Critical vulnerability archive — page 98

Tenda2 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2026-19747 · Tenda CH7

Tenda CH7 ATE Module Kylin HandleCmd command injection

EPSS 3%public exploit CVSS 9.8

CVE-2026-19750 · Tenda CH

Tenda CH/CP/TX3 SSH hard-coded password

EPSS 0.8%public exploit CVSS 9.2

Fosowl1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2026-72776 · Fosowl AgenticSeek

AgenticSeek Unauthenticated RCE via /query API Endpoint

EPSS 1%public exploit CVSS 9.8

Gitea7 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2026-56654 · Gitea Gitea Open Source Git Server

Privilege Escalation via Access Token Scope Escalation in API

EPSS 0.8%public exploit CVSS 9.8

CVE-2026-56443 · Gitea Gitea Open Source Git Server

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

EPSS 0.5%public exploit CVSS 9.6

CVE-2026-58443 · Gitea Gitea Open Source Git Server

Public-only repository tokens can update private PR head branches

EPSS 0.6%public exploit CVSS 9.1

CVE-2026-55982 · Gitea Gitea Open Source Git Server

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-58433 · Gitea Gitea Open Source Git Server

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

EPSS 0.5%public exploit CVSS 9.1

CVE-2026-56750 · Gitea Gitea Open Source Git Server

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

EPSS 0.5%CVSS 9.1

CVE-2026-58508 · Gitea Gitea Open Source Git Server

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

EPSS 0.5%CVSS 9.1

openwrt2 vulnerabilities on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2026-72841 · openwrt luci

luci-app-openvpn Path Traversal RCE via instance_name2

EPSS 0.6%public exploit CVSS 9.9

CVE-2026-72842 · openwrt luci

OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

EPSS 0.6%CVSS 9.9

shepherdwind1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-73649 · shepherdwind velocity.js

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)

EPSS 0.7%public exploit CVSS 9.8

filebrowser2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-72839 · filebrowser filebrowser

filebrowser through 2.63.16 Privilege Escalation via Signup

EPSS 0.6%public exploit CVSS 9.8

CVE-2026-72836 · filebrowser filebrowser

FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass

EPSS 0.5%public exploit CVSS 9.2

Budibase3 vulnerabilities on this pageMax CVSS 10.0Priority 47KEV 0

CVE-2026-72850 · budibase server

Budibase before 3.40.0 Arbitrary File Write via Path Traversal

EPSS 0.5%public exploit CVSS 9.4

CVE-2026-72851 · budibase server

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

EPSS 0.4%public exploit CVSS 10.0

CVE-2026-73302 · Budibase budibase

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

EPSS 0.4%public exploit CVSS 9.0

siyuan-note2 vulnerabilities on this pageMax CVSS 10.0Priority 47KEV 0

CVE-2026-72810 · siyuan-note siyuan

SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

EPSS 0.5%public exploit CVSS 9.2

CVE-2026-72811 · siyuan-note siyuan

SiYuan before v3.7.4 SQL Injection via backlink search

EPSS 0.4%CVSS 10.0

Tenable, Inc.1 vulnerability on this pageMax CVSS 9.9Priority 45KEV 0

CVE-2026-19626 · Tenable, Inc. Security Center

Remote Code Execution

EPSS 2%CVSS 9.9

IBM12 vulnerabilities on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-17481 · IBM Documentation Offline

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

EPSS 0.9%CVSS 9.8

CVE-2026-17482 · IBM Documentation Offline

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

EPSS 0.8%CVSS 9.8

CVE-2026-17206 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Host Servers

EPSS 0.7%CVSS 9.8

CVE-2026-16867 · IBM i

IBM i is Affected By Multiple Vulnerabilities in NetServer

EPSS 0.6%CVSS 9.8

CVE-2026-17101 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

EPSS 0.6%CVSS 9.6

CVE-2026-17197 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Host Servers

EPSS 0.5%CVSS 9.8

CVE-2026-18193 · IBM i

IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

EPSS 0.5%CVSS 10.0

CVE-2026-14525 · IBM WebSphere Application Server - Liberty

IBM WebSphere Application Server Liberty is affected by an authenication bypass

EPSS 0.5%CVSS 9.4

CVE-2026-16961 · IBM i

IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []

EPSS 0.5%CVSS 9.8

CVE-2026-19297 · IBM Langflow OSS

Insufficient Authentication Brute Force Protection on Login Endpoint

EPSS 0.6%CVSS 9.1

CVE-2026-18249 · IBM i

IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

EPSS 0.4%CVSS 9.9

CVE-2026-16815 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol

EPSS 0.5%CVSS 9.1

usmannasir1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-67614 · usmannasir cyberpanel

CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

EPSS 1.0%CVSS 9.8

vitest-dev1 vulnerability on this pageMax CVSS 9.4Priority 40KEV 0

CVE-2026-73653 · vitest-dev vitest

Vitest: Browser Mode provider commands bypass the file-access permission gate

EPSS 0.8%CVSS 9.4

nextauthjs2 vulnerabilities on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2026-73420 · nextauthjs next-auth

NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

EPSS 0.7%CVSS 9.1

CVE-2026-73421 · nextauthjs next-auth

NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

EPSS 0.6%CVSS 9.1

triggerdotdev1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-73656 · triggerdotdev trigger.dev

Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state

EPSS 0.5%CVSS 9.9

Wishlist Member1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-12949 · Wishlist Member Wishlist Member

Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter

EPSS 0.5%CVSS 9.8

CPANSec2 vulnerabilities on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2022-4993 · CPANSec

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

EPSS 0.6%CVSS 9.1

CVE-2026-13051 · CPANSec

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template

EPSS 0.6%CVSS 9.1

Elastic1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-72676 · Elastic Fleet Server

Improper Control of Generation of Code in Fleet Server Leading to Code Injection

EPSS 0.5%CVSS 9.1

HashiCorp1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2026-8715 · HashiCorp Tooling

Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

EPSS 0.5%CVSS 9.6

openchoreo2 vulnerabilities on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2026-73843 · openchoreo openchoreo

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

EPSS 0.5%CVSS 9.6

CVE-2026-73842 · openchoreo openchoreo

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

EPSS 0.3%CVSS 9.0

Roskus1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-19871 · Roskus Prospero Flow CRM

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

EPSS 0.5%CVSS 9.3

FreePBX2 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-73663 · FreePBX missedcall

FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

EPSS 0.4%CVSS 9.8

CVE-2026-73665 · FreePBX ucp

FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

EPSS 0.3%CVSS 9.8

OpenIdentityPlatform1 vulnerability on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2026-73644 · OpenIdentityPlatform OpenDJ

OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant

EPSS 0.4%CVSS 9.6

JuneAndGreen1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-73567 · JuneAndGreen sm-crypto

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

EPSS 0.4%CVSS 9.1

The archive.