Week 20, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

  Cisco · Cisco Catalyst SD-WAN Manager · Cisco Catalyst SD-WAN Controller

  EPSS 92%
• Critical 9.8
  CVE-2026-41089 Windows Netlogon Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 78%
• Critical 9.8
  CVE-2026-8181 Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

  burstbv · Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative)

  EPSS 15%
• Critical 9.4
  CVE-2026-44262 Scramble: Remote code execution via evaluation of user-controlled input in validation rules

  dedoc · scramble

  EPSS 5.9%
• Critical 9.1
  CVE-2026-44194 OPNsense: RCE on user managment

  opnsense · core

  EPSS 5.7%
• Critical 9.1
  CVE-2026-41103 Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

  Microsoft · Microsoft JIRA SAML SSO plugin · Microsoft Confluence SAML SSO plugin

  EPSS 5.4%
• Critical 9.1
  CVE-2026-42607 Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

  getgrav · grav

  EPSS 4.4%
• Critical 9.6
  CVE-2026-42048 Langflow: Path Traversal in Langflow Knowledge Bases API

  langflow-ai · langflow

  EPSS 4.2%
• Critical 9.6
  CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

  TanStack · solid-start · vue-start · react-start

  EPSS 3.3%
• Critical 9.8
  CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection

  gotenberg · gotenberg

  EPSS 3%
• Critical 9.8
  CVE-2026-41096 Windows DNS Client Remote Code Execution Vulnerability

  Microsoft · Windows Server 2025 · Windows Server 2025 (Server Core installation) · Windows 11 Version 24H2

  EPSS 2.7%
• Critical 9.2
  CVE-2026-27886 Strapi may leak sensitive data via relational filtering due to lack of query sanitization

  strapi · strapi

  EPSS 1.9%
• Critical 9.3
  CVE-2026-44343 WGDashboard: Critical Vulnerability in 4.3.2

  WGDashboard · WGDashboard

  EPSS 1.8%
• Critical 9.8
  CVE-2026-46364 phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha

  thorsten · phpMyFAQ

  EPSS 1.7%
• Critical 9.8
  CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated

  Apache Software Foundation · Apache Tomcat

  EPSS 1.7%

All 164 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.8
  CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

  Palo Alto Networks · PAN-OS · Prisma Access · Cloud NGFW

  EPSS 96%
• High 7.8
  CVE-2026-43500 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

  Linux · Linux

  EPSS 94%
• High 8.1
  CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability

  Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 14 · Microsoft Exchange Server Subscription Edition RTM

  EPSS 71%
• High 8.1
  CVE-2026-42945 NGINX ngx_http_rewrite_module vulnerability

  F5 · NGINX Plus · NGINX Open Source

  EPSS 68%
• High 8.6
  CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades

  vercel · next.js

  EPSS 36%
• High 8.8
  CVE-2026-33112 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 31%
• High 7.5
  CVE-2026-34648 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

  Adobe · Adobe Commerce · Magento Open Source · Adobe Commerce B2B

  EPSS 21%
• High 8.6
  CVE-2026-2652 Authentication Bypass in mlflow/mlflow

  MLflow · mlflow/mlflow

  EPSS 21%