Latest critical vulnerabilities
Published CVEs whose headline CVSS score — from the CNA or from NVD — is 9.0 or more, newest first.
Updated : CVE List (cvelistV5) · NVD (fkie-cad mirror)
Latest critical vulnerabilities · Libraries recently hit by a critical vulnerability · Most likely to be exploited · Recently added to CISA KEV
| CVE | Library / product — vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-109218 | kleor Contact Manager ≤ 9.1.2 | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass | CRITICAL 9.8 | |||
| CVE-2026-104383 | EagleCloud Aquila ≤ 2.6.7.2 | Code injection in EagleCloud Aquila on-premises version | CRITICAL 9.4 | |||
| CVE-2026-84999 | Pie Register Pie Register Premium ≤ 3.8.4.0 | Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler | CRITICAL 9.8 | |||
| CVE-2026-118375 | ggml-org llama.cpp b8841 – < b11865 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() | CRITICAL 9.2 | |||
| CVE-2026-106013 | artbees Jupiter X Core ≤ 4.61.0 | Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter | CRITICAL 9.8 | |||
| CVE-2026-110879 | FasterXML jackson-databind 2.10.0 – < 2.18.12 ; 2.19.0 – < 2.21.8 ; 2.22.0 – < 2.22.4FasterXML jackson-databind 3.0.0 – < 3.1.8 ; 3.2.0 – < 3.2.4 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation… | CRITICAL 9.8 | |||
| CVE-2026-58256 | JeromeDevome GRR < 4.5.0 | GRR vulnerable to Remote Code Execution Via PHP Code Injection | CRITICAL 9.1 | |||
| CVE-2026-116692 | mlflow PyPI 3.12.0rc0 – < 3.17.0 | MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact m… | CRITICAL 9.8 | |||
| CVE-2026-112352 | Sunhillo Corporation SureLine 8.0.0 – < 9.1.5 | Sunhillo SureLine Authentication Bypass via Session Cookie | CRITICAL 9.1 | |||
| CVE-2026-105780 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) | CRITICAL 9.9 | |||
| CVE-2026-104353 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | CRITICAL 9.9 | |||
| CVE-2026-105489 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | CRITICAL 9.9 | |||
| CVE-2026-105781 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | CRITICAL 10.0 | |||
| CVE-2026-105779 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | CRITICAL 9.1 | |||
| CVE-2026-104354 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | CRITICAL 9.1 | |||
| CVE-2026-104351 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) | CRITICAL 9.9 | |||
| CVE-2026-104350 | Adobe Adobe Campaign Classic ≤ 7.4.4 build 9402 | Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79) | CRITICAL 9.3 | |||
| CVE-2026-108015 | HCLSoftware Notes Client <1=2.0.2 FP8, <=14.0 FP5, 14.5, <=14.5.1 FP1 | eMudhra Compromised Certificate vulnerability impacts HCL Notes Client | CRITICAL 9.1 | |||
| CVE-2026-114595 | The EPICS Community EPICS Base ≤ 7.0.10 | Integer overflow or wraparound in EPICS Base | CRITICAL 9.3 | |||
| CVE-2026-48360 | Adobe Adobe Connect Desktop App ≤ 2026.8.51 (Win), 2026.08.45 (Mac Silicon), 2026.01.39 (Mac Intel)Adobe Adobe Connect Android Mobile App ≤ 4.4 | Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94) | CRITICAL 9.6 | |||
| CVE-2026-108014 | HCLSoftware Domino Server <1=2.0.2 FP8, <=14.0 FP5, 14.5, <=14.5.1 FP1 | eMudhra Compromised Certificate vulnerability impacts HCL Domino Server | CRITICAL 9.1 | |||
| CVE-2026-108142 | Veeam Backup and Replication 13.0 – < 13.0.3 ; 13.1 – < 13.1.2 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. | CRITICAL 9.1 | |||
| CVE-2026-106076 | Veeam Backup for Microsoft 365 8.0 – 8.5.0.1014 | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backu | CRITICAL 9.0 | |||
| CVE-2026-116863 | Tribulant Software Newsletters ≤ 4.18.2 | WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability | CRITICAL 9.6 | |||
| CVE-2026-90465 | WatchGuard Fireware OS 2025.1 – < 2026.4 ; 12.0 – < 12.12.4WatchGuard Fireware OS 12.0 – < 12.5.22 | Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation | CRITICAL 9.4 | |||
| CVE-2026-112710 | WatchGuard Fireware OS 2025.1 – < 2026.4 ; 12.0 – < 12.12.4WatchGuard Fireware OS 12.0 – < 12.5.22 | Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution | CRITICAL 9.2 | |||
