Critical vulnerability archive — page 67

D-Link3 vulnerabilities on this pageMax CVSS 9.9Priority 57KEV 0

CVE-2026-85223 · D-Link DNS-340L

D-Link DNS-340L CGI dropbox.cgi os command injection

EPSS 3%public exploit CVSS 9.9

CVE-2026-85222 · D-Link DNS-340L

D-Link DNS-340L Add-On Center addon_center.cgi os command injection

EPSS 4%public exploit CVSS 9.4

CVE-2026-85224 · D-Link DNS-320 ShareCenter

D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

EPSS 4%public exploit CVSS 9.4

Tenda1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2026-85109 · Tenda HG10

Tenda HG10 Boa Web Server formLogin buffer overflow

EPSS 1%public exploit CVSS 9.8

SciPhi-AI1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-82526 · SciPhi-AI R2R

R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint

EPSS 0.7%public exploit CVSS 9.8

WWBN1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-85154 · WWBN AVideo

WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

EPSS 0.6%public exploit CVSS 9.8

Unknown3 vulnerabilities on this pageMax CVSS 10.0Priority 48KEV 0

CVE-2025-9314 · Unknown Developer Tools

Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-4357 · Unknown Embed HTML5 Game

Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload

EPSS 0.5%CVSS 10.0

CVE-2026-77009 · Unknown WatchMan-Site7

WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

EPSS 0.5%CVSS 9.9

vbpf2 vulnerabilities on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2026-53670 · vbpf prevail

PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

EPSS 0.5%public exploit CVSS 9.3

CVE-2026-53671 · vbpf prevail

PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification

EPSS 0.5%public exploit CVSS 9.3

AS2030381 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-53611 · AS203038 looking-glass

Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

EPSS 2%CVSS 9.8

moos-ivp2 vulnerabilities on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-85425 · moos-ivp moos-ivp

MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS

EPSS 2%CVSS 9.8

CVE-2026-85426 · moos-ivp moos-ivp

MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names

EPSS 0.9%CVSS 9.8

Red Hat1 vulnerability on this pageMax CVSS 9.1Priority 42KEV 0

CVE-2026-66786 · Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets

EPSS 1%CVSS 9.1

Avaiga1 vulnerability on this pageMax CVSS 9.3Priority 41KEV 0

CVE-2026-85183 · Avaiga taipy

Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

EPSS 0.2%public exploit CVSS 9.3

Cisco3 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-20212 · Cisco Cisco NX-OS Software

Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability

EPSS 0.8%CVSS 9.8

CVE-2026-20274 · Cisco Cisco IOS XR Software

Cisco IOS XR Software Security Hardening Release: September 2026

EPSS 0.5%CVSS 9.8

CVE-2026-20279 · Cisco Cisco IOS XR Software

Cisco IOS XR Software Security Hardening Release: September 2026

EPSS 0.5%CVSS 9.8

geonetwork1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2026-58400 · geonetwork core-geonetwork

GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

EPSS 1%CVSS 9.1

misp2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-85216 · misp misp

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

EPSS 0.9%CVSS 9.8

CVE-2026-85221 · misp misp

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

EPSS 0.3%CVSS 9.1

themoos3 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-85424 · themoos core-moos

MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR

EPSS 0.8%CVSS 9.8

CVE-2026-85428 · themoos core-moos

MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write

EPSS 0.8%CVSS 9.8

CVE-2026-85427 · themoos essential-moos

MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE

EPSS 0.6%CVSS 9.8

TOTOLINK1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-85031 · TOTOLINK CP450

TOTOLINK CP450 cstecgi.cgi buffer overflow

EPSS 0.8%CVSS 9.9

dianping1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-85181 · dianping cat

CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

EPSS 0.7%CVSS 9.8

Peppermint-Lab1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-85391 · Peppermint-Lab peppermint

Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml

EPSS 0.6%CVSS 9.8

eyecix1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-84834 · eyecix JobSearch

WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

F51 vulnerability on this pageMax CVSS 9.2Priority 39KEV 0

CVE-2026-78689 · F5 NGINX JavaScript

NGINX ngx_http_js_module vulnerablility

EPSS 0.8%CVSS 9.2

maplibre1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-85061 · maplibre maplibre-gl-js

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

EPSS 0.5%CVSS 10.0

n8n-io1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2026-85165 · n8n-io n8n

n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

EPSS 0.6%CVSS 9.9

WPFunnels1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-84753 · WPFunnels Mail Mint

WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Bricksforge.1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-84814 · Bricksforge. Bricksforge

WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

Delinea1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-19117 · Delinea Secret Server (On-Prem)

Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability

EPSS 0.5%CVSS 9.8

YITH1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-84238 · YITH YITH Request a Quote for WooCommerce Premium

WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability

EPSS 0.5%CVSS 9.8

Google4 vulnerabilities on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2026-85042 · Google Chrome

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbo…

EPSS 0.5%CVSS 9.6

CVE-2026-85047 · Google Chrome

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potenti…

EPSS 0.5%CVSS 9.6

CVE-2026-85050 · Google Chrome

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code ou…

EPSS 0.5%CVSS 9.6

CVE-2026-85043 · Google Chrome

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via…

EPSS 0.4%CVSS 9.1

OCS Inventory NG2 vulnerabilities on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2026-76174 · OCS Inventory NG Ocsreports

Multiple vulnerabilities in Ocsreports for OCS Inventory NG

EPSS 0.5%CVSS 9.4

CVE-2026-76178 · OCS Inventory NG Ocsreports

Multiple vulnerabilities in Ocsreports for OCS Inventory NG

EPSS 0.4%CVSS 9.2

j2commerce.com1 vulnerability on this pageMax CVSS 9.5Priority 36KEV 0

CVE-2026-78069 · j2commerce.com J2Store extension for Joomla

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

EPSS 0.4%CVSS 9.5

e4jvikwp1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-84768 · e4jvikwp VikAppointments Services Booking Calendar

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Paolo1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-84813 · Paolo GeoDirectory

WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

BishopFox1 vulnerability on this pageMax CVSS 9.6Priority 34KEV 0

CVE-2026-53649 · BishopFox joro

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

EPSS 0.3%CVSS 9.6

Eclipse Foundation2 vulnerabilities on this pageMax CVSS 9.5Priority 34KEV 0

CVE-2026-82180 · Eclipse Foundation Eclipse Arrowhead

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqt…

EPSS 0.3%CVSS 9.5

CVE-2026-82955 · Eclipse Foundation Eclipse aeriOS

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API…

EPSS 0.2%CVSS 9.0

joodb.feenders.de1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-78080 · joodb.feenders.de JooDatabase Lite extension for Joomla

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0

EPSS 0.4%CVSS 9.3

mpdavis1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-85394 · mpdavis python-jose

python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret

EPSS 0.2%CVSS 9.3

The archive.