Critical-severity CVEs

34247 critical-severity CVEs (11309 with public PoCs). Browse the most dangerous vulnerabilities.

Top Critical-severity CVEs
CVESeverityScorePublishedSummary
CVE-2024-13784Critical9.82026-08-16The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…
CVE-2026-18316Critical9.12026-08-16The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() functio…
CVE-2026-18432Critical9.82026-08-16The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exi…
CVE-2026-16098Critical9.82026-08-16The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpl…
CVE-2026-14524Critical9.12026-08-16The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProces…
CVE-2026-19924Critical9.82026-08-16A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the componen…
CVE-2026-73053Critical9.02026-08-15SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attack…
CVE-2026-73052Critical9.02026-08-15SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu…
CVE-2026-73050Critical9.02026-08-15SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight u…
CVE-2026-73046Critical9.82026-08-15SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards n…
CVE-2026-73044Critical9.02026-08-15SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attac…
CVE-2026-73043Critical9.02026-08-15SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and…
CVE-2026-73042Critical9.02026-08-15SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, vie…
CVE-2026-73041Critical9.02026-08-15SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious ma…
CVE-2026-18855Critical9.12026-08-15The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function i…
CVE-2026-19598Critical9.82026-08-15The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and inclu…
CVE-2026-16142Critical9.82026-08-15The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() A…
CVE-2026-15826Critical9.82026-08-15The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due t…
CVE-2026-15341Critical9.82026-08-15The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4…
CVE-2026-15303Critical9.82026-08-15The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_creat…
All critical-severity CVEs — newest first (page 1 of 100)
CVESeverityScorePublishedSummary
CVE-2024-13784Critical9.82026-08-16The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…
CVE-2026-18316Critical9.12026-08-16The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() functio…
CVE-2026-18432Critical9.82026-08-16The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exi…
CVE-2026-16098Critical9.82026-08-16The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpl…
CVE-2026-14524Critical9.12026-08-16The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProces…
CVE-2026-19924Critical9.82026-08-16A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the componen…
CVE-2026-73053Critical9.02026-08-15SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attack…
CVE-2026-73052Critical9.02026-08-15SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu…
CVE-2026-73050Critical9.02026-08-15SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight u…
CVE-2026-73046Critical9.82026-08-15SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards n…
CVE-2026-73044Critical9.02026-08-15SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attac…
CVE-2026-73043Critical9.02026-08-15SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and…
CVE-2026-73042Critical9.02026-08-15SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, vie…
CVE-2026-73041Critical9.02026-08-15SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious ma…
CVE-2026-18855Critical9.12026-08-15The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function i…
CVE-2026-19598Critical9.82026-08-15The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and inclu…
CVE-2026-16142Critical9.82026-08-15The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() A…
CVE-2026-15826Critical9.82026-08-15The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due t…
CVE-2026-15341Critical9.82026-08-15The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4…
CVE-2026-15303Critical9.82026-08-15The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_creat…
CVE-2026-14484Critical9.12026-08-15The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validati…
CVE-2026-17186Critical9.92026-08-14IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a c…
CVE-2026-17184Critical9.82026-08-14IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.
CVE-2026-17182Critical9.82026-08-14IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validat…
CVE-2026-17181Critical9.32026-08-14IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.
