By publication date

Exploited and new serious CVEs: November 2026

783 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 8

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2026-120189No exploit	A vulnerability was identified in D-Link DIR-505 1.10B02.CWE-119 Pre-auth Memory safety	Critical9.3	—	1.3%	4 days ago
38Monitor	CVE-2026-120195No exploit	WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injectionwavlink · wl-wn579a3-a · CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.0%	3 days ago
35Monitor	CVE-2026-120196No exploit	WAVLINK WN579X3-D wapi.cgi port_forward os command injectionwavlink · wn579x3-d · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
35Monitor	CVE-2026-120197No exploit	WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injectionwavlink · wl-wn530hg4b · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
38Monitor	CVE-2026-120198No exploit	WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injectionwavlink · wl-wn530be1-a · CWE-74 pre-auth RCE Command injection	Critical9.3	—	2.0%	3 days ago
8Monitor	CVE-2026-120218Proof of concept	Typemill SvgSanitizer.php saveImage cross site scriptingCWE-79 XSS	Low2.0	—	0.2%	3 days ago
0Monitor	CVE-2026-116296Proof of concept	Gitea archived repository release, milestone and label modificationgitea · gitea · CWE-862 Broken access control (IDOR)	—	—	0.2%	3 days ago
34Monitor	CVE-2026-120224No exploit	Oray Pugongying X5 Pro API Authorization run_async_task improper authorizationoray · pugongying x5 pro · CWE-266	High8.6	—	0.3%	3 days ago
34Monitor	CVE-2026-120225No exploit	Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversaloray · pugongying x5 pro · CWE-22 Path traversal	High8.5	—	0.7%	3 days ago
35Monitor	CVE-2026-120227No exploit	WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injectionwavlink · wn701ae · CWE-77 RCE Command injection	High8.6	—	2.2%	3 days ago
39Monitor	CVE-2026-120306No exploit	Beta9 build sandbox escape via chroot-only isolationbeam-cloud · beta9 worker · CWE-269	Critical9.9	—	0.3%	3 days ago
39Monitor	CVE-2026-120307No exploit	Beta9 container escape via unvalidated sandbox file pathsbeam-cloud · beta9 worker · CWE-22 Path traversal	Critical9.9	—	0.4%	3 days ago
39Monitor	CVE-2026-120308No exploit	Beta9 host filesystem exposure via volume path traversalbeam-cloud · beta9 gateway · CWE-22 Path traversal	Critical9.9	—	0.5%	3 days ago
34Monitor	CVE-2026-120228No exploit	WAVLINK WN553X1-B ioos Service sub_416D88 os command injectionwavlink · wn553x1-b · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
35Monitor	CVE-2026-120229No exploit	WAVLINK WN553X1-B ioos sub_416B50 os command injectionwavlink · wn553x1-b · CWE-77 RCE Command injection	High8.5	—	2.8%	3 days ago
35Monitor	CVE-2026-120230No exploit	WAVLINK WN701AE ioos Web Backend del_vlan_group os command injectionwavlink · wn701ae · CWE-77 RCE Command injection	High8.6	—	2.2%	3 days ago
35Monitor	CVE-2026-120231No exploit	WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injectionwavlink · wn553x1-b · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
34Monitor	CVE-2026-120232Proof of concept	Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruptionhorizon datasys · reboot restore standard · CWE-119 Memory safety	High8.5	—	0.2%	3 days ago
40Plan	CVE-2026-120338No exploit	Prefab UI Pyodide sandbox escape to host RCEprefecthq · prefab-ui · CWE-94 pre-auth RCE	Critical10.0	—	0.7%	3 days ago
37Monitor	CVE-2026-62048No exploit	WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerabilityliquid web / stellarwp · bookit · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	3 days ago
28Monitor	CVE-2026-66570No exploit	WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilitynickboss · wordpress file upload · CWE-79 Pre-auth XSS	High7.1	—	0.2%	3 days ago
35Monitor	CVE-2026-120238No exploit	WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injectionwavlink · wn553x1-b · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
35Monitor	CVE-2026-120239No exploit	WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injectionwavlink · wn553x1-b · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
35Monitor	CVE-2026-120240No exploit	WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injectionwavlink · wn553x1-b · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
30Monitor	CVE-2026-120241No exploit	Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflowruijie · rg-es205gc · CWE-119 Pre-auth Memory safety	High7.7	—	0.6%	3 days ago
28Monitor	CVE-2026-82840No exploit	Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationapache software foundation · apache wicket · CWE-384	High7.2	—	0.3%	3 days ago
30Monitor	CVE-2026-111089No exploit	Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupapache software foundation · apache wicket · CWE-79 Pre-auth XSS	High7.6	—	0.3%	3 days ago
30Monitor	CVE-2026-82956No exploit	Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameapache software foundation · apache wicket · CWE-79 Pre-auth XSS	High7.6	—	0.3%	3 days ago
29Monitor	CVE-2026-83539No exploit	Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataapache software foundation · apache wicket · CWE-79 Pre-auth XSS	High7.4	—	0.3%	3 days ago
29Monitor	CVE-2026-83559No exploit	Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalapache software foundation · apache wicket · CWE-116 Pre-auth	High7.4	—	0.2%	3 days ago
33Monitor	CVE-2026-83594No exploit	Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesapache software foundation · apache wicket · CWE-789 Pre-auth	High8.3	—	0.2%	3 days ago
33Monitor	CVE-2026-84170No exploit	Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceapache software foundation · apache wicket · CWE-770 Pre-auth Denial of service	High8.3	—	0.3%	3 days ago
29Monitor	CVE-2026-84231No exploit	Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagapache software foundation · apache wicket · CWE-79 Pre-auth XSS	High7.4	—	0.3%	3 days ago
30Monitor	CVE-2026-95863No exploit	Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupapache software foundation · apache wicket · CWE-79 Pre-auth XSS	High7.6	—	0.3%	3 days ago
38Monitor	CVE-2026-120276No exploit	A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0.CWE-77 pre-auth RCE Command injection	Critical9.3	—	3.2%	3 days ago
38Monitor	CVE-2026-120277No exploit	A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0.CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.4%	3 days ago
38Monitor	CVE-2026-120279No exploit	WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injectionwavlink · wn536ax6-a · CWE-77 pre-auth RCE Command injection	Critical9.3	—	1.9%	3 days ago
38Monitor	CVE-2026-120280No exploit	A vulnerability has been found in WAVLINK WN536AX6-A V260507.CWE-77 pre-auth RCE Command injection	Critical9.3	—	1.9%	3 days ago
37Monitor	CVE-2026-120281No exploit	WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflowwavlink · wn536ax6-a · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.5%	3 days ago
34Monitor	CVE-2026-120282No exploit	WAVLINK WN536AX6-A protocol.csp host_black os command injectionwavlink · wn536ax6-a · CWE-77 RCE Command injection	High8.6	—	1.6%	3 days ago
37Monitor	CVE-2026-120283No exploit	Linksys E8450 portal.cgi strcpy stack-based overflowlinksys · e8450 · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.5%	3 days ago
34Monitor	CVE-2026-120322No exploit	Termix-SSH Termix transferToHost path traversaltermix-ssh · termix · CWE-22 Path traversal	High8.6	—	0.6%	3 days ago
34Monitor	CVE-2026-120311No exploit	Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job IDjovancoding · network-ai · CWE-23 Path traversal	High8.7	—	0.4%	2 days ago
34Monitor	CVE-2026-120312No exploit	Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Namejovancoding · network-ai · CWE-23 Path traversal	High8.7	—	0.4%	2 days ago
34Monitor	CVE-2026-120313No exploit	Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePathjovancoding · network-ai · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	2 days ago
34Monitor	CVE-2026-120315No exploit	LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFilelobehub · chat · CWE-22 RCE Path traversal	High8.7	—	0.4%	2 days ago
32Monitor	CVE-2026-120316No exploit	http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolutionhttp4k · http4k · CWE-22 Pre-auth Path traversal	High8.2	—	0.3%	2 days ago
32Monitor	CVE-2026-120317No exploit	http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrityhttp4k · http4k · CWE-345 Pre-auth	High8.2	—	0.1%	2 days ago
30Monitor	CVE-2026-20499No exploit	In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
30Monitor	CVE-2026-20545No exploit	In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
30Monitor	CVE-2026-20546No exploit	In Modem, there is a possible out of bounds write due to an incorrect bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
