Week 15, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.3
  CVE-2026-39987 marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

  marimo-team · marimo

  EPSS 100%
• Critical 9.8
  CVE-2026-0740 Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

  SaturdayDrive · Ninja Forms - File Uploads

  EPSS 63%
• Critical 9.8
  CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

  Weaver Network · E-cology

  EPSS 21%
• Critical 9.8
  CVE-2026-5854 Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection

  Totolink · A7100RU

  EPSS 17%
• Critical 9.8
  CVE-2026-4631 Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 15%
• Critical 9.8
  CVE-2026-5850 Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection

  Totolink · A7100RU

  EPSS 15%
• Critical 9.8
  CVE-2026-5853 Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection

  Totolink · A7100RU

  EPSS 14%
• Critical 9.8
  CVE-2026-5852 Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection

  Totolink · A7100RU

  EPSS 14%
• Critical 9.8
  CVE-2026-5851 Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection

  Totolink · A7100RU

  EPSS 14%
• Critical 9.9
  CVE-2026-23696 Windmill < 1.603.3 File Ownership Handling SQLi RCE

  windmill-labs · Windmill EE (Enterprise Edition) · Windmill CE (Community Edition)

  EPSS 14%
• Critical 9.1
  CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation

  glpi-project · glpi

  EPSS 12%
• Critical 9.3
  CVE-2026-33439 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

  OpenIdentityPlatform · OpenAM

  EPSS 9.3%
• Critical 9.8
  CVE-2026-1830 Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload

  davidfcarr · Quick Playground

  EPSS 8.1%
• Critical 9.8
  CVE-2021-4473 Tianxin Internet Behavior Management System Command Injection via toQuery.php

  Beijing Topsec Network Security Technology · Tianxin Internet Behavior Management System

  EPSS 6.3%
• Critical 9.8
  CVE-2026-3296 Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata

  WPEverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

  EPSS 3.6%

All 167 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2026-34486 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

  Apache Software Foundation · Apache Tomcat

  EPSS 99%
• High 8.8
  CVE-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

  Apache Software Foundation · Apache ActiveMQ · Apache ActiveMQ All · Apache ActiveMQ Broker

  EPSS 98%
• High 8.7
  CVE-2026-35029 LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

  BerriAI · litellm

  EPSS 39%
• High 8.8
  CVE-2026-40217 LiteLLM has a sandbox escape in custom-code guardrail

  BerriAI · litellm

  EPSS 17%
• High 7.2
  CVE-2026-22666 Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

  Dolibarr · Dolibarr ERP/CRM

  EPSS 16%
• High 7.5
  CVE-2026-29146 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

  Apache Software Foundation · Apache Tomcat

  EPSS 8.9%
• High 8.1
  CVE-2026-26263 GLPI has an Unauthenticated SQL Injection via Search engine

  glpi-project · glpi

  EPSS 8.4%
• High 8.6
  CVE-2026-34621 Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

  Adobe · Acrobat 2024 · Acrobat Reader DC · Acrobat DC

  EPSS 7.3%