Week 18, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2026-41940 WebPros cPanel and WHM Authentication Bypass via Login Flow

  WebPros · cPanel · WP Squared · WHM

  EPSS 99%
• Critical 9.8
  CVE-2026-7567 Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

  elemntor · Temporary Login

  EPSS 9.2%
• Critical 10.0
  CVE-2026-33453 Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution

  Apache Software Foundation · Apache Camel

  EPSS 9.2%
• Critical 9.8
  CVE-2025-71284 Synway SMG Gateway Management Software OS Command Injection via radius_address

  Synway Information Engineering · Synway SMG Gateway Management Software

  EPSS 5.7%
• Critical 9.8
  CVE-2026-4670 Improper Authentication vulnerability in Progress MOVEit Automation

  Progress Software · MOVEit Automation

  EPSS 5%
• Critical 9.8
  CVE-2026-7242 Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection

  Totolink · A8000RU

  EPSS 2.5%
• Critical 9.8
  CVE-2026-7243 Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection

  Totolink · A8000RU

  EPSS 2.4%
• Critical 9.8
  CVE-2026-7241 Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection

  Totolink · A8000RU

  EPSS 2.4%
• Critical 9.8
  CVE-2026-7204 Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection

  Totolink · A8000RU

  EPSS 2.4%
• Critical 9.8
  CVE-2026-7203 Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection

  Totolink · A8000RU

  EPSS 2.4%
• Critical 9.8
  CVE-2026-7202 Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection

  Totolink · A8000RU

  EPSS 2.4%
• Critical 9.8
  CVE-2026-7240 Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection

  Totolink · A8000RU

  EPSS 2.4%
• Critical 9.8
  CVE-2026-7244 Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection

  Totolink · A8000RU

  EPSS 2.4%
• Critical 9.8
  CVE-2026-7248 D-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflow

  D-Link · DI-8100

  EPSS 2.2%
• Critical 9.9
  CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, c…

  Apache Software Foundation · Apache Camel Google PubSub · Apache Camel CoAP · Apache Camel JMS

  EPSS 2.1%

All 85 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.1
  CVE-2026-27760 OpenCATS PHP Code Injection via installer AJAX endpoint

  OpenCATS · OpenCATS

  EPSS 33%
• High 8.1
  CVE-2026-42167 mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an…

  ProFTPD · ProFTPD

  EPSS 7.4%
• Medium 5.5
  CVE-2026-7608 TRENDnet TEW-821DAP tools_diagnostic os command injection

  Trendnet · TEW-821DAP

  EPSS 5.7%
• Medium 6.3
  CVE-2026-7690 Wavlink WL-WN570HA1 adm.cgi set_sys_adm command injection

  WAVLINK · WL-WN570HA1

  EPSS 5.5%
• Medium 6.3
  CVE-2026-7609 TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection

  Trendnet · TEW-821DAP

  EPSS 4.5%
• High 8.8
  CVE-2026-7096 Tenda HG3 formgponConf os command injection

  Tenda · HG3

  EPSS 4.1%
• Medium 6.3
  CVE-2026-7692 Wavlink WL-WN570HA1 adm.cgi ping_ddns command injection

  WAVLINK · WL-WN570HA1

  EPSS 3.5%
• Medium 6.3
  CVE-2026-7691 Wavlink WL-WN570HA1 adm.cgi set_sys_cmd command injection

  WAVLINK · WL-WN570HA1

  EPSS 3.5%