CVE-2026-73678Critical10.02026-08-14MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to exec…
CVE-2026-50027Critical9.82026-08-14mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served wi…
CVE-2026-49457Critical9.12026-08-14erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The Cer…
CVE-2026-19188Critical10.02026-08-14A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check fea…
CVE-2026-73849Critical9.82026-08-14Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the…
CVE-2026-48528Critical9.82026-08-14Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated…
CVE-2026-19682Critical9.92026-08-14A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on…
CVE-2026-19681Critical9.92026-08-14An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading…
CVE-2026-19626Critical9.92026-08-14A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could expl…
CVE-2026-72830Critical9.82026-08-14Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler config…
CVE-2026-72829Critical9.82026-08-14The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These meth…
CVE-2026-72826Critical9.82026-08-14The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiK…
CVE-2026-72824Critical9.82026-08-14The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check…
CVE-2026-72822Critical9.82026-08-14The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibl…
CVE-2026-72811Critical10.02026-08-14SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored bloc…
CVE-2026-12949Critical9.82026-08-14The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3…
CVE-2026-73843Critical9.62026-08-13OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing mana…
CVE-2026-73842Critical9.02026-08-13OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api…
CVE-2026-72851Critical10.02026-08-13Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST at…
CVE-2026-72850Critical9.12026-08-13Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved d…
CVE-2026-72842Critical9.92026-08-13luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes with…
CVE-2026-72841Critical9.92026-08-13luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write a…
CVE-2026-72839Critical9.82026-08-13filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated at…
CVE-2026-72776Critical9.82026-08-13AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary com…
CVE-2026-8715Critical9.62026-08-13Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration…
CVE-2026-19297Critical9.12026-08-13IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive auth…
CVE-2026-17482Critical9.82026-08-13IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
CVE-2026-73656Critical9.92026-08-13Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-w…
CVE-2026-19747Critical9.82026-08-13A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAt…
CVE-2026-14525Critical9.42026-08-13IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when th…
CVE-2026-73653Critical9.42026-08-13Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreensh…
CVE-2026-73649Critical9.82026-08-13Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __p…
CVE-2026-73644Critical9.62026-08-13OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se…
CVE-2026-73567Critical9.12026-08-13sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKe…
CVE-2026-67614Critical9.82026-08-13CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to f…
CVE-2026-58508Critical9.12026-08-13Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
CVE-2026-58443Critical9.12026-08-13Public-only repository tokens can update private PR head branches
CVE-2026-58433Critical9.12026-08-13Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
CVE-2026-56750Critical9.12026-08-13Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-56654Critical9.82026-08-13Privilege Escalation via Access Token Scope Escalation in API
CVE-2026-56443Critical9.62026-08-13Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
CVE-2026-55982Critical9.12026-08-13OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
CVE-2026-13051Critical9.12026-08-13Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy…
CVE-2022-4993Critical9.12026-08-13HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use er…
CVE-2026-73533Critical9.82026-08-13Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server…
CVE-2026-73532Critical9.82026-08-13Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server…
CVE-2026-53791Critical9.12026-08-13rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by send…
CVE-2026-66691Critical9.82026-08-13Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
CVE-2026-66478Critical9.32026-08-13Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
CVE-2026-66472Critical9.32026-08-13Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.
CVE-2026-66465Critical9.82026-08-13Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
CVE-2026-66458Critical9.32026-08-13Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.
CVE-2026-66453Critical9.82026-08-13Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.
CVE-2026-66446Critical9.32026-08-13Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.
CVE-2026-66436Critical9.32026-08-13Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
CVE-2026-66424Critical9.82026-08-13Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.
CVE-2026-61969Critical9.32026-08-13Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.
CVE-2026-61967Critical9.82026-08-13Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
CVE-2026-61966Critical9.32026-08-13Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
CVE-2026-61962Critical10.02026-08-13Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
CVE-2026-28185Critical9.82026-08-13Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
CVE-2026-28149Critical9.82026-08-13Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
CVE-2026-28148Critical9.82026-08-13Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.
CVE-2026-28142Critical9.32026-08-13Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
CVE-2026-28008Critical9.82026-08-13Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
CVE-2026-28001Critical9.32026-08-13Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
CVE-2026-27544Critical10.02026-08-13Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
CVE-2026-49827Critical9.82026-08-13WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbi…
CVE-2026-59507Critical9.32026-08-13CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control
CVE-2026-59506Critical9.32026-08-13CWE-306: Missing Authentication for Critical Function
CVE-2026-59504Critical9.12026-08-13CWE-602: Client-Side Enforcement of Server-Side Security
CVE-2026-59503Critical9.12026-08-13CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
CVE-2026-59500Critical10.02026-08-13CWE-287: Improper Authentication
CVE-2026-15413Critical10.02026-08-13The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link…
CVE-2026-14182Critical9.82026-08-13The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a…