30Monitor	CVE-2026-20547No exploit	In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
30Monitor	CVE-2026-20548No exploit	In Modem, there is a possible out of bounds write due to an integer overflow.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
30Monitor	CVE-2026-20549No exploit	In Modem, there is a possible out of bounds write due to improper input validation.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
28Monitor	CVE-2026-20554No exploit	In Modem, there is a possible system crash due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.1	—	0.2%	2 days ago
30Monitor	CVE-2026-20556No exploit	In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
30Monitor	CVE-2026-20557No exploit	In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
33Monitor	CVE-2026-20558No exploit	In GPU pdma, there is a possible escalation of privilege due to use after free.mediatek, inc. · mediatek chipset · CWE-416 Local privilege escalation Memory safety	High8.4	—	0.1%	2 days ago
31Monitor	CVE-2026-20559No exploit	In GPU pdma, there is a possible memory corruption due to use after free.mediatek, inc. · mediatek chipset · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	2 days ago
33Monitor	CVE-2026-20565No exploit	In Modem, there is a possible out of bounds write due to an incorrect bounds check.mediatek, inc. · mediatek chipset · CWE-787 Local privilege escalation Memory safety	High8.4	—	0.1%	2 days ago
30Monitor	CVE-2026-20585No exploit	In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	2 days ago
33Monitor	CVE-2026-20591No exploit	In GPU pdma, there is a possible escalation of privilege due to a missing permission check.mediatek, inc. · mediatek chipset · CWE-416 Local privilege escalation Memory safety	High8.4	—	0.1%	2 days ago
38Monitor	CVE-2026-120344No exploit	WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injectionwavlink · wn551x3-a · CWE-77 pre-auth RCE Command injection	Critical9.3	—	1.9%	2 days ago
37Monitor	CVE-2025-11969No exploit	Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actionswso2 · wso2 api manager · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.4	—	0.3%	2 days ago
38Monitor	CVE-2026-120345No exploit	WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injectionwavlink · wn551x3-a · CWE-77 pre-auth RCE Command injection	Critical9.3	—	1.9%	2 days ago
28Monitor	CVE-2026-101176No exploit	Permission control vulnerability in the event notification management module.huawei · harmonyos · CWE-264 Pre-auth	High7.1	—	0.1%	2 days ago
30Monitor	CVE-2026-101186No exploit	DoS vulnerability in the window module.huawei · harmonyos · CWE-19 Pre-auth Denial of service	High7.5	—	0.2%	2 days ago
36Monitor	CVE-2026-18199No exploit	Remote Code Execution Vulnerabilityzohocorp · manageengine password manager pro · CWE-78 RCE Command injection	High8.8	—	2.4%	2 days ago
32Monitor	CVE-2026-117518No exploit	@fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape@fastify/reply-from · @fastify/reply-from · CWE-22 Pre-auth Path traversal	High8.2	—	0.4%	2 days ago
36Monitor	CVE-2026-120213No exploit	@fastify/http-proxy vulnerable to prefix escape via decoded route parameters@fastify/http-proxy · @fastify/http-proxy · CWE-22 Pre-auth Path traversal	Critical9.1	—	0.6%	2 days ago
34Monitor	CVE-2026-2613No exploit	SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruptionwso2 · wso2 api manager · CWE-89 SQL injection	High8.7	—	0.3%	2 days ago
35Monitor	CVE-2026-8923No exploit	Remote Code Executionzohocorp · manageengine eventlog analyzer · CWE-78 RCE Command injection	High8.7	—	2.1%	2 days ago
34Monitor	CVE-2026-111560No exploit	OS Command Injection in Barracuda Appliancesbarracuda networks · barracuda email security gateway (esg) · CWE-78 RCE Command injection	High8.6	—	0.4%	2 days ago
37Monitor	CVE-2026-116606No exploit	Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gatewaybarracuda networks · barracuda email security gateway (esg) · CWE-288 Pre-auth Auth bypass	Critical9.3	—	0.7%	2 days ago
32Monitor	CVE-2026-91909No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injedell · openmanage enterprise · CWE-88 RCE	High8.0	—	0.6%	2 days ago
31Monitor	CVE-2026-92886No exploit	Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-registertübi̇tak bi̇lgem software technologies research institute · eta-register · CWE-862 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	2 days ago