| CVE-2026-112709 | WatchGuard Fireware OS 2025.1 – < 2026.4 ; 12.0 – < 12.12.4WatchGuard Fireware OS 12.0 – < 12.5.22 | Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution | CRITICAL 9.2 | |||
| CVE-2026-103593 | WatchGuard Fireware OS 2025.1 – < 2026.4 ; 12.0 – < 12.12.4WatchGuard Fireware OS 12.0 – < 12.5.22 | Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution | CRITICAL 9.1 | |||
| CVE-2026-93866 | WatchGuard Fireware OS 2025.1 – < 2026.4 ; 12.0 – < 12.12.4WatchGuard Fireware OS 12.0 – < 12.5.22 | Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write | CRITICAL 9.2 | |||
| CVE-2026-93865 | WatchGuard Fireware OS 2025.1 – < 2026.4 ; 12.0 – < 12.12.4WatchGuard Fireware OS 12.0 – < 12.5.22 | Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection | CRITICAL 9.2 | |||
| CVE-2026-93857 | WatchGuard Fireware OS 2025.1 – < 2026.4 ; 12.0 – < 12.12.4WatchGuard Fireware OS 12.0 – < 12.5.22 | Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution | CRITICAL 9.2 | |||
| CVE-2026-103594 | WatchGuard Fireware OS 2026.2 – < 2026.4 ; 12.12 – < 12.12.4 | Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution | CRITICAL 9.5 | |||
| CVE-2026-117603 | spesmilo electrum < 4.7.2 | Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass | CRITICAL 9.3 | |||
| CVE-2026-117601 | spesmilo electrum < 4.8.3 | Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions | CRITICAL 9.3 | |||
| CVE-2026-117564 | buqiyuan nest-admin < 1.0.1 | nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret | CRITICAL 9.3 | |||
| CVE-2026-65145 | NVIDIA NeMo Agent Toolkit 1.0 to 1.8.0 | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lea | CRITICAL 10.0 | |||
| CVE-2026-115216 | Eclipse Foundation Eclipse ioFog 3.8.0 – < 3.9.2 | Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials | CRITICAL 9.1 | |||
| CVE-2026-112362 | @fastify/express @fastify/express 4.0.5 – < 4.0.9 | @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets | CRITICAL 9.1 | |||
| CVE-2026-117532 | redaxo core 5.3.0 – < 5.21.4 | REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin | CRITICAL 9.3 | |||
| CVE-2026-82117 | Hitachi HiRDB Server Version 10 10-00 – < 10-12-01Hitachi HiRDB Server Version 9 09-00 – 09-66-22+3 more | Authentication Bypass by Spoofing Vulnerability in HiRDB | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-82116 | Hitachi HiRDB Server Version 10 10-00 – < 10-12-01Hitachi HiRDB Server Version 9 09-00 – 09-66-22+3 more | Missing Authentication for Critical Function Vulnerability in HiRDB | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-82118 | Hitachi HiRDB Server Version 10 10-00 – < 10-12-01Hitachi HiRDB Server Version 9 09-00 – 09-66-22+3 more | Stack-based Buffer Overflow Vulnerability in HiRDB | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-82120 | Hitachi HiRDB Server Version 10 10-00 – < 10-12-01Hitachi HiRDB Server Version 9 09-00 – 09-66-22+3 more | Heap-based Buffer Overflow Vulnerability in HiRDB | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-82119 | Hitachi HiRDB Server Version 10 10-00 – < 10-12-01Hitachi HiRDB Server Version 9 09-00 – 09-66-22+3 more | OS Command Injection Vulnerability in HiRDB | CRITICAL 9.8 | 1.8 % | ||
| CVE-2026-82122 | Hitachi HiRDB Server Version 10 10-00 – < 10-12-01Hitachi HiRDB Server Version 9 09-00 – 09-66-22+3 more | Stack-based Buffer Overflow Vulnerability in HiRDB | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-76939 | Hitachi JP1/Automatic Job Management System 3 - Manager 11-00 – < 13-50-31Hitachi JP1/Automatic Job Management System 3 - Agent 11-00 – < 13-50-31 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-76936 | Hitachi JP1/Automatic Job Management System 3 - Manager 10-00 – < 13-50-31 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-76937 | Hitachi JP1/Automatic Job Management System 3 - Manager 10-00 – < 13-50-31 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-76938 | Hitachi JP1/Automatic Job Management System 3 - Manager 10-00 – < 13-50-31 | Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-76935 | Hitachi JP1/Automatic Job Management System 3 - Manager 13-10 – < 13-50-31 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-76934 | Hitachi JP1/Automatic Job Management System 3 - Manager 10-00 – < 13-50-31Hitachi JP1/Automatic Job Management System 3 - Agent 10-00 – < 13-50-31+1 more | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-76933 | Hitachi JP1/Automatic Job Management System 3 - Manager 10-00 – < 13-50-31Hitachi JP1/Automatic Job Management System 3 - Agent 10-00 – < 13-50-31+1 more | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-76932 | Hitachi JP1/Automatic Job Management System 3 - Manager 10-00 – < 13-50-31Hitachi JP1/Automatic Job Management System 3 - Agent 10-00 – < 13-50-31+1 more | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-86577 | Hitachi JP1/Integrated Management 3 - Manager 13-00 – < 13-50-31Hitachi JP1/Automatic Job Management System 3 - Manager 13-00 – < 13-50-31+3 more | Out-of-bounds Write Vulnerability in JP1 Products | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-86576 | Hitachi JP1/Integrated Management 3 - Manager 13-00 – < 13-50-31Hitachi JP1/Automatic Job Management System 3 - Manager 13-00 – < 13-50-31+3 more | Heap-based Buffer Overflow Vulnerability in JP1 Products | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-86575 | Hitachi JP1/Integrated Management 3 - Manager 13-00 – < 13-50-31Hitachi JP1/Automatic Job Management System 3 - Manager 13-00 – < 13-50-31+3 more | Stack-based Buffer Overflow Vulnerability in JP1 Products | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-86574 | Hitachi JP1/Base 11-00 – < 12-50-54 | Heap-based Buffer Overflow Vulnerability in JP1/Base | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-102788 | balbooa.com Gridbox extension for Joomla 1.0.0-2.20.4.1 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-102789 | balbooa.com Gridbox extension for Joomla 1.0.0-2.20.4.1 | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 | CRITICAL 9.3 | 0.3 % | ||
| CVE-2026-92885 | Qode Themes Qode Membership ≤ 2.0.6.2 | Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-18450 | SMCI X12SPI 01.07.20 | Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-116747 | rajnandan1 kener 3.0.0 – < 4.1.10 | Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-116508 | TOTOLINK A950RG 4.1.2cu.5268_B20221104 | TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow | CRITICAL 10.0 | 0.6 % | ||
| CVE-2026-116506 | TOTOLINK A950RG 4.1.2cu.5268_B20221104 | TOTOLINK A950RG firewall.so apmib_set command injection | CRITICAL 9.4 | 1.9 % | ||
| CVE-2026-116505 | TOTOLINK A950RG 4.1.2cu.5268_B20221104 | TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection | CRITICAL 9.4 | 2.7 % | ||
| CVE-2026-116504 | TOTOLINK A950RG 4.1.2cu.5268_B20221104 | TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection | CRITICAL 9.4 | 1.5 % | ||
| CVE-2026-110720 | HashiCorp Tooling 0.42.0 – < 2.0.4 | Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules | CRITICAL 9.9 | 0.4 % | ||
| CVE-2026-10757 | Esri ArcGIS Server 11.1 – < 12.1 | BUG-000187511 - ArcGIS Server has a security vulnerability. | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-102649 | padok-team burrito < 0.13.0 | Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-115905 | zip-rs zip2 < 9.0.5 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Over… | CRITICAL 10.0 | 0.3 % | ||
| CVE-2026-112346 | OpenHands OpenHands Software Agent SDK < 1.52.0 | OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE | CRITICAL 9.3 | 1.0 % | ||
| CVE-2026-77055 | boneIO black_debian_images 1.2.0 – < 1.6.0 | Improper Privilege Assignment in boneIO | CRITICAL 9.3 | 0.1 % | ||
