Week 14, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2026-35616 A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or co…

  Fortinet · FortiClientEMS

  EPSS 94%
• Critical 9.8
  CVE-2026-2699 EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

  Progress · ShareFile Storage Zones Controller

  EPSS 58%
• Critical 9.1
  CVE-2026-2701 RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)

  Progress · ShareFile Storage Zones Controller

  EPSS 55%
• Critical 9.8
  CVE-2026-4257 Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

  supsysticcom · Contact Form by Supsystic

  EPSS 41%
• Critical 9.8
  CVE-2026-29014 MetInfo CMS Unauthenticated PHP Code Injection RCE

  MetInfo CMS · MetInfo CMS

  EPSS 39%
• Critical 9.8
  CVE-2026-3300 Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

  WPEverest · Everest Forms Pro

  EPSS 39%
• Critical 9.8
  CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

  0xJacky · nginx-ui

  EPSS 35%
• Critical 10.0
  CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

  nocobase · nocobase

  EPSS 35%
• Critical 10.0
  CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

  MervinPraison · PraisonAI

  EPSS 13%
• Critical 9.1
  CVE-2026-35216 Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

  Budibase · budibase

  EPSS 11%
• Critical 9.1
  CVE-2026-0545 Missing Authentication for Critical Function in mlflow/mlflow

  MLflow · mlflow/mlflow

  EPSS 4.4%
• Critical 10.0
  CVE-2025-15379 Command Injection in mlflow/mlflow

  MLflow · mlflow/mlflow

  EPSS 2.4%
• Critical 9.1
  CVE-2026-21861 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

  baserproject · basercms

  EPSS 2.3%
• Critical 9.8
  CVE-2026-34243 wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`

  njzjz · wenxian

  EPSS 2.2%
• Critical 9.2
  CVE-2026-30880 baserCMS: OS command injection vulnerability in installer

  baserproject · basercms

  EPSS 2.1%

All 137 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2026-4020 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API

  Rocketgenius · Gravity SMTP

  EPSS 74%
• High 7.5
  CVE-2026-21710 A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses …

  nodejs · node

  EPSS 25%
• High 8.8
  CVE-2026-5281 Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi…

  Google · Chrome

  EPSS 14%
• Medium 6.3
  CVE-2026-5184 TRENDnet TEW-713RE setSysAdm command injection

  Trendnet · TEW-713RE

  EPSS 9.6%
• High 8.8
  CVE-2026-34040 Moby: AuthZ plugin bypass with oversized request body

  moby · moby

  EPSS 9.3%
• High 7.1
  CVE-2026-34472 Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local n…
  EPSS 9%
• Medium 6.3
  CVE-2026-5183 TRENDnet TEW-713RE addRouting sub_421494 command injection

  Trendnet · TEW-713RE

  EPSS 8.5%
• Medium 4.7
  CVE-2026-5339 Tenda G103 Setting gpon.lua action_set_net_settings command injection

  Tenda · G103

  EPSS 6.5%