Week 26, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.9
  CVE-2026-52806 Gogs: RCE via git rebase --exec argument injection in pull request merge

  Gogs · Gogs

  EPSS 7.9%
• Critical 9.9
  CVE-2026-56274 Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

  Flowise · Flowise · Flowise Components

  EPSS 7.5%
• Critical 9.2
  CVE-2026-54069 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

  siyuan-note · siyuan

  EPSS 7.5%
• Critical 9.8
  CVE-2025-71334 Flowise - Arbitrary File Access via Missing Chat Flow ID Validation

  Flowise · Flowise

  EPSS 4.4%
• Critical 10.0
  CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

  kestra-io · kestra

  EPSS 3.3%
• Critical 9.5
  CVE-2026-49468 LiteLLM: Authentication Bypass via Host Header Injection

  BerriAI · litellm

  EPSS 3%
• Critical 9.8
  CVE-2026-53753 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

  unclecode · Crawl4AI

  EPSS 2.9%
• Critical 9.1
  CVE-2026-12851 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

  GeoVision · GV-I/O Box 4E

  EPSS 2.7%
• Critical 9.1
  CVE-2026-12850 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

  GeoVision · GV-I/O Box 4E

  EPSS 2.7%
• Critical 9.1
  CVE-2026-12849 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

  GeoVision · GV-I/O Box 4E

  EPSS 2.7%
• Critical 9.1
  CVE-2026-12486 GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability

  GeoVision · GV-I/O Box 4E

  EPSS 2.7%
• Critical 9.0
  CVE-2026-11374 Account Takeover via Predictable SSO Ticket Generation

  Zohocorp · ManageEngine ADSelfService Plus · ManageEngine ADAudit Plus · manageengine_m365_manager_plus

  EPSS 2.5%
• Critical 10.0
  CVE-2026-49869 Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

  kestra-io · kestra

  EPSS 2.1%
• Critical 9.4
  CVE-2026-28496 FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

  FOSSBilling · FOSSBilling

  EPSS 1.9%
• Critical 9.0
  CVE-2026-54157 LobeHub: Unauthenticated SSRF in `/webapi/proxy`

  lobehub · lobehub

  EPSS 1.8%

All 176 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2026-9787 Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability

  Quest · NetVault Backup

  EPSS 5.5%
• High 8.8
  CVE-2026-50741 Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a dis…

  Revive · Adserver

  EPSS 4.9%
• Medium 5.9
  CVE-2026-54068 SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

  siyuan-note · siyuan

  EPSS 4.3%
• High 7.5
  CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all suppo…

  nodejs · node

  EPSS 3.7%
• High 7.7
  CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver a…

  nodejs · node

  EPSS 3.1%
• High 8.8
  CVE-2026-56766 Hydra - Stack Buffer Overflow in NTLM Authentication Handler

  vanhauser-thc · thc-hydra

  EPSS 2.4%
• High 8.8
  CVE-2026-32833 Cudy LT300 3.0 OS Command Injection via NTP Configuration

  Shenzhen Cudy Technology · LT300 3.0

  EPSS 2.4%
• High 7.2
  CVE-2026-9777 ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability

  ATEN · Unizon

  EPSS 2.2%