The archive.

mitre1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-52490 · mitre

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts()…

EPSS 0.7%public exploit CVSS 9.8

DrayTek Corporation3 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2026-71921 · DrayTek Corporation VigorSwitch G2540xs

DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi

EPSS 3%CVSS 9.8

CVE-2026-71914 · DrayTek Corporation VigorAP 918R

DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm

EPSS 3%CVSS 9.8

CVE-2026-71933 · DrayTek Corporation VigorSwitch G2540xs

DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

EPSS 0.6%CVSS 9.1

4MOSAn Security Technology1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2026-78211 · 4MOSAn Security Technology 4MOSAn GCB Doctor

4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection

EPSS 2%CVSS 9.8

oauth2-proxy1 vulnerability on this pageMax CVSS 9.3Priority 46KEV 0

CVE-2026-76835 · oauth2-proxy oauth2-proxy

OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

EPSS 0.5%public exploit CVSS 9.3

Canonical1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-66897 · Canonical LXD

Instance template path traversal allows arbitrary host file write as root

EPSS 0.7%CVSS 9.9

rconfig1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-77915 · rconfig rconfig

rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

EPSS 0.8%CVSS 9.8

Apache Software Foundation3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-71300 · Apache Software Foundation Apache Camel

Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection

EPSS 0.7%CVSS 9.8

CVE-2026-78329 · Apache Software Foundation Apache Camel

Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

EPSS 0.7%CVSS 9.8

CVE-2026-66906 · Apache Software Foundation Apache Camel

Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

EPSS 0.8%CVSS 9.1

CPANSec1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-78183 · CPANSec

DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float

EPSS 0.7%CVSS 9.8

A CPT1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-32563 · A CPT ACPT (Pro) - Custom Post Types Plugin for WordPress

WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Konami1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2026-19874 · Konami Metal Gear Online 3

Konami's Metal Gear Online 3 contains a heap-based buffer overflow

EPSS 0.8%CVSS 9.1

Nexcess1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-78265 · Nexcess The Events Calendar

WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

Theme-Rex1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-66650 · Theme-Rex FreightCo

WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

weDevs1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-78262 · weDevs WP Project Manager

WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

cakephp2 vulnerabilities on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-77337 · cakephp authentication

CakePHP: Potential Authentication bypass with CookieAuthenticator

EPSS 0.7%CVSS 9.1

CVE-2026-77635 · cakephp cakephp

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

EPSS 0.5%CVSS 9.2

Combodo1 vulnerability on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-39975 · Combodo iTop

Combodo iTop: Remote code execution using external auth variable value

EPSS 0.6%CVSS 9.4

exceljs1 vulnerability on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-78207 · exceljs exceljs

exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

EPSS 0.6%CVSS 9.4

MVPThemes1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-66648 · MVPThemes Jawn

WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

phpipam1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2026-67602 · phpipam phpipam

phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

EPSS 0.6%CVSS 9.3

ransomlook4 vulnerabilities on this pageMax CVSS 9.4Priority 38KEV 0

CVE-2026-78370 · ransomlook ransomlook

RansomLook Unauthenticated Database Export Exposes Private Data

EPSS 0.7%CVSS 9.2

CVE-2026-78372 · ransomlook ransomlook

RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

EPSS 0.7%CVSS 9.2

CVE-2026-78387 · ransomlook ransomlook

RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

EPSS 0.6%CVSS 9.4

CVE-2026-78555 · ransomlook ransomlook

RansomLook API Key Disclosure Through /admin/apikeys HTML Source

EPSS 0.4%CVSS 9.4

RedefiningTheWeb1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-32558 · RedefiningTheWeb Affiliate Pro - Affiliate Program for WooCommerce & WordPress

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

tophive1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-32559 · tophive UltimateAI

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

UnitedOver, LLC1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-28165 · UnitedOver, LLC Digits

WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

WPCafe1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-66587 · WPCafe WP Cafe Pro

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Zscaler2 vulnerabilities on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-59568 · Zscaler Client Connector

Remote Code Execution

EPSS 0.7%CVSS 9.1

CVE-2026-59564 · Zscaler Client Connector

Authentication bypass between ZCC and client connector portal

EPSS 0.5%CVSS 9.1

miniorange.com1 vulnerability on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2026-77995 · miniorange.com miniOrange OAuth Client (free) extension for Joomla

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2

EPSS 0.4%CVSS 10.0

Roskus1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-78365 · Roskus Prospero Flow CRM

IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

EPSS 0.5%CVSS 9.3

rustdesk1 vulnerability on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2026-76840 · rustdesk rustdesk

RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length

EPSS 0.4%CVSS 9.6

DiviNext1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-32551 · DiviNext Woo Essential

WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

DJI1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-78251 · DJI Neo

DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

joomlack.fr1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-77994 · joomlack.fr Page Builder CK extension for Joomla

Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5

PixelYourSite Professional1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-32555 · PixelYourSite Professional Boost

WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

WBW1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-32554 · WBW WooBeWoo Product Filter Pro

WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability