Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Latest critical vulnerabilities

Published CVEs whose headline CVSS score — from the CNA or from NVD — is 9.0 or more, newest first.

Updated : CVE List (cvelistV5) : NVD (fkie-cad mirror) :

CVELibrary / product — vulnerable versionsTitleSeverityPublishedEPSSExploitation
CVE-2026-61730socfortress CoPilot < 0.1.77SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static MountCRITICAL 9.3
CVE-2026-61729socfortress CoPilot < 0.1.76SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert InjectionCRITICAL 9.4
CVE-2026-61728socfortress CoPilot < 0.1.76SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeoverCRITICAL 9.9
CVE-2026-112905givanz Vvveb < 1.0.8.7Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token TheftCRITICAL 9.0
CVE-2026-110799givanz Vvveb < 1.0.8.7Vvveb: Authentication Bypass via PHP Array Injection leading to full Account TakeoverCRITICAL 9.8
CVE-2026-119660yincongcyincong MuseBot < 2.0.0MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session KeyCRITICAL 9.3
CVE-2026-119597AIDotNet OpenDeepWiki ≤ 2.0.6OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token ForgeryCRITICAL 9.3
CVE-2026-119568vsftpd vsftpd ≤ 3.0.5vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel HijackingCRITICAL 9.1
CVE-2026-119419cakephp cakephp ≤ 5.4.3CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression CollationCRITICAL 9.2
CVE-2026-119418cakephp cakephp ≤ 5.4.3CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()CRITICAL 9.2
CVE-2026-116366ClickHouse ClickHouse 26.3 – < 26.3.62.3-lts ; 26.8 – < 26.8.36.3-lts ; 26.9 – < 26.9.27.3-stable ; …Unauthenticated RCE vulnerability against ClickHouse ServerCRITICAL 9.5
CVE-2025-31704Dahua Intelligent Connection Center V1.000.0000000.1 – 1.000.0000005.0 ; V5.000.0000000.6 – < V5.000.0000000.15Dahua Intelligent Connection Center command injectionCRITICAL 9.8
CVE-2026-82104Teltonika Networks RUT 7.22 – 7.24.2
Teltonika Networks RUTX 7.22 – 7.24.2
+3 more		API permission bypass via logic bugCRITICAL 9.4
CVE-2026-103039Gravity Forms Gravity Forms ≤ 3.1.2Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom FieldCRITICAL 9.8
CVE-2026-119263Google Chrome 156.0.8078.79 – < 156.0.8078.79Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary coCRITICAL 9.6
CVE-2026-119261Google Chrome 156.0.8078.79 – < 156.0.8078.79Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code ouCRITICAL 9.6
CVE-2023-22793Veeam Management Pack for Microsoft System Center 9.0 – < 13.1.0.334A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization ExteCRITICAL 9.3
CVE-2026-61707socfortress CoPilot < 0.1.76SOCFortress CoPilot: Stored case-report template injection permits backend code executionCRITICAL 9.0
CVE-2026-61645docat-org docat < 1.6.0Docat has Arbitrary File Upload exists in Upload APICRITICAL 9.1
CVE-2026-103093ServiceNow ServiceNow AI Platform < Yokohama Patch 13 Hot Fix 4a ; < Zurich Patch 10 Hot Fix 3b ; < Zurich Patch 12 ; …Sandbox Escape via Table Rotation in ServiceNow AI PlatformCRITICAL 9.4
CVE-2026-118769randombit botan >= 2.1.0, < 3.13.0Botan: Integer overflow when reporting block size in FFI can cause memory corruptionCRITICAL 9.2
CVE-2026-118762monkeytypegame monkeytype < 26.43.0Monkeytype: fork PR can execute code with elevated GITHUB_TOKENCRITICAL 9.3
CVE-2026-119145frappe frappe 16.0.0 – < 16.34.0
frappe frappe < 15.121.0		Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File UploadCRITICAL 9.4
CVE-2026-119128zitadel zitadel 4.0.0 – < 4.19.5ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck CookieCRITICAL 9.1
CVE-2026-90868Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4OS Command Injection in Progress WS_FTP ServerCRITICAL 9.9
CVE-2026-90866Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4Virtual Folder Path Confinement Bypass in Progress WS_FTP ServerCRITICAL 9.1
CVE-2026-90865Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4Command Injection via FTP Notification Variables in Progress WS_FTP ServerCRITICAL 9.0
CVE-2026-90864Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4Host Administrator Path Containment Bypass in Progress WS_FTP ServerCRITICAL 9.1