33Monitor	CVE-2026-94349No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Commdell · openmanage enterprise · CWE-78 RCE Command injection	High8.0	—	2.1%	2 days ago
35Monitor	CVE-2026-102802No exploit	Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1regularlabs.com · sourcerer free extension for joomla · CWE-94 RCE	High8.9	—	0.3%	2 days ago
34Monitor	CVE-2026-103419No exploit	Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.joomshaper.com · helix ultimate extension for joomla · CWE-79 XSS	High8.6	—	0.3%	2 days ago
28Monitor	CVE-2026-103420No exploit	Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · stageit extension for joomla · CWE-352 Pre-auth CSRF	High7.2	—	0.2%	2 days ago
34Monitor	CVE-2026-105600No exploit	Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · stageit extension for joomla · CWE-94 RCE	High8.6	—	0.3%	2 days ago
34Monitor	CVE-2026-105602No exploit	Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.joomshaper.com · helix ultimate extension for joomla · CWE-79 XSS	High8.6	—	0.3%	2 days ago
30Monitor	CVE-2026-74993No exploit	SQL Injection in Starnet Computer Systems' Inventory Tracking Applicationstarnet computer and network systems · inventory tracking application · CWE-89 Pre-auth SQL injection	High7.5	—	0.3%	2 days ago
34Monitor	CVE-2026-120318Proof of concept	Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAXcodeixer · product gallery slider & additional variation images for woocommerce · CWE-862 Broken access control (IDOR)	High8.6	—	0.4%	2 days ago
28Monitor	CVE-2026-120425No exploit	Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpointmunafio · chatify · CWE-639 Broken access control (IDOR)	High7.1	—	0.5%	2 days ago
34Monitor	CVE-2026-120426No exploit	OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Routeopencsg · csghub · CWE-639 Pre-auth Broken access control (IDOR)	High8.7	—	0.4%	2 days ago
28Monitor	CVE-2026-120429No exploit	Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaControllerowen2345 · camaleon cms · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	2 days ago
34Monitor	CVE-2026-120431No exploit	Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflownetpbm · netpbm · CWE-122 Memory safety	High8.5	—	0.1%	2 days ago
34Monitor	CVE-2026-120432No exploit	Netpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopamnetpbm · netpbm · CWE-190 Memory safety	High8.5	—	0.1%	2 days ago
34Monitor	CVE-2026-120433No exploit	Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPolynetpbm · netpbm · CWE-121 Memory safety	High8.5	—	0.1%	2 days ago
34Monitor	CVE-2026-120434No exploit	Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPolynetpbm · netpbm · CWE-121 Memory safety	High8.5	—	0.1%	2 days ago
34Monitor	CVE-2026-120435No exploit	Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppmnetpbm · netpbm · CWE-787 Memory safety	High8.5	—	0.1%	2 days ago
34Monitor	CVE-2026-120436No exploit	Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnmnetpbm · netpbm · CWE-190 Memory safety	High8.5	—	0.1%	2 days ago
34Monitor	CVE-2026-120438No exploit	QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumerationquickjs-ng · quickjs-ng · CWE-190 Memory safety	High8.5	—	0.1%	2 days ago
33Monitor	CVE-2026-120439No exploit	QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sortquickjs-ng · quickjs-ng · CWE-190 Pre-auth Memory safety	High8.3	—	0.3%	2 days ago
37Monitor	CVE-2026-120442No exploit	ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypassxianhc · ape-volo-admin · CWE-1394 Pre-auth Auth bypass	Critical9.3	—	0.4%	2 days ago
28Monitor	CVE-2026-120444No exploit	GoFound through 1.4.1 Path Traversal via database parameter in /api/db/dropsea-team · gofound · CWE-22 Pre-auth Path traversal	High7.2	—	0.4%	2 days ago
34Monitor	CVE-2026-120445No exploit	madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddlewaremadong-code · madong-admin-saas · CWE-863 Broken access control (IDOR)	High8.7	—	0.3%	2 days ago
35Monitor	CVE-2026-120446No exploit	madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management APImadong-code · madong-admin-saas · CWE-306 Pre-auth Auth bypass	High8.8	—	0.4%	2 days ago
36Monitor	CVE-2026-120447No exploit	HotGo through 2.15.1 Authentication Bypass via Client-Set SMS Verification Codebufanyun · hotgo · CWE-287 Pre-auth Auth bypass	Critical9.2	—	0.5%	2 days ago

CVE-2026-120189
37Monitor
A vulnerability was identified in D-Link DIR-505 1.10B02.
