Critical vulnerability archive — page 93

mlflow1 vulnerability on this pageMax CVSS 9.3Priority 97KEV 1

CVE-2026-64849 · mlflow mlflow

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

KEV · due 2 Sep EPSS 10%public exploit SSVC act CVSS 9.3

EFM1 vulnerability on this pageMax CVSS 10.0Priority 54KEV 0

CVE-2026-19977 · EFM ipTIME A3004T

EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication

EPSS 1%public exploit CVSS 10.0

patriksimek2 vulnerabilities on this pageMax CVSS 9.9Priority 52KEV 0

CVE-2026-47698 · patriksimek vm2

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

EPSS 1.0%public exploit CVSS 9.8

CVE-2026-47686 · patriksimek vm2

vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

EPSS 0.6%CVSS 9.9

mitre6 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-67965 · mitre

An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function

EPSS 0.9%public exploit CVSS 9.8

CVE-2026-68004 · mitre

An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorizatio…

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-67967 · mitre

Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code.

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-67966 · mitre

Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root…

EPSS 0.6%public exploit CVSS 9.8

CVE-2021-43716 · mitre

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20.

EPSS 0.3%public exploit CVSS 9.8

CVE-2026-67960 · mitre

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentContr…

EPSS 0.7%CVSS 9.8

jahlives18 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-74899 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-74896 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-74872 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

EPSS 0.7%CVSS 9.8

CVE-2026-74878 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

EPSS 0.7%CVSS 9.8

CVE-2026-74886 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

EPSS 0.7%CVSS 9.8

CVE-2026-74894 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token

EPSS 0.7%CVSS 9.8

CVE-2026-74895 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation

EPSS 0.7%CVSS 9.8

CVE-2026-74880 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

EPSS 0.6%CVSS 9.8

CVE-2026-74900 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode

EPSS 0.6%CVSS 9.8

CVE-2026-74891 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Hardcoded Database Credentials

EPSS 0.5%CVSS 9.8

CVE-2026-74901 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback

EPSS 0.4%CVSS 9.8

CVE-2026-74876 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

EPSS 0.3%CVSS 9.8

CVE-2026-74889 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF

EPSS 0.3%CVSS 9.8

CVE-2026-74881 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins

EPSS 0.4%CVSS 9.3

CVE-2026-74875 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Schema Validation Bypass

EPSS 0.3%CVSS 9.8

CVE-2026-74885 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Logging Bug and Race Condition

EPSS 0.2%CVSS 9.3

CVE-2026-74890 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

EPSS 0.2%CVSS 9.3

CVE-2026-74882 · jahlives openssl_encrypt

openssl_encrypt before 1.4.0 Insecure Default Configuration

EPSS 0.2%CVSS 9.1

MemTensor1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-75110 · MemTensor MemOS

MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

EPSS 0.7%public exploit CVSS 9.8

siyuan-note3 vulnerabilities on this pageMax CVSS 9.4Priority 47KEV 0

CVE-2026-74798 · siyuan-note siyuan

SiYuan kernel Path Traversal via database_clean MCP tool

EPSS 0.5%public exploit CVSS 9.3

CVE-2026-74799 · siyuan-note siyuan

SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure

EPSS 0.5%public exploit CVSS 9.3

CVE-2026-74800 · siyuan-note siyuan

SiYuan before v3.7.4 Stored XSS via assets endpoint

EPSS 0.4%CVSS 9.4

GitLab1 vulnerability on this pageMax CVSS 9.4Priority 45KEV 0

CVE-2026-19478 · GitLab GitLab

Improper Control of Generation of Code ('Code Injection') in GitLab

EPSS 2%CVSS 9.4

OpnForm1 vulnerability on this pageMax CVSS 9.3Priority 45KEV 0

CVE-2026-75106 · OpnForm OpnForm

OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

EPSS 0.4%public exploit CVSS 9.3

frappe1 vulnerability on this pageMax CVSS 9.9Priority 43KEV 0

CVE-2026-65974 · frappe erpnext

ERPNext: Server-Side Template Injection leading to Remote Code Execution

EPSS 1%CVSS 9.9

Wavlink1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2026-74843 · Wavlink WN531P3

Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow

EPSS 1%CVSS 10.0

Red Hat3 vulnerabilities on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-66792 · Red Hat Multicluster Global Hub 1.4.9

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

EPSS 0.7%CVSS 9.9

CVE-2026-71472 · Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

EPSS 0.9%CVSS 9.1

CVE-2026-66795 · Red Hat multicluster engine for Kubernetes 2.10

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

EPSS 0.5%CVSS 9.9

discourse1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2026-55674 · discourse discourse

Discourse: Cache poisoning/XSS via color scheme cookies

EPSS 0.6%CVSS 9.3

QuantumNous2 vulnerabilities on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-71479 · QuantumNous new-api

New API: Integer overflow in quota billing yields negative charges (self-crediting)

EPSS 0.6%CVSS 9.1

CVE-2026-64859 · QuantumNous new-api

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

EPSS 0.6%CVSS 9.1

onyx-dot-app1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2026-71424 · onyx-dot-app onyx

Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

EPSS 0.5%CVSS 9.6

Roundcube1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-75003 · Roundcube Webmail

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remot…

EPSS 0.4%CVSS 9.8

JetBrains1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-75045 · JetBrains YouTrack

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via…

EPSS 0.5%CVSS 9.1

joomlack.fr1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-74254 · joomlack.fr Page Builder CK extension for Joomla

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5

EPSS 0.4%CVSS 9.3

regularlabs.com1 vulnerability on this pageMax CVSS 10.0Priority 35KEV 0

CVE-2026-74253 · regularlabs.com Sourcerer extension for Joomla

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0

EPSS 0.3%CVSS 10.0

Google Cloud1 vulnerability on this pageMax CVSS 9.4Priority 34KEV 0

CVE-2026-15623 · Google Cloud Google SecOps (Chronicle SOAR)

Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service

EPSS 0.3%CVSS 9.4

Innotim Software Telecommunications and Consulting Trade Ltd. Co.1 vulnerability on this pageMax CVSS 9.0Priority 34KEV 0

CVE-2026-14564 · Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM

Sensitive Data Exposure in Innotim Software's Logsign SIEM

EPSS 0.4%CVSS 9.0

openshift-metal31 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-71566 · openshift-metal3 fakefish

KubeVirt backend is not authenticated

EPSS 0.4%CVSS 9.3

The archive.