Week 6, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2026-21643 An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthentic…

  Fortinet · FortiClientEMS

  EPSS 98%
• Critical 9.9
  CVE-2026-1731 Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

  BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)

  EPSS 94%
• Critical 9.4
  CVE-2026-25512 Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

  Intermesh · groupoffice

  EPSS 20%
• Critical 9.8
  CVE-2026-22778 vLLM leaks a heap address when PIL throws an error

  vllm-project · vLLM

  EPSS 18%
• Critical 9.1
  CVE-2026-25137 NixOs Odoo database and filestore publicly accessible with default odoo configuration

  NixOS · nixpkgs

  EPSS 10%
• Critical 9.8
  CVE-2020-37125 Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution

  EDIMAX Technology · EW-7438RPn Mini

  EPSS 7%
• Critical 9.4
  CVE-2026-1709 Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

  EPSS 5.7%
• Critical 9.8
  CVE-2026-2017 IP-COM W30AP POST Request wx3auth R7WebsSecurityHandler stack-based overflow

  IP-COM · W30AP

  EPSS 4.8%
• Critical 10.0
  CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin

  SignalK · signalk-server

  EPSS 4.5%
• Critical 9.8
  CVE-2020-37123 Pinger 1.0 - Remote Code Execution

  wcchandler · Pinger

  EPSS 3.3%
• Critical 9.1
  CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

  blakeblackshear · frigate

  EPSS 3%
• Critical 10.0
  CVE-2026-25592 Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK

  Microsoft · semantic-kernel

  EPSS 2.5%
• Critical 9.8
  CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret
  EPSS 2.2%
• Critical 9.4
  CVE-2025-69212 OpenSTAManager has an OS Command Injection in P7M File Processing

  devcode-it · openstamanager

  EPSS 1.9%
• Critical 9.4
  CVE-2026-25049 n8n Has an Expression Escape Vulnerability Leading to RCE

  n8n-io · n8n

  EPSS 1.6%

All 120 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2026-0599 Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference

  huggingface · huggingface/text-generation-inference

  EPSS 29%
• Medium 4.7
  CVE-2026-2000 DCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injection

  DCN · DCME-320

  EPSS 19%
• Medium 6.3
  CVE-2026-2131 XixianLiang HarmonyOS-mcp-server input_text os command injection

  XixianLiang · HarmonyOS-mcp-server

  EPSS 17%
• Medium 5.4
  CVE-2026-1207 Potential SQL injection via raster lookups on PostGIS

  djangoproject · Django

  EPSS 13%
• High 7.2
  CVE-2026-2080 UTT HiPER 810 formUser setSysAdm command injection

  UTT · HiPER 810

  EPSS 11%
• High 7.3
  CVE-2026-2184 Great Developers Certificate Generation System csv.php os command injection

  Great Developers · Certificate Generation System

  EPSS 11%
• High 7.2
  CVE-2026-2085 D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection

  D-Link · DWR-M921

  EPSS 11%
• High 7.2
  CVE-2026-2182 UTT 进取 521G setSysAdm doSystem command injection

  UTT · 进取 521G

  EPSS 9.6%