Critical vulnerability archive — page 87

NetScaler1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2026-19490 · NetScaler ADC

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

KEV · due 12 Sep EPSS 33%public exploit SSVC act CVSS 9.8

sgoudelis1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2026-53451 · sgoudelis ground-station

Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution

EPSS 1%public exploit CVSS 9.8

TRENDnet1 vulnerability on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2026-75976 · TRENDnet TEW-823DRU

TRENDnet TEW-823DRU NVRAM wan.cgi strcpy stack-based overflow

EPSS 0.9%public exploit CVSS 9.9

UTT2 vulnerabilities on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2026-76003 · UTT HiPER 1200GW

UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow

EPSS 0.8%public exploit CVSS 9.9

CVE-2026-76004 · UTT HiPER 1250GW

UTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow

EPSS 0.8%public exploit CVSS 9.9

wazuh2 vulnerabilities on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2026-48024 · wazuh wazuh

Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager

EPSS 0.8%public exploit CVSS 9.1

CVE-2026-48162 · wazuh wazuh

Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager

EPSS 0.7%public exploit CVSS 9.1

getgrav1 vulnerability on this pageMax CVSS 9.4Priority 46KEV 0

CVE-2026-62668 · getgrav grav

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

EPSS 0.4%public exploit CVSS 9.4

libfuse1 vulnerability on this pageMax CVSS 9.3Priority 46KEV 0

CVE-2026-47187 · libfuse sshfs

SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

EPSS 0.5%public exploit CVSS 9.3

Unknown4 vulnerabilities on this pageMax CVSS 10.0Priority 46KEV 0

CVE-2026-18051 · Unknown W3 Total Cache

W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

EPSS 2%CVSS 10.0

CVE-2026-18937 · Unknown Broken Link Checker

Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

EPSS 2%CVSS 9.0

CVE-2026-18031 · Unknown TabaPay Gateway

TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback

EPSS 0.5%CVSS 9.8

CVE-2026-18776 · Unknown TrueBooker

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

EPSS 0.5%CVSS 9.8

thorsten2 vulnerabilities on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2026-76213 · thorsten phpMyFAQ

phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

EPSS 0.4%public exploit CVSS 9.1

CVE-2026-76214 · thorsten phpMyFAQ

phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

EPSS 0.4%CVSS 9.1

Comfast1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2026-76008 · Comfast CF-N1-S

Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

EPSS 1%CVSS 10.0

verbb1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2026-52889 · verbb formie

Formie: Server-Side Template Injection in Formie Hidden field defaults

EPSS 1%CVSS 9.8

Crocoblock. Jetimpex Inc.1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2026-66613 · Crocoblock. Jetimpex Inc. JetEngine

WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability

EPSS 0.9%CVSS 9.8

IBM4 vulnerabilities on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-15068 · IBM AIX

Vulnerabilities in IBM AIX and PowerVM VIOS

EPSS 0.8%CVSS 9.9

CVE-2026-16816 · IBM AIX

Vulnerabilities in IBM AIX and PowerVM VIOS

EPSS 0.8%CVSS 9.9

CVE-2026-16656 · IBM AIX

Vulnerabilities in IBM AIX and PowerVM VIOS

EPSS 0.7%CVSS 9.8

CVE-2026-15065 · IBM AIX

Vulnerabilities in IBM AIX and PowerVM VIOS

EPSS 0.6%CVSS 9.1

mitre1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2026-51366 · mitre

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_v…

EPSS 0.8%CVSS 9.9

siyuan-note2 vulnerabilities on this pageMax CVSS 9.3Priority 41KEV 0

CVE-2026-75916 · siyuan-note siyuan

SiYuan XSS-to-RCE via unescaped block metadata in hint popup

EPSS 0.2%public exploit CVSS 9.3

CVE-2026-75917 · siyuan-note siyuan

SiYuan before v3.7.4 XSS-to-RCE via pathName.ts

EPSS 0.2%public exploit CVSS 9.3

Cisco1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2026-20030 · Cisco Cisco Crosswork Planning

Cisco Crosswork Security Hardening Release: August 2026

EPSS 0.6%CVSS 10.0

balbooa.com1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-67364 · balbooa.com Balbooa Forms extension for Joomla

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

EPSS 0.5%CVSS 10.0

The41 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-73389 · The4 Kalles Addons

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

wpdesk1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-73364 · wpdesk Flexible Subscriptions

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Faydam Innovation Inc.1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-16019 · Faydam Innovation Inc. FAYDAM Datalogger

SQL Injection in Faydam Innovation's FAYDAM Datalogger

EPSS 0.5%CVSS 9.8

FreeBSD2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-58081 · FreeBSD FreeBSD

Heap based buffer overflow in iconv(3)

EPSS 0.5%CVSS 9.8

CVE-2026-58082 · FreeBSD FreeBSD

Stack based buffer overflow in iconv(3)

EPSS 0.5%CVSS 9.8

KlbTheme2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-73390 · KlbTheme Total Donations

WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

CVE-2026-73391 · KlbTheme Total Donations

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

ThemetechMount1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-73347 · ThemetechMount TrueBooker

WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

cmsjunkie.com2 vulnerabilities on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2026-75949 · cmsjunkie.com J-BusinessDirectory extension for Joomla

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3

EPSS 0.4%CVSS 10.0

CVE-2026-75954 · cmsjunkie.com J-BusinessDirectory extension for Joomla

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3

EPSS 0.4%CVSS 9.3

CPANSec1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-72889 · CPANSec

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify

EPSS 0.4%CVSS 9.8

eidetic-labs3 vulnerabilities on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2026-76243 · eidetic-labs stigmem

stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth

EPSS 0.6%CVSS 9.2

CVE-2026-76242 · eidetic-labs stigmem

stigmem Federation Peer Registration Authentication Bypass

EPSS 0.3%CVSS 9.1

CVE-2026-76244 · eidetic-labs stigmem

stigmem-node Insecure Federation Transport Configuration

EPSS 0.3%CVSS 9.1

PoxenStudio1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2026-45272 · PoxenStudio talebook

MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File

EPSS 0.5%CVSS 9.4

Shenzhen Cudy Technology Co., Ltd.1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-71960 · Shenzhen Cudy Technology Co., Ltd. WR3000 2.0

Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

EPSS 0.5%CVSS 9.3

yootheme.com2 vulnerabilities on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2026-74803 · yootheme.com Zoo extension for Joomla

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

EPSS 0.4%CVSS 10.0

CVE-2026-74804 · yootheme.com Zoo extension for Joomla

Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

EPSS 0.4%CVSS 9.3

Oracle Corporation1 vulnerability on this pageMax CVSS 9.9Priority 36KEV 0

CVE-2026-73930 · Oracle Corporation Helidon

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

EPSS 0.4%CVSS 9.9

Get Maps Marker Pro1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-73183 · Get Maps Marker Pro Maps Marker Pro

WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

TeconceTheme1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-73388 · TeconceTheme Nikstore Core

WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

wpo-HR1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-73185 · wpo-HR NGG Smart Image Search

WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

LY Corporation1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-11751 · LY Corporation Armeria

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently dis…

EPSS 0.3%CVSS 9.1

The archive.