CVE-2026-90863Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4Privilege Escalation via Missing Authorization in WS_FTP ManagerCRITICAL 9.1
CVE-2026-84295Progress Software WS_FTP Server < 2024.0.6 ; < 2025.0.3Improper Authentication in Progress WS_FTP ServerCRITICAL 10.0
CVE-2026-111732RT-Labs P-Net < 1.0.3Out-of-bounds write when parsing AR Vendor Block requestsCRITICAL 9.3
CVE-2026-112256OpenText Advanced Authentication Server 6.4.0.0 – 6.4.3.8 ; 6.5.0.0 – 6.5.0.10 ; 6.6.0.0 – 6.6.1.0Logon bypass (trust of attacker-controlled completed-methods list)CRITICAL 9.2
CVE-2026-62131Zoho Flow Zoho Flow n/a – 2.14.5WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62018ThemeREX Gunslinger n/a – 1.11WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62017ThemeREX Good Homes n/a – 1.3.13WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62016ThemeREX Gamic n/a – 1.19WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62015ThemeREX Gamezone n/a – 1.1.11WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62014ThemeREX EmojiNation n/a – 1.0.12WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62013ThemeREX Edge Decor n/a – 2.9WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62012ThemeREX Coinpress n/a – 1.0.15WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62011ThemeREX Bonbon n/a – 1.11WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62010ThemeREX Avventure n/a – 1.1.12WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62009ThemeREX Filmax n/a – 1.1.11WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62008ThemeREX Orpheus n/a – 1.8WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62006ThemeREX Nuts n/a – 1.12WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62005ThemeREX Muzicon n/a – 1.15WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62004ThemeREX Motorix n/a – 1.11WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62003ThemeREX Mission n/a – 1.22WordPress Mission theme <= 1.22 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62002ThemeREX Meals & Wheels n/a – 1.1.13WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-62001ThemeREX Marcell n/a – 1.2.14WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-61998ThemeREX Le Truffe n/a – 1.1.7WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-61997ThemeREX Legal Stone n/a – 1.2.11WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-61992Von Eyal Fitoussi GEO my WordPress n/a – 4.5.5.3WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-61991Ajax Load More AjaxLoadMore Cache n/a – 3.1.1WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerabilityCRITICAL 10.0
CVE-2026-54860ThemeREX Ozisti n/a – 1.1.10WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-54859ThemeREX Preservation n/a – 1.15WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-54858ThemeREX Printy n/a – 1.13.0WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-54857ThemeREX Quirky n/a – 1.23WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-54856ThemeREX RexCoin n/a – 1.2.6WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerabilityCRITICAL 9.8
CVE-2026-93680IBM Langflow OSS 1.0.0 – 1.12.8Langflow OSS is affected by multiple vulnerabilitiesCRITICAL 9.8
CVE-2026-104339IBM Langflow OSS 1.0.0 – 1.12.3Langflow OSS is affected by multiple vulnerabilitiesCRITICAL 9.8
CVE-2026-107327IBM Langflow OSS 1.0.0 – 1.12.4Langflow OSS is affected by multiple vulnerabilitiesCRITICAL 9.9
CVE-2026-107328IBM Langflow OSS 1.0.0 – 1.12.4Langflow OSS is affected by multiple vulnerabilitiesCRITICAL 9.9
CVE-2026-107329IBM Langflow OSS 1.0.0 – 1.12.4Langflow OSS is affected by multiple vulnerabilitiesCRITICAL 9.9
CVE-2026-110186IBM Langflow OSS 1.0.0 – 1.12.8Langflow OSS is affected by multiple vulnerabilitiesCRITICAL 9.8
CVE-2026-119050agno-agi agno ≤ 3.1.11Agno through 3.1.11 Code Execution via PandasTools Unsafe ReflectionCRITICAL 9.2
CVE-2026-97854Yamaha Corporation NWR100 ≤ Rev.26.00.07Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may bCRITICAL 9.3
CVE-2026-115964StylemixThemes Motors ≤ 1.4.126WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerabilityCRITICAL 9.3
CVE-2026-114358Radius Synergies Radius Xenia M2M Platform VersionSQL Injection Vulnerability in Radius Xenia M2M PlatformCRITICAL 9.30.5 %
