Week 33, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-72898 Metabase SQL injection via password reset endpoint

  metabase · metabase

  EPSS 98%
• Critical 9.1
  CVE-2026-71362 Adobe Commerce | Incorrect Authorization (CWE-863)

  Adobe · Adobe Commerce · Adobe Commerce B2B · Magento Open Source

  EPSS 90%
• Critical 9.8
  CVE-2026-73034 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

  eosphoros-ai · DB-GPT

  EPSS 5.7%
• Critical 9.9
  CVE-2026-19681 Command Injection

  Tenable · Security Center

  EPSS 4.2%
• Critical 9.8
  CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

  Cozmoslabs · User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

  EPSS 3.9%
• Critical 9.4
  CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

  Microsoft · UFO

  EPSS 3.7%
• Critical 9.8
  CVE-2026-19598 Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

  sc0ttkclark · Pods – Custom Content Types and Fields

  EPSS 3.5%
• Critical 10.0
  CVE-2026-48362 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

  Adobe · ColdFusion 2025 · ColdFusion 2023

  EPSS 3.5%
• Critical 9.9
  CVE-2026-72867 Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose…

  Dokploy · dokploy

  EPSS 3.4%
• Critical 9.8
  CVE-2026-12571 Authentication Bypass Leading to Account Takeover

  Zohocorp · manageengine_ddi_central

  EPSS 3.3%
• Critical 9.8
  CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
  EPSS 3.2%
• Critical 9.8
  CVE-2026-19747 Tenda CH7 ATE Module Kylin HandleCmd command injection

  Tenda · CP3 · TC3B15C · CH7

  EPSS 3.1%
• Critical 10.0
  CVE-2026-19188 Haiwell IoT Cloud HMI Gateway OS Command Injection

  Haiwell · Haiwell IoT Cloud HMI Gateway

  EPSS 2.9%
• Critical 9.8
  CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

  Apache Software Foundation · Apache Ranger

  EPSS 2.6%
• Critical 9.9
  CVE-2026-72603 wg-easy wg-easy - OS Command Injection

  wg-easy · wg-easy

  EPSS 2.2%

All 443 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.9
  CVE-2026-73570 A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notificat…

  Zimbra · Collaboration

  EPSS 77%
• High 7.5
  CVE-2026-42018 Anonymous user token generation exposure in JFrog Artifactory

  jfrog · artifactory

  EPSS 10%
• High 8.8
  CVE-2026-65660 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 9.9%
• High 7.0
  CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 8.6%
• High 7.2
  CVE-2026-19771 Baicells EG3661M LuCI Web luci os command injection

  Baicells · EG3661M

  EPSS 3.7%
• High 8.8
  CVE-2026-71966 CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer

  usmannasir · cyberpanel

  EPSS 3.3%
• High 8.5
  CVE-2026-17179 IBM Db2 Mirror for i is affected by multiple vulnerabilities

  IBM · Db2 Mirror for i

  EPSS 3.1%
• High 8.8
  CVE-2026-11840 SQL Injection

  Zohocorp · ManageEngine Password Manager Pro · ManageEngine PAM360

  EPSS 3.1%