- CRITICAL10.0CVE-2026-7411EPSS 0.13%Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
- CRITICAL9.8CVE-2026-26956EPSS 0.12%VM2 Has a WASM Sandbox Escape (Node 25 only)
- CRITICAL9.8CVE-2026-26332EPSS 0.08%VM2 Has a Sandbox Escape Issue via SuppressedError
- CRITICAL9.8CVE-2026-24781EPSS 0.17%VM2 Has Sandbox Breakout Through Inspect Function
- CRITICAL9.8CVE-2026-24120EPSS 0.12%VM2 Has Sandbox Breakout Through Promise Species
- CRITICAL9.0CVE-2026-41901EPSS 0.10%Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
- CRITICAL9.1CVE-2026-41258EPSS 0.06%OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
- CRITICAL9.9CVE-2026-42812EPSS 0.12%Apache Polaris has an Improper Input Validation issue
- CRITICAL9.9CVE-2026-42811EPSS 0.11%Apache Polaris has an Improper Input Validation issue
- CRITICAL9.9CVE-2026-42810EPSS 0.11%Apache Polaris has an Improper Input Validation Issue
- CRITICAL9.9CVE-2026-42809EPSS 0.10%Apache Polaris has an Improper Input Validation Issue
- CRITICAL9.8CVE-2026-42027EPSS 0.64%Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
- CRITICAL9.1CVE-2026-40682EPSS 0.11%Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing
- CRITICAL9.8CVE-2026-24118EPSS 0.16%VM2 Sandbox Breakout Through __lookupGetter__
- CRITICAL9.8CVE-2026-42779EPSS 0.08%Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)
- CRITICAL9.8CVE-2026-42778EPSS 0.29%Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)
- CRITICAL10.0CVE-2026-36767EPSS 0.09%Shopizer has a path traversal issue
- CRITICAL9.9CVE-2026-42232EPSS 0.19%n8n has XML Node Prototype Pollution that to RCE
- CRITICAL10.0CVE-2026-42231EPSS 0.41%n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
- CRITICAL9.8CVE-2026-42233EPSS 0.06%n8n has SQL Injection in Oracle Database Node via Limit Field
- CRITICAL9.0CVE-2026-42523EPSS 0.05%Jenkins GitHub Plugin has an XSS vulnerability
- CRITICAL9.1CVE-2026-40976EPSS 0.02%Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
- CRITICAL9.8CVE-2026-41409EPSS 0.28%Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)
- CRITICAL9.4CVE-2026-33454EPSS 0.33%Apache Camel's Camel-Mail component is vulnerable to Camel message header injection
- CRITICAL10.0CVE-2026-33453EPSS 6.1%Apache camel-coap allows header injection that can lead to remote code execution