Week 28, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

  rsjoomla.com · rsjoomla.com RSFiles extension for Joomla

  EPSS 17%
• Critical 10.0
  CVE-2026-61447 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent

  MervinPraison · PraisonAI

  EPSS 15%
• Critical 10.0
  CVE-2026-56291 Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

  balbooa.com · balbooa.com Balbooa Forms extension for Joomla

  EPSS 15%
• Critical 9.8
  CVE-2026-15511 Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection

  Comfast · CF-WR631AX V3

  EPSS 4.7%
• Critical 9.8
  CVE-2026-58123 Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

  nesquena · hermes-webui

  EPSS 4.6%
• Critical 9.9
  CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results

  metabase · metabase

  EPSS 3.8%
• Critical 9.8
  CVE-2026-58480 Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

  Creative Themes · Blocksy Companion

  EPSS 3.6%
• Critical 9.8
  CVE-2026-14894 Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

  WebRehab · Super Forms – Drag & Drop Form Builder

  EPSS 3.5%
• Critical 10.0
  CVE-2026-59726 Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

  ruvnet · ruflo

  EPSS 3%
• Critical 9.9
  CVE-2026-34038 Coolify authenticated remote command injection leading to RCE and secret exfiltration

  coollabsio · coolify

  EPSS 2.5%
• Critical 9.1
  CVE-2026-40047 Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

  Apache Software Foundation · Apache Camel

  EPSS 2.4%
• Critical 9.8
  CVE-2026-61459 MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

  Flux159 · mcp-server-kubernetes

  EPSS 2.4%
• Critical 9.8
  CVE-2026-10768 LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

  Drupal · LocalGov Workflows

  EPSS 2.1%
• Critical 9.8
  CVE-2026-59800 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint

  decolua · 9Router

  EPSS 2.1%
• Critical 9.1
  CVE-2026-56688 Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vuln…

  Dell · PowerFlex Manager

  EPSS 2%

All 145 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.3
  CVE-2026-43825 Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel

  Apache Software Foundation · Apache OpenNLP :: Core :: ML :: LibSVM

  EPSS 14%
• High 7.2
  CVE-2026-3576 Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter

  xtreeme · Planyo online reservation system

  EPSS 8.8%
• High 8.6
  CVE-2026-55638 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

  decolua · 9Router

  EPSS 6.6%
• Medium 6.5
  CVE-2026-61450 Grav before 2.0.2 Config Exfiltration via offsetGet Filter

  getgrav · grav

  EPSS 5.4%
• High 8.8
  CVE-2026-60102 Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver

  horde · Vfs

  EPSS 3.3%
• High 8.8
  CVE-2025-30007 HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

  hestiacp · hestiacp

  EPSS 3.2%
• High 8.8
  CVE-2026-15481 Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection

  Trendnet · TEW-635BRM

  EPSS 2.9%
• High 7.8
  CVE-2026-58459 gpsd gpsprof Command Injection via gnuplot plot title subtype field

  NTPsec · gpsd

  EPSS 2.9%