| CVE-2026-93328 | Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) 1.2.0 – < 1.5.0 | Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-65184 | Vertiv Avocent ACS8000 ≤ 2.32.4 | Avocent ACS8000 wsserver command injection | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-115693 | benoitc hackney 1.24.0 – < 4.9.0benoitc hackney d8a9afcf5c3849904274e2eba1df56c63d1a1a0c – < 915eb5737e9c489d8fc22eec8cdae30e9b027be4 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-107656 | Fortinet FortiSandbox 5.0.0 – 5.0.6 ; 4.4.0 – 4.4.9 ; 4.2.1 – 4.2.8Fortinet FortiSandbox PaaS 5.0.0 – 5.0.6 ; 4.4.0 – 4.4.9 ; 4.2.1 – 4.2.8 | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 t | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-59107 | WolfVision Cynap Pro, Cynap Core Pro < 1.78aWolfVision Cynap, Cynap Core | Shared SSH Authentication Key in vSolution Matrix File Sharing | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-59106 | WolfVision Cynap Pure (Next Gen), Cynap Bridge < 2.00cWolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro < 1.78a+2 more | Unauthenticated RCE Vulnerability in WolfProt interface implementation | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-116485 | huangxd- danmu_api < 1.21.7 | danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-116214 | maccmspro maccms10 ≤ 2021.1000.2000magicblack maccms10 < 2026.1000.4054 | MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-115188 | mautic/core 7.0.0 – < 7.2.2 | An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, t | CRITICAL 9.9 | 0.7 % | ||
| CVE-2026-110475 | CreditNirvana CreditNirvana Collections Platform (CollectionWorkz) All versions prior to 4.8.2 | Improper Authentication Vulnerability in CreditNirvana Collections Platform | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-116237 | Oray Pugongying X5 Pro 7.6.1 | Oray Pugongying X5 Pro Dnsmasq crlf injection | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-116235 | Oray Pugongying X5 Pro 7.6.1 | Oray Pugongying X5 Pro L2TP Authentication crlf injection | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-116234 | Oray Pugongying X5 Pro 7.6.1 | Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-116233 | Oray Pugongying X5 Pro 7.6.1 | Oray Pugongying X5 Pro Dnsmasq crlf injection | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-116232 | Oray Pugongying X5 Pro 7.6.1 | Oray Pugongying X5 Pro SNMP snmp_set crlf injection | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-116231 | Oray Pugongying X5 Pro 7.6.1 | Oray Pugongying X5 Pro Ser2net crlf injection | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-116116 | Yoosee GM8135S Camera 21.00.01.36 | Yoosee GM8135S Camera Secure Boot signature verification | CRITICAL 9.3 | 0.1 % | ||
| CVE-2026-107092 | — | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-116199 | grokability snipe-it < 8.6.3 | Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback | CRITICAL 9.2 | 0.3 % | ||
| CVE-2026-116163 | parse-community parse-server 9.0.0 – < 9.10.5-alpha.2parse-community parse-server < 8.6.102 | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-115214 | Unknown Datawiza Proxy Auth Plugin 1.1.0 – < 1.1.1 | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-115995 | Unitree Robotics Unitree Go2 1.1.11.0 ; 1.1.11.1 ; 1.1.11.2 ; … | Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection | CRITICAL 9.4 | 1.4 % | ||
| CVE-2026-114820 | Oracle Corporation Oracle Java SE 8u511-b32 ; 8u511-perf-b32 ; 11.0.33.0.2 ; …Oracle Corporation Oracle GraalVM for JDK 17.0.21.0.2 ; 21.0.13.0.2+1 more | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-115933 | GitroomHQ postiz-app 2.15.0 – < 2.25.3 | Forged signed tokens let any registered user take over other users and organizations | CRITICAL 9.9 | 0.2 % | ||
| CVE-2026-115557 | Python Software Foundation CPython < 3.11.18 ; 3.12.0 – < 3.12.16 ; 3.13.0 – < 3.13.18 ; … | Distrust compromised intermediate certificates in ssl module | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-115932 | GitroomHQ postiz-app 2.23.0 – < 2.25.3 | Path traversal in post media lets any registered user read server files | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-116014 | open62541 open62541 1.5.0 – < 1.5.7 | open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-114196 | paytiumsupport Paytium ≤ 5.0.5 | WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % |