Critical vulnerability archive — page 53

EFM1 vulnerability on this pageMax CVSS 9.4Priority 56KEV 0

CVE-2026-90847 · EFM ipTIME C200E

EFM ipTIME C200E System Setup iux_set.cgi os command injection

EPSS 3%public exploit CVSS 9.4

D-Link2 vulnerabilities on this pageMax CVSS 9.9Priority 52KEV 0

CVE-2026-91001 · D-Link DI-8400

D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow

EPSS 0.9%public exploit CVSS 9.9

CVE-2026-91003 · D-Link DI-8300

D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow

EPSS 1.0%public exploit CVSS 9.4

MervinPraison6 vulnerabilities on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2026-57138 · MervinPraison PraisonAI

PraisonAI codeMode sandbox escape via Function constructor

EPSS 0.7%public exploit CVSS 9.9

CVE-2026-57147 · MervinPraison PraisonAI

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-57139 · MervinPraison PraisonAI

PraisonAI MCPServer exposes unauthenticated HTTP tools/call

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-57148 · MervinPraison PraisonAI

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-57141 · MervinPraison PraisonAI

PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

EPSS 0.7%CVSS 9.8

CVE-2026-57140 · MervinPraison PraisonAI

PraisonAI AgentOS exposes unauthenticated agent listing and invocation

EPSS 0.6%CVSS 9.4

julien0401 vulnerability on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2026-50006 · julien040 anyquery

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

EPSS 1.0%public exploit CVSS 9.1

casdoor1 vulnerability on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2026-91998 · casdoor casdoor

Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp

EPSS 0.6%public exploit CVSS 9.9

mitre3 vulnerabilities on this pageMax CVSS 9.9Priority 48KEV 0

CVE-2026-37152 · mitre

TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-79303 · mitre

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection.

EPSS 0.4%public exploit CVSS 9.9

CVE-2026-88617 · mitre

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint.

EPSS 0.6%CVSS 9.8

TREXOM1 vulnerability on this pageMax CVSS 9.3Priority 44KEV 0

CVE-2026-89308 · TREXOM TrxTimeATTENDANCE

Arbitrary command execution in TrxTimeATTENDANCE

EPSS 2%CVSS 9.3

Apple8 vulnerabilities on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2026-65414 · Apple iOS and iPadOS

An out-of-bounds write issue was addressed with improved bounds checking.

EPSS 1%CVSS 9.8

CVE-2026-84561 · Apple iOS and iPadOS

A double free issue was addressed with improved memory management.

EPSS 0.7%CVSS 9.8

CVE-2026-84609 · Apple iOS and iPadOS

A permissions issue was addressed with improved path validation.

EPSS 0.7%CVSS 9.8

CVE-2026-43790 · Apple macOS

The issue was addressed with improved memory handling.

EPSS 0.7%CVSS 9.1

CVE-2026-84520 · Apple macOS

A buffer overflow was addressed with improved size validation.

EPSS 0.4%CVSS 9.8

CVE-2026-65381 · Apple macOS

A validation issue existed in the entitlement verification.

EPSS 0.3%CVSS 10.0

CVE-2026-84625 · Apple iOS and iPadOS

A permissions issue was addressed with additional sandbox restrictions.

EPSS 0.5%CVSS 9.1

CVE-2026-86881 · Apple iOS and iPadOS

A certificate validation issue was addressed with improved certificate validation.

EPSS 0.4%CVSS 9.1

kimai1 vulnerability on this pageMax CVSS 9.1Priority 42KEV 0

CVE-2026-52824 · kimai kimai

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

EPSS 1%CVSS 9.1

OpenIdentityPlatform6 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-62379 · OpenIdentityPlatform OpenAM

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

EPSS 1%CVSS 9.8

CVE-2026-46619 · OpenIdentityPlatform OpenAM

OpenAM Authentication Bypass via MSISDN LDAP Injection

EPSS 1.0%CVSS 9.3

CVE-2026-45052 · OpenIdentityPlatform OpenAM

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

EPSS 0.8%CVSS 9.3

CVE-2026-62263 · OpenIdentityPlatform OpenAM

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

EPSS 0.9%CVSS 9.2

CVE-2026-45051 · OpenIdentityPlatform OpenAM

OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

EPSS 0.7%CVSS 9.2

CVE-2026-48717 · OpenIdentityPlatform OpenAM

OpenAM OAuth Authorization Bypass via PKCE Challenge

EPSS 0.5%CVSS 9.1

theopolis2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-54333 · theopolis uefi-firmware-parser

UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

EPSS 0.8%CVSS 9.8

CVE-2026-54334 · theopolis uefi-firmware-parser

UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

EPSS 0.8%CVSS 9.8

pig-mesh1 vulnerability on this pageMax CVSS 9.3Priority 40KEV 0

CVE-2026-91995 · pig-mesh pig

pig before 4.1.0 Unverified Password Change via /register/password

EPSS 0.9%CVSS 9.3

Mozilla13 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-92036 · Mozilla Firefox

Incorrect boundary conditions in the Networking: HTTP component

EPSS 0.6%CVSS 9.8

CVE-2026-92037 · Mozilla Firefox

Incorrect boundary conditions in the DOM: Animation component

EPSS 0.6%CVSS 9.8

CVE-2026-92051 · Mozilla Firefox

Spoofing issue due to invalid pointer in the Graphics component

EPSS 0.5%CVSS 9.1

CVE-2026-92018 · Mozilla Firefox

Sandbox escape in the DOM: Core & HTML component

EPSS 0.3%CVSS 9.6

CVE-2026-92032 · Mozilla Firefox

Sandbox escape due to invalid pointer in the Graphics component

EPSS 0.3%CVSS 9.6

CVE-2026-92035 · Mozilla Firefox

Sandbox escape due to incorrect boundary conditions in the Graphics component

EPSS 0.3%CVSS 9.6

CVE-2026-92050 · Mozilla Firefox

Sandbox escape due to race condition in the XPConnect component

EPSS 0.4%CVSS 9.1

CVE-2026-92045 · Mozilla Firefox

Sandbox escape due to incorrect boundary conditions in the WebRTC component

EPSS 0.3%CVSS 9.6

CVE-2026-92038 · Mozilla Firefox

Mitigation bypass in the Remote Settings Client component

EPSS 0.3%CVSS 9.1

CVE-2026-92041 · Mozilla Firefox

Mitigation bypass in the DOM: Networking component

EPSS 0.3%CVSS 9.1

CVE-2026-92034 · Mozilla Firefox

Site isolation issue in the Graphics component

EPSS 0.3%CVSS 9.1

CVE-2026-92048 · Mozilla Firefox

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

EPSS 0.3%CVSS 9.0

CVE-2026-92057 · Mozilla Firefox

Mitigation bypass in the Enterprise Policies component

EPSS 0.3%CVSS 9.1

WebPros1 vulnerability on this pageMax CVSS 9.3Priority 39KEV 0

CVE-2026-67399 · WebPros WHMCS

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

EPSS 0.8%CVSS 9.3

envoyproxy1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-53713 · envoyproxy gateway

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

EPSS 0.4%CVSS 9.1

IBM1 vulnerability on this pageMax CVSS 9.6Priority 35KEV 0

CVE-2026-12944 · IBM Langflow OSS

Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

EPSS 0.4%CVSS 9.6

proxy-addr1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2026-90711 · proxy-addr proxy-addr

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

EPSS 0.3%CVSS 9.1

The archive.