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Memory safety
4 days ago
CVE-2026-120195
38Monitor
WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
wavlink · wl-wn579a3-a3 days ago
CVE-2026-120196
35Monitor
WAVLINK WN579X3-D wapi.cgi port_forward os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wn579x3-d3 days ago
CVE-2026-120197
35Monitor
WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wl-wn530hg4b3 days ago
CVE-2026-120198
38Monitor
WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
wavlink · wl-wn530be1-a3 days ago
CVE-2026-120218
8Monitor
Typemill SvgSanitizer.php saveImage cross site scripting
LowCVSS 2.0Proof of conceptEPSS 0%
- XSS
3 days ago
CVE-2026-116296
0Monitor
Gitea archived repository release, milestone and label modification
Proof of conceptEPSS 0%
- Broken access control (IDOR)
gitea · gitea3 days ago
CVE-2026-120224
34Monitor
Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
HighCVSS 8.6No exploitEPSS 0%
oray · pugongying x5 pro3 days ago
CVE-2026-120225
34Monitor
Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
oray · pugongying x5 pro3 days ago
CVE-2026-120227
35Monitor
WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
wavlink · wn701ae3 days ago
CVE-2026-120306
39Monitor
Beta9 build sandbox escape via chroot-only isolation
CriticalCVSS 9.9No exploitEPSS 0%
beam-cloud · beta9 worker3 days ago
CVE-2026-120307
39Monitor
Beta9 container escape via unvalidated sandbox file paths
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
beam-cloud · beta9 worker3 days ago
CVE-2026-120308
39Monitor
Beta9 host filesystem exposure via volume path traversal
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
beam-cloud · beta9 gateway3 days ago
CVE-2026-120228
34Monitor
WAVLINK WN553X1-B ioos Service sub_416D88 os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wn553x1-b3 days ago
CVE-2026-120229
35Monitor
WAVLINK WN553X1-B ioos sub_416B50 os command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
wavlink · wn553x1-b3 days ago
CVE-2026-120230
35Monitor
WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
wavlink · wn701ae3 days ago
CVE-2026-120231
35Monitor
WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wn553x1-b3 days ago
CVE-2026-120232
34Monitor
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
HighCVSS 8.5Proof of conceptEPSS 0%
- Memory safety
horizon datasys · reboot restore standard3 days ago
CVE-2026-120338
40Plan
Prefab UI Pyodide sandbox escape to host RCE
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
prefecthq · prefab-ui3 days ago
CVE-2026-62048
37Monitor
WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
liquid web / stellarwp · bookit3 days ago
CVE-2026-66570
28Monitor
WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nickboss · wordpress file upload3 days ago
CVE-2026-120238
35Monitor
WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wn553x1-b3 days ago
CVE-2026-120239
35Monitor
WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wn553x1-b3 days ago
CVE-2026-120240
35Monitor
WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wn553x1-b3 days ago
CVE-2026-120241
30Monitor
Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
ruijie · rg-es205gc3 days ago
CVE-2026-82840
28Monitor
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
HighCVSS 7.2No exploitEPSS 0%
apache software foundation · apache wicket3 days ago
CVE-2026-111089
30Monitor
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- XSS
apache software foundation · apache wicket3 days ago
CVE-2026-82956
30Monitor
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- XSS
apache software foundation · apache wicket3 days ago
CVE-2026-83539
29Monitor
Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
apache software foundation · apache wicket3 days ago
CVE-2026-83559
29Monitor
Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
apache software foundation · apache wicket3 days ago
CVE-2026-83594
33Monitor
Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
apache software foundation · apache wicket3 days ago
CVE-2026-84170
33Monitor
Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache wicket3 days ago
CVE-2026-84231
29Monitor
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
apache software foundation · apache wicket3 days ago
CVE-2026-95863
30Monitor
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- XSS
apache software foundation · apache wicket3 days ago
CVE-2026-120276
38Monitor
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0.
