Week 19, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.3
  CVE-2026-42208 LiteLLM: SQL injection in Proxy API key verification

  BerriAI · litellm

  EPSS 89%
• Critical 9.1
  CVE-2026-36356 The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /actio…
  EPSS 20%
• Critical 9.6
  CVE-2026-44112 OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes

  OpenClaw · OpenClaw

  EPSS 7.3%
• Critical 9.1
  CVE-2024-51092 LibreNMS has an Authenticated OS Command Injection
  EPSS 7.2%
• Critical 9.8
  CVE-2026-27960 OpenCTI privilege escalation and unauthenticated access via default admin account

  OpenCTI-Platform · opencti

  EPSS 7.1%
• Critical 9.8
  CVE-2026-38360 dash-uploader has a directory traversal vulnerability
  EPSS 6%
• Critical 9.8
  CVE-2026-7854 D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow

  D-Link · DI-8100

  EPSS 5.9%
• Critical 9.3
  CVE-2026-41922 WDR201A WiFi Extender OS Command Injection via wireless.cgi

  Shenzhen Yipu Commercial and Trading · WDR201A WiFi Extender

  EPSS 5%
• Critical 9.3
  CVE-2026-41925 WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)

  Shenzhen Yipu Commercial and Trading · WDR201A WiFi Extender

  EPSS 4%
• Critical 10.0
  CVE-2026-7411 Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

  Eclipse Foundation · Eclipse BaSyx

  EPSS 3.7%
• Critical 9.3
  CVE-2026-41924 WDR201A WiFi Extender OS Command Injection via makeRequest.cgi

  Shenzhen Yipu Commercial and Trading · WDR201A WiFi Extender

  EPSS 3.2%
• Critical 9.3
  CVE-2026-41923 WDR201A WiFi Extender OS Command Injection via internet.cgi

  Shenzhen Yipu Commercial and Trading · WDR201A WiFi Extender

  EPSS 3.1%
• Critical 9.8
  CVE-2026-8153 Command injection in Dashboard Server interface

  Universal Robots · PolyScope 5

  EPSS 2.9%
• Critical 9.8
  CVE-2026-42796 Arelle < 2.39.10 Unauthenticated RCE via /rest/configure

  Arelle · Arelle

  EPSS 2.7%
• Critical 10.0
  CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

  gotenberg · gotenberg

  EPSS 2.3%

All 188 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2026-43284 xfrm: esp: avoid in-place decrypt on shared skb frags

  Linux · Linux

  EPSS 94%
• High 8.7
  CVE-2026-42271 LiteLLM: Authenticated command execution via MCP stdio test endpoints

  BerriAI · litellm

  EPSS 91%
• High 8.8
  CVE-2026-23918 Apache HTTP Server: http2: double free and possible RCE on early reset

  Apache Software Foundation · Apache HTTP Server

  EPSS 50%
• High 8.7
  CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

  Palo Alto Networks · PAN-OS · Prisma Access · Cloud NGFW

  EPSS 42%
• High 7.2
  CVE-2026-6973 An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to…

  ivanti · Endpoint Manager Mobile

  EPSS 34%
• High 7.3
  CVE-2026-44338 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

  MervinPraison · PraisonAI

  EPSS 33%
• High 7.5
  CVE-2026-34474 Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sen…
  EPSS 25%
• Medium 6.9
  CVE-2026-7864 Exposure of Sensitive Information to an Unauthorized Actor

  SEPPmail · Secure Email Gateway

  EPSS 16%