Week 30, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-8985 Unauthenticated Command Injection

  Autel · MaxiCharger Single

  EPSS 7.1%
• Critical 10.0
  CVE-2026-6516 Remote Code Execution

  Zohocorp · ManageEngine ADAudit Plus

  EPSS 4.7%
• Critical 10.0
  CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

  dbgate · dbgate

  EPSS 3.9%
• Critical 9.3
  CVE-2026-16232 Authentication Bypass in the SmartConsole Login Process Using an Application Token

  checkpoint · Quantum Security Management · Multi-Domain Security Management

  EPSS 3.5%
• Critical 9.5
  CVE-2026-8986 Command Injection via Malicious OCPP Server

  Autel · MaxiCharger Single

  EPSS 3.3%
• Critical 9.8
  CVE-2026-15015 MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

  cascadiawebservices · MountDev AI MCP Connector for WordPress

  EPSS 2.6%
• Critical 9.8
  CVE-2026-16766 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

  RRWO · Catalyst::View::Wkhtmltopdf

  EPSS 2.6%
• Critical 9.8
  CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

  getgrav · grav

  EPSS 2.5%
• Critical 9.9
  CVE-2026-64879 Command Injection

  Tenable · Security Center

  EPSS 2.3%
• Critical 9.8
  CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

  RVC-Boss · GPT-SoVITS

  EPSS 2.1%
• Critical 9.4
  CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

  freescout-help-desk · freescout

  EPSS 1.9%
• Critical 9.4
  CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

  dbgate · dbgate

  EPSS 1.8%
• Critical 9.9
  CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability

  Microsoft · Microsoft 365 Copilot

  EPSS 1.7%
• Critical 9.8
  CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

  h2oai · h2ogpt

  EPSS 1.5%
• Critical 9.8
  CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

  MervinPraison · PraisonAI

  EPSS 1.5%

All 454 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.5
  CVE-2026-16492 umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection

  umijs · umi

  EPSS 3.9%
• High 7.5
  CVE-2026-65694 Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

  microweber · microweber

  EPSS 3.4%
• High 7.5
  CVE-2026-16445 Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 3.2%
• High 8.1
  CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

  WPForms · WPForms Pro

  EPSS 2.5%
• High 8.8
  CVE-2026-64881 Command Injection

  Tenable · Security Center

  EPSS 2.2%
• Medium 4.7
  CVE-2026-28316 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

  SolarWinds · Serv-U

  EPSS 2.1%
• High 7.5
  CVE-2026-65919 Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

  meshery · meshery

  EPSS 2.1%
• High 7.2
  CVE-2026-65711 sysPass 3.2.11 Authenticated OS Command Injection via Backup Path

  nuxsmin · sysPass

  EPSS 2%