Week 1, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-52691 Upload Arbitrary Files

  SmarterTools · SmarterMail

  EPSS 86%
• Critical 9.8
  CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass

  rustfs · rustfs

  EPSS 32%
• Critical 9.7
  CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

  SignalK · signalk-server

  EPSS 20%
• Critical 9.8
  CVE-2025-68706 A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handle…
  EPSS 5%
• Critical 9.8
  CVE-2025-15255 Tenda W6-S R7websSsecurityHandler httpd stack-based overflow

  Tenda · W6-S

  EPSS 4.7%
• Critical 9.8
  CVE-2022-50794 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username

  SOUND4 · Kantar Media · Impact/Pulse Eco · BigVoice2

  EPSS 3.7%
• Critical 9.8
  CVE-2025-14998 Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover

  wpmudev · Branda – White Label & Branding, Free Login Page Customizer

  EPSS 1.9%
• Critical 9.8
  CVE-2022-50796 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

  SOUND4 · Kantar Media · BigVoice4 · Stream

  EPSS 1.6%
• Critical 9.8
  CVE-2022-50691 MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh

  MiniDVBLinux · MiniDVBLinux

  EPSS 1.4%
• Critical 9.8
  CVE-2025-15194 D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow

  D-Link · DIR-600

  EPSS 1.2%
• Critical 9.8
  CVE-2025-66848 JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER…
  EPSS 1.1%
• Critical 9.2
  CVE-2026-21440 AdonisJS Path Traversal in Multipart File Handling

  adonisjs · core

  EPSS 1%
• Critical 9.4
  CVE-2025-64120 Nuvation Energy Multi-Stack Controller OS Command Injection

  Nuvation Energy · Multi-Stack Controller (MSC)

  EPSS 1%
• Critical 9.8
  CVE-2022-50694 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x SQL Injection via Username Parameter

  SOUND4 · Kantar Media · Impact/Pulse Eco · BigVoice2

• Critical 9.1
  CVE-2025-69288 Titra has Remote Code Execution in Admin Functionality

  kromitgmbh · titra

All 54 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2026-21445 Langflow Missing Authentication on Critical API Endpoints

  langflow-ai · langflow

  EPSS 33%
• High 8.1
  CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation

  Apache Software Foundation · Apache StreamPipes

  EPSS 15%
• High 7.3
  CVE-2025-15257 Edimax BR-6208AC Web-based Configuration formRoute command injection

  Edimax · BR-6208AC

  EPSS 5.1%
• Medium 5.3
  CVE-2025-15229 Tenda CH22 DhcpListClient fromDhcpListClient denial of service

  Tenda · CH22

  EPSS 4.6%
• Medium 6.3
  CVE-2025-15357 D-Link DI-7400G+ msp_info.htm command injection

  D-Link · DI-7400G+

  EPSS 4.6%
• High 7.8
  CVE-2022-50789 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.php

  SOUND4 · Kantar Media · BigVoice2 · Impact/Pulse/First

  EPSS 4.2%
• Medium 6.3
  CVE-2025-15391 D-Link DIR-806A SSDP Request ssdpcgi_main command injection

  D-Link · DIR-806A

  EPSS 4.2%
• High 7.8
  CVE-2022-50795 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php

  SOUND4 · Kantar Media · BigVoice4 · Stream

  EPSS 4.2%