Critical vulnerability archive — page 58

rclone2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2026-88018 · rclone rclone

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-88044 · rclone rclone

rclone: RC per-server auth-proxy bypass

EPSS 0.5%public exploit CVSS 9.1

Dell4 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-81467 · Dell ThinOS 10

Dell ThinOS 10, versions prior to 2605_10.

EPSS 3%CVSS 9.8

CVE-2026-81048 · Dell ThinOS 10

Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Inject…

EPSS 2%CVSS 9.6

CVE-2026-81468 · Dell ThinOS 10

Dell ThinOS 10, versions prior to 2605_10.

EPSS 2%CVSS 9.1

CVE-2026-81046 · Dell ThinOS 10

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability.

EPSS 0.5%CVSS 9.4

WWBN4 vulnerabilities on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2026-88869 · WWBN AVideo

AVideo AD_Server Stored XSS via log.php label parameter

EPSS 0.5%public exploit CVSS 9.3

CVE-2026-88866 · WWBN AVideo

WWBN AVideo LoginControl Stored XSS via User-Agent Header

EPSS 0.4%public exploit CVSS 9.3

CVE-2026-88867 · WWBN AVideo

WWBN AVideo Stored XSS via Category Name and Icon Class

EPSS 0.4%public exploit CVSS 9.3

CVE-2026-88868 · WWBN AVideo

AVideo LiveLinks Stored XSS via title and description fields

EPSS 0.4%CVSS 9.3

angular1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2026-88056 · angular angular

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

EPSS 0.5%public exploit CVSS 9.1

Cap-go2 vulnerabilities on this pageMax CVSS 9.3Priority 44KEV 0

CVE-2026-88864 · Cap-go capgo.app

Capgo SSO Provider Authentication Bypass via PostgREST Direct Write

EPSS 0.4%public exploit CVSS 9.3

CVE-2026-88860 · Cap-go capgo.app

Capgo Authorization Bypass via Stale Channel Permission Overrides

EPSS 0.3%CVSS 9.3

WebPros4 vulnerabilities on this pageMax CVSS 9.9Priority 44KEV 0

CVE-2026-65638 · WebPros ConfigServer Security & Firewall

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary co…

EPSS 2%CVSS 9.2

CVE-2026-65639 · WebPros ConfigServer Security & Firewall

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured a…

EPSS 1%CVSS 9.5

CVE-2026-68487 · WebPros Plesk

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

EPSS 0.6%CVSS 9.9

CVE-2026-68488 · WebPros Plesk

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to r…

EPSS 0.4%CVSS 9.9

diegosouzapw1 vulnerability on this pageMax CVSS 9.5Priority 43KEV 0

CVE-2026-88062 · diegosouzapw OmniRoute

OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

EPSS 1%CVSS 9.5

Apache Software Foundation3 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-80351 · Apache Software Foundation Apache Camel K

Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

EPSS 1%CVSS 9.8

CVE-2026-80352 · Apache Software Foundation Apache Camel K

Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

EPSS 0.8%CVSS 9.8

CVE-2026-84939 · Apache Software Foundation Apache FreeMarker

Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks

EPSS 0.9%CVSS 9.1

krakenjs2 vulnerabilities on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2026-89043 · krakenjs passport-saml-encrypted

passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

EPSS 0.3%public exploit CVSS 9.1

CVE-2026-89042 · krakenjs passport-saml-encrypted

passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

EPSS 0.4%CVSS 9.3

Forgejo1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-89094 · Forgejo Forgejo

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/temp…

EPSS 0.9%CVSS 9.9

knowns-dev1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-88899 · knowns-dev knowns

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

EPSS 0.8%CVSS 9.8

OCaml1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2026-89086 · OCaml jose

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and…

EPSS 0.3%public exploit CVSS 9.1

AWS1 vulnerability on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-89049 · AWS Amazon SSM Agent

Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

EPSS 0.7%CVSS 9.9

traefik3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-88877 · traefik traefik

Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

EPSS 0.6%CVSS 9.8

CVE-2026-88007 · traefik traefik

Traefik HTTP/3 Backend NTLM Connection Reuse

EPSS 0.6%CVSS 9.1

CVE-2026-88008 · traefik traefik

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

EPSS 0.5%CVSS 9.1

IBM2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-85025 · IBM Langflow OSS

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

EPSS 0.6%CVSS 9.8

CVE-2026-82107 · IBM DataStage on Cloud Pak for Data

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

EPSS 0.5%CVSS 9.6

Armiya Information Technologies Ltd. Co.2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-7188 · Armiya Information Technologies Ltd. Co. Access Control System

SQLi in Armiya Information Technologies' Access Control System

EPSS 0.5%CVSS 9.8

CVE-2026-8323 · Armiya Information Technologies Ltd. Co. Access Control System

Open Redirect in Armiya Information Technologies' Access Control System

EPSS 0.4%CVSS 9.3

GeoVision Inc.2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-88278 · GeoVision Inc. GV-LPCLPC2011/2211

GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay

EPSS 0.5%CVSS 9.8

CVE-2026-88285 · GeoVision Inc. GV-LPC2011/LPC2211

GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service

EPSS 0.5%CVSS 9.4

GIS Informatics1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-9163 · GIS Informatics GisLab Laboratory Management System

SQLi in GIS Informatics' GisLab Laboratory Management System

EPSS 0.5%CVSS 9.8

Unknown2 vulnerabilities on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2026-77770 · Unknown miniOrange 2FA

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

EPSS 0.4%CVSS 10.0

CVE-2026-78361 · Unknown zipMoney(Zip Co) Payments Plugin for WooCommerce

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

EPSS 0.5%CVSS 9.1

joomshaper.com1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-78082 · joomshaper.com SP Property extension for Joomla

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4

EPSS 0.5%CVSS 9.3

OISF1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-45764 · OISF suricata

Suricata http2: protocol-change type confusion can lead to denial of service

EPSS 0.6%CVSS 9.1

Amazon1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2026-85228 · Amazon Deep Java Library

Integer overflow in tensor buffer validation in Deep Java Library

EPSS 0.5%CVSS 9.1

renovatebot4 vulnerabilities on this pageMax CVSS 9.2Priority 36KEV 0

CVE-2026-88880 · renovatebot renovate

Renovate before 44.11.3 Credential Exfiltration via Link Header

EPSS 0.5%CVSS 9.2

CVE-2026-88881 · renovatebot renovate

Renovate before 44.11.3 Credential Exfiltration via Link Header

EPSS 0.4%CVSS 9.2

CVE-2026-88882 · renovatebot renovate

Renovate before 44.11.2 Credential Exfiltration via Link Header

EPSS 0.4%CVSS 9.2

CVE-2026-88887 · renovatebot renovate

Renovate before 44.11.2 Credential Exfiltration via Link Header

EPSS 0.4%CVSS 9.2

Lenovo1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-75940 · Lenovo Health Application

A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an att…

EPSS 0.4%CVSS 9.3

Par avisverifies1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-81800 · Par avisverifies Verified Reviews (Avis Vérifiés)

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

SUSE2 vulnerabilities on this pageMax CVSS 9.5Priority 32KEV 0

CVE-2026-44950 · SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.8

fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

EPSS 0.3%CVSS 9.5

CVE-2026-59679 · SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.8

fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

EPSS 0.3%CVSS 9.2

The archive.