS 9.3

Functional Software, Inc.1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-90999 · Functional Software, Inc. Sentry Seer

Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

EPSS 0.7%CVSS 9.8

checkpoint1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-91843 · checkpoint Quantum Security Management

Stack overflow in login process to the Security Management and Log Servers

EPSS 0.5%CVSS 9.8

Concrete CMS1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2026-85385 · Concrete CMS Concrete CMS

Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field

EPSS 0.5%CVSS 9.6

rabbitmq3 vulnerabilities on this pageMax CVSS 9.5Priority 37KEV 0

CVE-2026-77411 · rabbitmq amqp091-go

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

EPSS 0.5%CVSS 9.5

CVE-2026-77408 · rabbitmq amqp091-go

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

EPSS 0.5%CVSS 9.1

CVE-2026-77405 · rabbitmq amqp091-go

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

EPSS 0.3%CVSS 9.4

@fastify/proxy-addr1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2026-92395 · @fastify/proxy-addr @fastify/proxy-addr

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

EPSS 0.3%CVSS 9.1

The archive.