Critical vulnerability archive — page 54

Cisco5 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2026-76461 · Cisco Cisco Secure Email

Cisco Secure Email Gateway SQL Injection Vulnerability

KEV · due 17 Sep EPSS 30%public exploit SSVC act CVSS 9.8

CVE-2026-76443 · Cisco Cisco Secure Email

Cisco Secure Email Gateway Security Hardening Release

EPSS 2%CVSS 9.8

CVE-2026-76440 · Cisco Cisco Secure Email

Cisco Secure Email Gateway Security Hardening Release

EPSS 0.6%CVSS 9.8

CVE-2026-20353 · Cisco Cisco Secure Email

Cisco Secure Email Gateway Security Hardening Release

EPSS 0.5%CVSS 9.8

CVE-2026-76441 · Cisco Cisco Secure Email and Web Manager

Cisco Secure Email Gateway Security Hardening Release

EPSS 0.5%CVSS 9.8

D-Link5 vulnerabilities on this pageMax CVSS 9.9Priority 57KEV 0

ModelTC1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2026-90919 · ModelTC LightLLM

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization

EPSS 1%public exploit CVSS 9.8

MervinPraison6 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2026-57124 · MervinPraison PraisonAI

PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

EPSS 1%public exploit CVSS 9.8

CVE-2026-57131 · MervinPraison PraisonAI

praisonai: Jobs API exposes agent-execution endpoints with no authentication

EPSS 1.0%public exploit CVSS 9.8

CVE-2026-57127 · MervinPraison PraisonAI

praisonai: recipe serve auth middleware silently disables itself when no secret is set

EPSS 0.9%public exploit CVSS 9.8

CVE-2026-57125 · MervinPraison PraisonAI

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-57123 · MervinPraison praisonaiagents

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

EPSS 0.9%CVSS 9.8

CVE-2026-57145 · MervinPraison PraisonAI

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

EPSS 0.5%CVSS 9.1

crawlab-team1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-90945 · crawlab-team crawlab

Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

EPSS 0.8%public exploit CVSS 9.8

confetti1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2026-61534 · confetti yayson

Yayson: Prototype pollution in the Store/LegacyStore deserialization

EPSS 0.8%public exploit CVSS 9.1

maximhq1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-90898 · maximhq Bifrost

Bifrost unauthenticated remote code execution via MCP stdio client registration

EPSS 2%CVSS 9.8

casdoor1 vulnerability on this pageMax CVSS 9.6Priority 43KEV 0

CVE-2026-90942 · casdoor casdoor

Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

EPSS 0.3%public exploit CVSS 9.6

equinor1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-55209 · equinor resdata

resdata insufficiently validates untrusted GRDECL files

EPSS 0.8%CVSS 9.8

esphome1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-59178 · esphome device-builder

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

EPSS 0.8%CVSS 9.8

Apache Software Foundation17 vulnerabilities on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-78330 · Apache Software Foundation Apache Syncope

Apache Syncope: Privilege escalation for admin user via JWT authentication

EPSS 0.6%CVSS 9.8

CVE-2026-82435 · Apache Software Foundation Apache Storm Worker

Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

EPSS 0.7%CVSS 9.8

CVE-2026-75030 · Apache Software Foundation Apache Syncope

Apache Syncope: Incomplete authorization checks for Group members deprovisioning

EPSS 0.6%CVSS 9.8

CVE-2026-77051 · Apache Software Foundation Apache Syncope

Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

EPSS 0.6%CVSS 9.8

CVE-2026-82232 · Apache Software Foundation Apache Syncope

Apache Syncope: SQL injection via sort parameter in Task search

EPSS 0.6%CVSS 9.8

CVE-2026-82434 · Apache Software Foundation Apache Storm Nimbus

Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

EPSS 0.5%CVSS 10.0

CVE-2026-86460 · Apache Software Foundation Apache Syncope

Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

EPSS 0.6%CVSS 9.8

CVE-2026-73370 · Apache Software Foundation Apache Syncope

Apache Syncope: Cross-Realm boundaries reconciliation bypass

EPSS 0.5%CVSS 9.8

CVE-2026-73470 · Apache Software Foundation Apache Syncope

Apache Syncope: Delegating users can grant unowned Roles

EPSS 0.5%CVSS 9.8

CVE-2026-73579 · Apache Software Foundation Apache Syncope

Apache Syncope: Non-recursive Any search could skip Realms restrictions

EPSS 0.5%CVSS 9.8

CVE-2026-73668 · Apache Software Foundation Apache Syncope

Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

EPSS 0.5%CVSS 9.8

CVE-2026-77181 · Apache Software Foundation Apache Syncope

Apache Syncope: ClientApp update entitlement not effective

EPSS 0.5%CVSS 9.8

CVE-2026-87785 · Apache Software Foundation Apache Syncope

Apache Syncope: JWT subject spoofing

EPSS 0.5%CVSS 9.1

CVE-2026-82431 · Apache Software Foundation Apache Storm Client

Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

EPSS 0.4%CVSS 9.8

CVE-2026-82439 · Apache Software Foundation Apache Storm DRPC

Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC

EPSS 0.3%CVSS 9.8

CVE-2026-82441 · Apache Software Foundation Apache Storm Nimbus

Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

EPSS 0.3%CVSS 9.1

CVE-2026-87802 · Apache Software Foundation Apache Syncope

Apache Syncope: SRA OAuth2 JWT signature verification bypass

EPSS 0.3%CVSS 9.1

froxlor1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-90937 · froxlor froxlor

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

EPSS 0.5%CVSS 9.9

Hiperdino1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-12258 · Hiperdino REST API

Inadequate access control in the Hiperdino REST API

EPSS 0.7%CVSS 9.2

MISP1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2026-90961 · MISP MISP

MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials

EPSS 0.6%CVSS 9.3

Ping Identity1 vulnerability on this pageMax CVSS 9.5Priority 38KEV 0

CVE-2026-21391 · Ping Identity PingAM

Improper Claim Validation in PingAM OIDC Provider

EPSS 0.6%CVSS 9.5

riganti1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-57578 · riganti dotvvm

DotVVM: Missing authorization in AuthorizeActionFilter

EPSS 0.6%CVSS 9.2

IBM1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-16338 · IBM DataStage on Cloud Pak for Data

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

EPSS 0.4%CVSS 9.9

Eclipse Foundation1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-78299 · Eclipse Foundation Eclipse Embedded CDT (C/C++ Development Tools)

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extrac…

EPSS 0.5%CVSS 9.1

Concrete CMS1 vulnerability on this pageMax CVSS 9.0Priority 35KEV 0

CVE-2026-18119 · Concrete CMS Concrete CMS

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values

EPSS 0.5%CVSS 9.0

parallax1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-90943 · parallax filament-comments

parallax filament-comments through 3.0.0 Stored XSS via Comment Body

EPSS 0.4%CVSS 9.3

Mattermost1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-12985 · Mattermost Mattermost

Mattermost DCR redirect URI allowlist bypass via improper URL component validation

EPSS 0.3%CVSS 9.3

The archive.