CriticalCVSS 9.3No exploitEPSS 3%
- pre-auth RCE
- Command injection
3 days ago
CVE-2026-120277
38Monitor
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0.
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
3 days ago
CVE-2026-120279
38Monitor
WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
wavlink · wn536ax6-a3 days ago
CVE-2026-120280
38Monitor
A vulnerability has been found in WAVLINK WN536AX6-A V260507.
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
3 days ago
CVE-2026-120281
37Monitor
WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
wavlink · wn536ax6-a3 days ago
CVE-2026-120282
34Monitor
WAVLINK WN536AX6-A protocol.csp host_black os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wn536ax6-a3 days ago
CVE-2026-120283
37Monitor
Linksys E8450 portal.cgi strcpy stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
linksys · e84503 days ago
CVE-2026-120322
34Monitor
Termix-SSH Termix transferToHost path traversal
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
termix-ssh · termix3 days ago
CVE-2026-120311
34Monitor
Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
jovancoding · network-ai2 days ago
CVE-2026-120312
34Monitor
Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
jovancoding · network-ai2 days ago
CVE-2026-120313
34Monitor
Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
jovancoding · network-ai2 days ago
CVE-2026-120315
34Monitor
LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
lobehub · chat2 days ago
CVE-2026-120316
32Monitor
http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
http4k · http4k2 days ago
CVE-2026-120317
32Monitor
http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
http4k · http4k2 days ago
CVE-2026-20499
30Monitor
In Modem, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20545
30Monitor
In Modem, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20546
30Monitor
In Modem, there is a possible out of bounds write due to an incorrect bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20547
30Monitor
In Modem, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20548
30Monitor
In Modem, there is a possible out of bounds write due to an integer overflow.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20549
30Monitor
In Modem, there is a possible out of bounds write due to improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20554
28Monitor
In Modem, there is a possible system crash due to a missing bounds check.
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20556
30Monitor
In Modem, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20557
30Monitor
In Modem, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20558
33Monitor
In GPU pdma, there is a possible escalation of privilege due to use after free.
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20559
31Monitor
In GPU pdma, there is a possible memory corruption due to use after free.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20565
33Monitor
In Modem, there is a possible out of bounds write due to an incorrect bounds check.
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20585
30Monitor
In Modem, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-20591
33Monitor
In GPU pdma, there is a possible escalation of privilege due to a missing permission check.
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
- Memory safety
mediatek, inc. · mediatek chipset2 days ago
CVE-2026-120344
38Monitor
WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
wavlink · wn551x3-a2 days ago
CVE-2025-11969
37Monitor
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wso2 · wso2 api manager2 days ago
CVE-2026-120345
38Monitor
WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
wavlink · wn551x3-a2 days ago
CVE-2026-101176
28Monitor
Permission control vulnerability in the event notification management module.
