Week 32, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-5430 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

  WSO2 · WSO2 API Manager · WSO2 API Control Plane · WSO2 Traffic Manager

  EPSS 22%
• Critical 9.8
  CVE-2026-15733 WGDashboard Remote Code Execution vulnerability

  WGDashboard · WGDashboard

  EPSS 10%
• Critical 9.8
  CVE-2026-18686 GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection

  GL.iNet · GL-MT3000

  EPSS 4.7%
• Critical 9.8
  CVE-2026-18612 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection

  GL.iNet · GL-MT3000

  EPSS 4%
• Critical 9.8
  CVE-2026-41452 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

  krayin · laravel-crm

  EPSS 3.7%
• Critical 9.8
  CVE-2026-18685 GL.iNet GL-MT3000 modem.so glc set_upgrade command injection

  GL.iNet · GL-MT3000

  EPSS 3.6%
• Critical 9.8
  CVE-2026-18684 GL.iNet GL-MT3000 modem.so glc remove_profile command injection

  GL.iNet · GL-MT3000

  EPSS 3.6%
• Critical 9.8
  CVE-2026-18616 GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

  GL.iNet · GL-MT3000

  EPSS 3.6%
• Critical 9.8
  CVE-2026-18615 GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection

  GL.iNet · GL-MT3000

  EPSS 3.6%
• Critical 9.8
  CVE-2026-18614 GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection

  GL.iNet · GL-MT3000

  EPSS 3.6%
• Critical 9.8
  CVE-2026-18602 GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection

  GL.iNet · GL-MT3000

  EPSS 3.6%
• Critical 9.8
  CVE-2026-18601 GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection

  GL.iNet · GL-MT3000

  EPSS 3.6%
• Critical 9.8
  CVE-2026-19348 Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection

  Shenzhen Aitemi · M300 Wi-Fi Repeater

  EPSS 3.6%
• Critical 9.8
  CVE-2026-71956 D-Link DWR-M961 Command Injection via app.cgi

  D-Link · DWR-M961

  EPSS 3.2%
• Critical 9.8
  CVE-2026-71955 D-Link DWR-M961 Command Injection via /boafrm/formWsc

  D-Link · DWR-M961

  EPSS 3.2%

All 287 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.0
  CVE-2026-18599 GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection

  GL.iNet · GL-MT3000

  EPSS 4.4%
• Medium 5.5
  CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

  Kirachon · context-engine

  EPSS 3.9%
• High 7.2
  CVE-2026-18902 H3C NX15 esps repeaterproc command injection

  H3C · NX15

  EPSS 3.8%
• High 7.2
  CVE-2026-18900 H3C NX15 Backend RPC esps file.exec os command injection

  H3C · NX15

  EPSS 3.8%
• High 7.2
  CVE-2026-18811 H3C NX15 esps add command injection

  H3C · NX15

  EPSS 3.6%
• High 7.2
  CVE-2026-18813 H3C NX15 esps delete command injection

  H3C · NX15

  EPSS 3.6%
• High 7.2
  CVE-2026-18812 H3C NX15 esps esps.ipv6.wan command injection

  H3C · NX15

  EPSS 3.6%
• High 7.2
  CVE-2026-18814 H3C NX15 esps reload.reload_config command injection

  H3C · NX15

  EPSS 3.6%