Week 13, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.3
  CVE-2026-3055 Insufficient input validation leading to memory overread

  NetScaler · ADC · Gateway

  EPSS 91%
• Critical 9.4
  CVE-2026-33634 Trivy ecosystem supply chain briefly compromised

  BerriAI · aquasecurity · team-telnyx · litellm

  EPSS 60%
• Critical 9.1
  CVE-2026-33340 LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint

  parisneo · lollms-webui

  EPSS 22%
• Critical 10.0
  CVE-2026-33309 Langflow has an Arbitrary File Write (RCE) via v2 API

  langflow-ai · langflow

  EPSS 13%
• Critical 10.0
  CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

  WWBN · AVideo

  EPSS 13%
• Critical 9.2
  CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling

  squid-cache · squid

  EPSS 9.1%
• Critical 9.8
  CVE-2026-4585 Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection

  Tiandy · Easy7 Integrated Management Platform

  EPSS 4.5%
• Critical 9.8
  CVE-2026-4567 Tenda A15 UploadCfg stack-based overflow

  Tenda · A15

  EPSS 3.8%
• Critical 9.1
  CVE-2026-33475 Langflow GitHub Actions Shell Injection

  langflow-ai · langflow

  EPSS 3.2%
• Critical 9.8
  CVE-2026-26831 textract is vulnerable to OS Command Injection
  EPSS 2.5%
• Critical 9.8
  CVE-2026-26830 pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter
  EPSS 2.5%
• Critical 9.8
  CVE-2026-26833 thumbler allows OS Command Injection
  EPSS 2.4%
• Critical 10.0
  CVE-2026-30302 The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The …
  EPSS 2.1%
• Critical 9.1
  CVE-2026-27876 RCE on Grafana via sqlExpressions

  Grafana · Grafana

  EPSS 2%
• Critical 9.8
  CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion

  handlebars-lang · handlebars.js

  EPSS 1.9%

All 177 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2026-5027 Langflow - Path Traversal Arbitrary File Write via upload_user_file

  langflow-ai · langflow

  EPSS 40%
• High 8.2
  CVE-2026-27654 NGINX ngx_http_dav_module vulnerability

  F5 · NGINX Plus · NGINX Open Source

  EPSS 26%
• High 8.7
  CVE-2026-33497 Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

  langflow-ai · langflow

  EPSS 20%
• High 8.8
  CVE-2026-4840 Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection

  Netcore · Power 15AX

  EPSS 11%
• High 8.7
  CVE-2026-32748 Squid has Denial of Service in ICP Response handling

  squid-cache · squid

  EPSS 9.1%
• High 7.5
  CVE-2026-33484 Langflow has Unauthenticated IDOR on Image Downloads

  langflow-ai · langflow

  EPSS 5.9%
• High 8.8
  CVE-2026-4903 Tenda AC5 POST Request QuickIndex formQuickIndex memory corruption

  Tenda · AC5

  EPSS 5.7%
• Medium 6.3
  CVE-2026-32854 LibVNCServer httpd proxy NULL Pointer Dereference

  LibVNC · libvncserver

  EPSS 5.4%