Critical vulnerability archive — page 70

QVidium1 vulnerability on this pageMax CVSS 10.0Priority 58KEV 0

CVE-2026-82971 · QVidium Opera11

QVidium Opera11 CGI Script net_tr.cgi command injection

EPSS 3%public exploit CVSS 10.0

D-Link5 vulnerabilities on this pageMax CVSS 9.9Priority 57KEV 0

RedPort1 vulnerability on this pageMax CVSS 9.9Priority 57KEV 0

CVE-2026-83524 · RedPort Optimizer wXa-203

RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

EPSS 3%public exploit CVSS 9.9

mitre8 vulnerabilities on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2026-79408 · mitre

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoPars…

EPSS 2%public exploit CVSS 9.8

CVE-2026-51738 · mitre

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset t…

EPSS 0.6%CVSS 9.8

CVE-2026-51740 · mitre

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate c…

EPSS 0.6%CVSS 9.8

CVE-2026-51741 · mitre

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase…

EPSS 0.6%CVSS 9.8

CVE-2026-51744 · mitre

Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to for…

EPSS 0.6%CVSS 9.8

CVE-2026-51747 · mitre

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect…

EPSS 0.6%CVSS 9.8

CVE-2026-51736 · mitre

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase syste…

EPSS 0.5%CVSS 9.1

CVE-2026-51743 · mitre

Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable…

EPSS 0.5%CVSS 9.1

Tenda3 vulnerabilities on this pageMax CVSS 10.0Priority 55KEV 0

CVE-2026-82693 · Tenda AC1206

Tenda AC1206 Web UI telnet TendaTelnet missing authentication

EPSS 1%public exploit CVSS 10.0

CVE-2026-82694 · Tenda AC1206

Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication

EPSS 1%public exploit CVSS 10.0

CVE-2026-82695 · Tenda AC18

Tenda AC18 Telnet telnet missing authentication

EPSS 1%public exploit CVSS 10.0

TOTOLINK1 vulnerability on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2026-82616 · TOTOLINK NR1800X

TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow

EPSS 0.9%public exploit CVSS 9.9

samanhappy1 vulnerability on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2026-79748 · samanhappy mcphub

MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

EPSS 0.6%public exploit CVSS 9.9

nodemailer1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-82854 · nodemailer nodemailer

Nodemailer before 8.0.4 SMTP Command Injection via envelope.size

EPSS 2%CVSS 9.8

ToolJet3 vulnerabilities on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2026-82870 · ToolJet ToolJet

ToolJet before v3.16.208 Cross-Tenant Database Manipulation

EPSS 0.4%public exploit CVSS 9.6

CVE-2026-82872 · ToolJet ToolJet

ToolJet before v3.16.208 Cross-Workspace Authorization Bypass

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-82874 · ToolJet ToolJet

ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

EPSS 0.4%CVSS 9.9

ZTE1 vulnerability on this pageMax CVSS 9.6Priority 46KEV 0

CVE-2026-49003 · ZTE ZXDU68 S202 V5.0

Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product

EPSS 2%CVSS 9.6

Ministry of the Interior (MVČR)1 vulnerability on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2026-59111 · Ministry of the Interior (MVČR) eObčanka-Identifikace

Command Injection vulnerability in eObčanka-Identifikace

EPSS 1%CVSS 9.3

VulDB1 vulnerability on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2026-82954 · VulDB

Dokploy Settings application.ts writeTraefikConfigInPath path traversal

EPSS 1.0%CVSS 9.9

MSI1 vulnerability on this pageMax CVSS 9.3Priority 40KEV 0

CVE-2026-82908 · MSI Dragon Center

MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow

EPSS 0.2%public exploit CVSS 9.3

Proper Fraction1 vulnerability on this pageMax CVSS 9.2Priority 40KEV 0

CVE-2026-66047 · Proper Fraction ProfilePress

ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

EPSS 0.9%CVSS 9.2

Dell1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-58574 · Dell PowerStore 500T

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability.

EPSS 0.6%CVSS 9.8

hashthemes1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-81780 · hashthemes Hash Form

WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

hulumi4 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-82855 · hulumi policies

@hulumi/policies before 1.3.2 Evidence Validation Bypass

EPSS 0.6%CVSS 9.8

CVE-2026-82860 · hulumi policies

@hulumi/policies before 1.3.2 Admin Policy Bypass

EPSS 0.5%CVSS 9.8

CVE-2026-82856 · hulumi policies

@hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

EPSS 0.5%CVSS 9.8

CVE-2026-82858 · hulumi drift

@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

EPSS 0.3%CVSS 9.8

ieungSoft1 vulnerability on this pageMax CVSS 9.3Priority 39KEV 0

CVE-2026-82807 · ieungSoft Ultra RAMDisk Pro

ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management

EPSS 0.2%public exploit CVSS 9.3

kerberosmansour2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-82859 · kerberosmansour hulumi

hulumi before v1.3.2 SCP Template Tag-on-Create Bypass

EPSS 0.5%CVSS 9.8

CVE-2026-82857 · kerberosmansour hulumi

hulumi before v1.3.2 Privilege Escalation via IAM Policy

EPSS 0.5%CVSS 9.8

Silk Themes1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-81779 · Silk Themes Newspapers X

WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

EPSS 0.5%CVSS 10.0

Tickera1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-82226 · Tickera Tickera

WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

WP Legal Pages1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-82970 · WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

Ebyte2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-73819 · Ebyte Ebyte NA111-M Firmware

Ebyte NA111-M Weak Authentication

EPSS 0.5%CVSS 9.8

CVE-2026-76133 · Ebyte Ebyte NA111-M Firmware

Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm

EPSS 0.4%CVSS 9.8

Phison Electronics Corporation1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2026-82876 · Phison Electronics Corporation PS3111-S11 Controller Firmware

Phison PS3111-S11 Controller Firmware Signature Verification Bypass

EPSS 0.1%public exploit CVSS 9.3

Autorius E-goi1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-81756 · Autorius E-goi Smart Marketing SMS and Newsletters Forms

WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Passionate Programmer Peter1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-81293 · Passionate Programmer Peter WP Data Access

WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

zhenorzz1 vulnerability on this pageMax CVSS 9.6Priority 35KEV 0

CVE-2026-53552 · zhenorzz goploy

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

EPSS 0.4%CVSS 9.6

ウェブ屋のさとーさん1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-81763 · ウェブ屋のさとーさん Throws SPAM Away

WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Google Cloud1 vulnerability on this pageMax CVSS 9.4Priority 30KEV 0

CVE-2026-19410 · Google Cloud Google Cloud Build

Google Cloud Build Comment Control Bypass via Webhook Suppression

EPSS 0.2%CVSS 9.4

Colorful1 vulnerability on this pageMax CVSS 9.3Priority 29KEV 0

CVE-2026-82628 · Colorful iGameCenter

Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management

EPSS 0.2%CVSS 9.3

The archive.