Week 2, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-21858 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

  n8n-io · n8n

  EPSS 78%
• Critical 9.8
  CVE-2025-70161 EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() f…
  EPSS 27%
• Critical 9.3
  CVE-2026-21876 OWASP CRS has multipart bypass using multiple content-type parts

  coreruleset · coreruleset

  EPSS 17%
• Critical 9.1
  CVE-2025-61686 React Router has Path Traversal in File Session Storage

  remix-run · react-router

  EPSS 17%
• Critical 9.8
  CVE-2025-15471 TRENDnet TEW-713RE formFSrvX os command injection

  Trendnet · TEW-713RE

  EPSS 14%
• Critical 9.8
  CVE-2025-15029 An unauthenticated user is able to introduce SQL Injection using the Awie export module

  Centreon · Infra Monitoring

  EPSS 13%
• Critical 9.8
  CVE-2017-20216 FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection

  FLIR Systems · FLIR Thermal Camera PT-Series

  EPSS 12%
• Critical 9.8
  CVE-2025-69542 A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal pro…
  EPSS 9.7%
• Critical 9.8
  CVE-2025-15501 Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection

  Sangfor · Operation and Maintenance Management System

  EPSS 6.9%
• Critical 9.8
  CVE-2025-15500 Sangfor Operation and Maintenance Management System HTTP POST Request getHis os command injection

  Sangfor · Operation and Maintenance Management System

  EPSS 6.1%
• Critical 9.8
  CVE-2025-14346 WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with th…

  WHILL · Model F Power Chair · Model C2 Electric Wheelchair

  EPSS 5.6%
• Critical 10.0
  CVE-2026-21877 n8n is vulnerable to Remote Code Execution via Arbitrary File Write

  n8n-io · n8n

  EPSS 5.4%
• Critical 9.8
  CVE-2025-65212 An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification,…
  EPSS 5.4%
• Critical 9.1
  CVE-2025-69222 LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions

  danny-avila · LibreChat

  EPSS 4.6%
• Critical 9.8
  CVE-2025-69258 A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executab…

  Trend Micro · Trend Micro Apex Central

  EPSS 3.6%

All 98 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.1
  CVE-2025-68493 Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

  Apache Software Foundation · Apache Struts

  EPSS 50%
• High 7.2
  CVE-2025-5965 RCE via the backup feature available only to user with high privilege

  Centreon · Infra Monitoring

  EPSS 28%
• High 7.2
  CVE-2025-15472 TRENDnet TEW-811DRU httpd  uapply.cgi setDeviceURL  os command injection

  Trendnet · TEW-811DRU

  EPSS 22%
• High 8.8
  CVE-2026-0628 Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extensi…

  Google · Chrome

  EPSS 21%
• High 7.2
  CVE-2025-66376 Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM…

  Zimbra · Collaboration

  EPSS 20%
• High 8.8
  CVE-2017-20215 FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection

  FLIR Systems · FLIR Thermal Camera FC-S/PT

  EPSS 16%
• Medium 6.3
  CVE-2026-0732 D-Link DI-8200G upgrade_filter.asp command injection

  D-Link · DI-8200G

  EPSS 12%
• Medium 6.2
  CVE-2017-20212 FLIR Thermal Camera F/FC/PT/D 8.0.0.64 Information Disclosure via File Reading

  FLIR Systems · FLIR Thermal Camera F/FC/PT/D

  EPSS 9.5%