Week 22, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.0
  CVE-2026-4480 Samba: samba: remote code execution in printing subsystem via unescaped job description

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 6

  EPSS 29%
• Critical 9.8
  CVE-2026-45247 Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

  Mirasvit · Full Page Cache Warmer for Magento 2

  EPSS 26%
• Critical 9.8
  CVE-2026-8732 WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

  flippercode · WP Maps Pro

  EPSS 20%
• Critical 9.8
  CVE-2026-46817 Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15…

  Oracle · Oracle Payments

  EPSS 12%
• Critical 9.2
  CVE-2026-9312 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint

  GitHub · Enterprise Server

  EPSS 9.2%
• Critical 10.0
  CVE-2026-45087 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

  hahwul · dalfox

  EPSS 8.7%
• Critical 9.8
  CVE-2026-10187 Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

  Totolink · N300RH

  EPSS 7.3%
• Critical 9.8
  CVE-2025-12686 Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote …

  Synology · BeeStation OS

  EPSS 2.8%
• Critical 9.0
  CVE-2026-4408 Samba: remote code execution in samr

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 6

  EPSS 2.5%
• Critical 9.8
  CVE-2026-9543 Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection

  Totolink · N300RH

  EPSS 2.1%
• Critical 9.8
  CVE-2026-9458 Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection

  Totolink · A8000RU

  EPSS 2.1%
• Critical 9.8
  CVE-2026-9457 Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection

  Totolink · A8000RU

  EPSS 2.1%
• Critical 9.8
  CVE-2026-9436 Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection

  Totolink · A8000RU

  EPSS 2%
• Critical 9.8
  CVE-2026-9478 Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection

  Totolink · A8000RU

  EPSS 1.9%
• Critical 9.8
  CVE-2026-9477 Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection

  Totolink · A8000RU

  EPSS 1.9%

All 189 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.5
  CVE-2026-48710 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

  Kludex · starlette

  EPSS 70%
• High 7.1
  CVE-2026-49373 In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

  JetBrains · TeamCity

  EPSS 33%
• Medium 6.3
  CVE-2026-9440 Edimax BR-6478AC POST Request formAccept command injection

  Edimax · BR-6478AC

  EPSS 17%
• Medium 6.3
  CVE-2026-9441 Edimax BR-6478AC POST Request formiNICbasic command injection

  Edimax · BR-6478AC

  EPSS 15%
• High 8.6
  CVE-2026-35223 Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints

  Joomla! Project · Joomla! CMS

  EPSS 13%
• High 7.5
  CVE-2026-40383 Joomla! Core - [20260509] - LFI in HTMLView layout parameter

  Joomla! Project · Joomla! CMS

  EPSS 13%
• Medium 6.3
  CVE-2026-9514 Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection

  Totolink · CA750-PoE

  EPSS 10%
• Medium 6.3
  CVE-2026-9533 Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection

  Totolink · CA750-PoE

  EPSS 10%