CVE-2026-115245Unknown Chat AI with Dispatcher < 2.4Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File UploadCRITICAL 9.80.2 %
CVE-2026-113617Unknown Automated Import Products to Cart < 1.0.4Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path TraversalCRITICAL 9.90.2 %
CVE-2026-113616Unknown LogixFast Auth < 1.0.4LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password ResetCRITICAL 9.80.1 %
CVE-2026-103693Unknown Frontend Dashboard < 3.0.5
Unknown ProfileGrid < 6.0.0.5		Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object InjectionCRITICAL 9.00.2 %
CVE-2026-109516guruteam Bot for Telegram on WooCommerce ≤ 1.3.0Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Fo…CRITICAL 9.80.6 %
CVE-2026-42922frangoteam Frangoteam 1.3.2-2809A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP requestCRITICAL 9.80.5 %
CVE-2026-66088Apereo Foundation openEQUELLA < 2026.1Unrestricted Command Execution via system.executeCRITICAL 9.40.7 %
CVE-2026-107058—An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service CRITICAL 9.8
CVE-2026-107032—Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, lCRITICAL 9.1
CVE-2026-107015—Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note datCRITICAL 9.1
CVE-2026-118579D-Link DIR-505 1.10B02D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoorCRITICAL 9.30.8 %
CVE-2026-61567WWBN AVideo-Encoder < 8.1.0AVideo-Encoder: unauthenticated command execution through streamer login trustCRITICAL 10.00.5 %
CVE-2026-61564WWBN AVideo-Encoder < 8.1.0AVideo-Encoder: unauthenticated installer PHP code injectionCRITICAL 10.00.5 %
CVE-2026-118690SignalK signalk-server < 2.33.0Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogsCRITICAL 9.30.7 %
CVE-2026-117574Red Hat Red Hat OpenShift AI (RHOAI)
Red Hat Red Hat OpenShift AI (RHOAI)		Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-proc…CRITICAL 9.10.2 %
CVE-2026-63190fearlessgeekmedia FearlessCMS < 0.1.4FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSSCRITICAL 9.40.5 %
CVE-2026-118264github.com/labstack/echo/v4 Go 4.0.0 – < 4.16.1
github.com/labstack/echo/v5 Go 5.0.0 – < 5.4.1		Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsCRITICAL 9.10.4 %
CVE-2026-118633Sophos SG UTM ≤ 9.724A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) afterCRITICAL 9.20.6 %
CVE-2026-103409Juniper Networks Session Smart Router < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessedCRITICAL 9.80.3 %
CVE-2026-103406Juniper Networks Session Smart Conductor < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.CRITICAL 9.80.5 %
CVE-2026-44179com.xwiki.pro/xwiki-pro-macros Maven 1.13 – < 1.14.5XWiki Pro Macros: excerpt-include title and content injection executes codeCRITICAL 9.90.7 %
CVE-2026-115968Ultimate Member Ultimate Member ≤ 2.13.1WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerabilityCRITICAL 9.80.4 %
CVE-2026-105420Wing Soft Technology Wing FTP Server < 8.2.6Path Traversal in Wing WFTP Server leading to Remote Code ExecutionCRITICAL 9.40.5 %
CVE-2026-111411Aman FunnelKit Automations ≤ 3.8.5.2WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerabilityCRITICAL 9.30.3 %
CVE-2026-115607Crowd Favorite DXP ToolKit ≤ 2.0.1WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerabilityCRITICAL 9.30.2 %
CVE-2026-115904topluyo App < 2026.9.2410Topluyo Desktop for Linux has an OS Command Injection issueCRITICAL 9.60.7 %
CVE-2026-67074HCL Software BigFix AEX v13.0.0.1HCL BigFix AEX is affected by multiple security vulnerabilities.CRITICAL 9.10.5 %
CVE-2026-114278Eclipse Foundation Eclipse Che 7.0.0 – 7.122.0Unauthenticated Command Injection via kubeconfig Username in che-machine-execCRITICAL 9.80.9 %
CVE-2026-103792Dell PowerProtect Data Domain Management Center < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; …Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1CRITICAL 9.60.4 %
CVE-2026-103799Dell PowerProtect Data Domain Management Center < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; …Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1CRITICAL 9.60.3 %
CVE-2026-112197Tactis NoviGest Desktop App NoviGest Desktop App prior to version 8.0.0-300Missing Authentication for Critical Function in Tactis' NoviGest Desktop AppCRITICAL 9.40.4 %