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
huawei · harmonyos2 days ago
CVE-2026-101186
30Monitor
DoS vulnerability in the window module.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
huawei · harmonyos2 days ago
CVE-2026-18199
36Monitor
Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
zohocorp · manageengine password manager pro2 days ago
CVE-2026-117518
32Monitor
@fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
@fastify/reply-from · @fastify/reply-from2 days ago
CVE-2026-120213
36Monitor
@fastify/http-proxy vulnerable to prefix escape via decoded route parameters
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
@fastify/http-proxy · @fastify/http-proxy2 days ago
CVE-2026-2613
34Monitor
SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
wso2 · wso2 api manager2 days ago
CVE-2026-8923
35Monitor
Remote Code Execution
HighCVSS 8.7No exploitEPSS 2%
- RCE
- Command injection
zohocorp · manageengine eventlog analyzer2 days ago
CVE-2026-111560
34Monitor
OS Command Injection in Barracuda Appliances
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
barracuda networks · barracuda email security gateway (esg)2 days ago
CVE-2026-116606
37Monitor
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
barracuda networks · barracuda email security gateway (esg)2 days ago
CVE-2026-91909
32Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Inje
HighCVSS 8.0No exploitEPSS 0%
- RCE
dell · openmanage enterprise2 days ago
CVE-2026-92886
31Monitor
Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
tübi̇tak bi̇lgem software technologies research institute · eta-register2 days ago
CVE-2026-94349
33Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm
HighCVSS 8.0No exploitEPSS 2%
- RCE
- Command injection
dell · openmanage enterprise2 days ago
CVE-2026-102802
35Monitor
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1
HighCVSS 8.9No exploitEPSS 0%
- RCE
regularlabs.com · sourcerer free extension for joomla2 days ago
CVE-2026-103419
34Monitor
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.
HighCVSS 8.6No exploitEPSS 0%
- XSS
joomshaper.com · helix ultimate extension for joomla2 days ago
CVE-2026-103420
28Monitor
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- CSRF
php-web-design.com · stageit extension for joomla2 days ago
CVE-2026-105600
34Monitor
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5
HighCVSS 8.6No exploitEPSS 0%
- RCE
php-web-design.com · stageit extension for joomla2 days ago
CVE-2026-105602
34Monitor
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.
HighCVSS 8.6No exploitEPSS 0%
- XSS
joomshaper.com · helix ultimate extension for joomla2 days ago
CVE-2026-74993
30Monitor
SQL Injection in Starnet Computer Systems' Inventory Tracking Application
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
starnet computer and network systems · inventory tracking application2 days ago
CVE-2026-120318
34Monitor
Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX
HighCVSS 8.6Proof of conceptEPSS 0%
- Broken access control (IDOR)
codeixer · product gallery slider & additional variation images for woocommerce2 days ago
CVE-2026-120425
28Monitor
Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
munafio · chatify2 days ago
CVE-2026-120426
34Monitor
OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
opencsg · csghub2 days ago
CVE-2026-120429
28Monitor
Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
owen2345 · camaleon cms2 days ago
CVE-2026-120431
34Monitor
Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
netpbm · netpbm2 days ago
CVE-2026-120432
34Monitor
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopam
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
netpbm · netpbm2 days ago
CVE-2026-120433
34Monitor
Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
netpbm · netpbm2 days ago
CVE-2026-120434
34Monitor
Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
netpbm · netpbm2 days ago
CVE-2026-120435
34Monitor
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
netpbm · netpbm2 days ago
CVE-2026-120436
34Monitor
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
netpbm · netpbm2 days ago
CVE-2026-120438
34Monitor
QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
quickjs-ng · quickjs-ng2 days ago
CVE-2026-120439
33Monitor
QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
quickjs-ng · quickjs-ng2 days ago
CVE-2026-120442
37Monitor
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
xianhc · ape-volo-admin2 days ago
CVE-2026-120444
28Monitor
GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Path traversal
sea-team · gofound2 days ago
CVE-2026-120445
34Monitor
madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
madong-code · madong-admin-saas2 days ago
CVE-2026-120446
35Monitor
madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
madong-code · madong-admin-saas2 days ago
CVE-2026-120447
36Monitor
HotGo through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
bufanyun · hotgo2 days ago