Week 31, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2026-63077 In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

  JetBrains · TeamCity

  EPSS 95%
• Critical 9.8
  CVE-2026-59310 vCenter directory-traversal vulnerability

  VMware · Cloud Foundation · Telco Cloud Platform · Telco Cloud Infrastructure

  EPSS 62%
• Critical 9.5
  CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

  rails · rails

  EPSS 33%
• Critical 9.9
  CVE-2026-48030 Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

  pheditor · pheditor

  EPSS 7.5%
• Critical 9.8
  CVE-2026-67208 Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

  somta · Juggle

  EPSS 7.2%
• Critical 9.8
  CVE-2026-61511 vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

  vBulletin · vBulletin

  EPSS 5.6%
• Critical 9.8
  CVE-2026-14483 Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

  Realtyna · Realtyna Organic IDX plugin + WPL Real Estate

  EPSS 4%
• Critical 9.8
  CVE-2026-18072 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogi…

  nico23 · Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …

  EPSS 3%
• Critical 9.8
  CVE-2026-38711 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover…
  EPSS 2.8%
• Critical 9.8
  CVE-2026-38713 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover…
  EPSS 2.8%
• Critical 9.8
  CVE-2026-38708 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover…
  EPSS 2.8%
• Critical 9.8
  CVE-2026-38709 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover…
  EPSS 2.8%
• Critical 9.8
  CVE-2026-12394 MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
  EPSS 2.1%
• Critical 10.0
  CVE-2026-16812 VeloCloud Orchestrator OS Command Injection

  Arista Networks · VeloCloud Orchestrator On-Prem

  EPSS 1.8%
• Critical 9.8
  CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

  Apache Software Foundation · Apache Axis2/Java

  EPSS 1.7%

All 312 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.3
  CVE-2026-20316 Cisco Secure Firewall Management Center Software Static Credential Vulnerability

  Cisco · Cisco Secure Firewall Management Center (FMC)

  EPSS 35%
• High 8.2
  CVE-2026-18577 Incomplete patch leads to administrative account takeover

  N-able · N-central

  EPSS 15%
• High 8.1
  CVE-2026-42016 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

  jfrog · artifactory

  EPSS 8.6%
• High 8.2
  CVE-2026-18556 Unauthenticated administrative account takeover

  N-able · N-central

  EPSS 7.9%
• High 8.6
  CVE-2026-43830 A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.

  Advantech · ADAM-3600

  EPSS 2.5%
• High 8.5
  CVE-2026-9044 Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75

  TP-Link Systems · AXE75 V1

  EPSS 2.5%
• High 7.2
  CVE-2026-38710 TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows atta…
  EPSS 2.3%
• High 8.8
  CVE-2026-67325 GitPython before 3.1.51 Command Injection via option prefix abbreviation

  gitpython-developers · GitPython

  EPSS 2.2%