Critical-severity CVEs (page 10)
Page 10 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89635 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd_reopen_durab… |
CVE-2026-89634 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check added by… |
CVE-2026-89633 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2(… |
CVE-2026-89631 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() boun… |
CVE-2026-89630 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902… |
CVE-2026-89614 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is si… |
CVE-2026-89613 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if… |
CVE-2026-89612 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MF… |
CVE-2026-89611 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribut… |
CVE-2026-89610 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates tha… |
CVE-2026-89558 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in raid10_sync_request() Commit fe6a19d40ceb… |
CVE-2026-89555 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_ha… |
CVE-2026-89551 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes… |
CVE-2026-89550 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validate… |
CVE-2026-89546 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can co… |
CVE-2026-89542 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC… |
CVE-2026-89541 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_priv() validates the RP… |
CVE-2026-89538 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss_krb5_unwrap_v2() sets buf-… |
CVE-2026-89537 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2… |
CVE-2026-89536 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs… |
CVE-2026-89533 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Re… |
CVE-2026-89532 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a ch… |
CVE-2026-89530 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client c… |
CVE-2026-89526 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk posi… |
CVE-2026-89495 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-c… |
CVE-2026-89494 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES mes… |
CVE-2026-89492 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf… |
CVE-2026-89485 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the curr… |
CVE-2026-89482 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Commit 25e5cb780e62… |
CVE-2026-89479 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() loo… |
CVE-2026-89478 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once pe… |
CVE-2026-89448 | Critical | 9.3 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of reques… |
CVE-2026-81002 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into a… |
CVE-2026-80986 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has ma… |
CVE-2026-80981 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_l… |
CVE-2026-80980 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state fla… |
CVE-2026-80976 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap_and_validate() pulls the outer SRv6 head… |
CVE-2026-80945 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics er… |
CVE-2026-80926 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opi… |
CVE-2026-53952 | Critical | 9.8 | 2026-09-11 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below… |
CVE-2026-52630 | Critical | 9.8 | 2026-09-11 | SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in Us… |
CVE-2026-79396 | Critical | 9.8 | 2026-09-11 | Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted… |
CVE-2026-79395 | Critical | 9.8 | 2026-09-11 | An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 f… |
CVE-2026-62105 | Critical | 9.8 | 2026-09-11 | Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. |
CVE-2026-62103 | Critical | 9.8 | 2026-09-11 | Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. |
CVE-2026-54072 | Critical | 9.3 | 2026-09-11 | Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_ur… |
CVE-2026-82617 | Critical | 9.8 | 2026-09-11 | The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER… |
CVE-2026-72710 | Critical | 9.8 | 2026-09-11 | SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL… |
CVE-2026-72709 | Critical | 9.8 | 2026-09-11 | SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to in… |
CVE-2026-89010 | Critical | 9.8 | 2026-09-11 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote at… |
CVE-2026-89009 | Critical | 9.1 | 2026-09-11 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote at… |
CVE-2026-71644 | Critical | 9.8 | 2026-09-11 | An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning a… |
CVE-2026-84390 | Critical | 9.8 | 2026-09-11 | A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2… |
CVE-2026-80462 | Critical | 10.0 | 2026-09-11 | A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Auto… |
CVE-2026-89259 | Critical | 9.8 | 2026-09-11 | Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec… |
CVE-2026-86793 | Critical | 9.8 | 2026-09-11 | SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be… |
CVE-2026-14563 | Critical | 9.8 | 2026-09-11 | The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email addres… |
CVE-2026-14560 | Critical | 10.0 | 2026-09-11 | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preservi… |
CVE-2026-14559 | Critical | 9.8 | 2026-09-11 | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers… |
CVE-2026-8778 | Critical | 9.8 | 2026-09-11 | The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to mi… |
CVE-2026-82107 | Critical | 9.6 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to… |
CVE-2026-82100 | Critical | 9.6 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. |
CVE-2026-81204 | Critical | 9.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction. |
CVE-2026-80424 | Critical | 9.1 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extracti… |
CVE-2026-79724 | Critical | 9.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in… |
CVE-2026-78573 | Critical | 9.8 | 2026-09-10 | IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials. |
CVE-2026-71640 | Critical | 9.1 | 2026-09-10 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via improper handling o… |
CVE-2026-45764 | Critical | 9.1 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a pro… |
CVE-2026-19646 | Critical | 9.1 | 2026-09-10 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbit… |
CVE-2026-89094 | Critical | 9.9 | 2026-09-10 | Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. |
CVE-2026-85025 | Critical | 9.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through pub… |
CVE-2026-75940 | Critical | 9.1 | 2026-09-10 | A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensit… |
CVE-2026-89086 | Critical | 9.1 | 2026-09-10 | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the… |
CVE-2026-89049 | Critical | 9.9 | 2026-09-10 | A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Am… |
CVE-2026-88056 | Critical | 9.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-89042 | Critical | 9.1 | 2026-09-10 | passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by… |
CVE-2026-68006 | Critical | 9.1 | 2026-09-10 | An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file |
CVE-2026-88044 | Critical | 9.1 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC inte… |
CVE-2026-85228 | Critical | 9.1 | 2026-09-10 | An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remot… |
CVE-2026-68488 | Critical | 9.9 | 2026-09-10 | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file… |
CVE-2026-68487 | Critical | 9.9 | 2026-09-10 | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. |
CVE-2026-52098 | Critical | 9.8 | 2026-09-10 | An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint |
CVE-2026-88899 | Critical | 9.8 | 2026-09-10 | knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can suppl… |
CVE-2026-88018 | Critical | 9.8 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with… |
CVE-2026-81468 | Critical | 9.1 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera… |
CVE-2026-81467 | Critical | 9.8 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera… |
CVE-2026-81048 | Critical | 9.6 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A… |
CVE-2026-81046 | Critical | 9.4 | 2026-09-10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could pote… |
CVE-2026-88008 | Critical | 9.1 | 2026-09-10 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header req… |
CVE-2026-88007 | Critical | 9.1 | 2026-09-10 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.A… |
CVE-2026-81800 | Critical | 9.3 | 2026-09-10 | Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions. |
CVE-2026-88877 | Critical | 9.8 | 2026-09-10 | Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry… |
CVE-2026-88869 | Critical | 9.3 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint… |
CVE-2026-88864 | Critical | 9.1 | 2026-09-10 | Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo ful… |
CVE-2026-38626 | Critical | 9.8 | 2026-09-10 | Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. |
CVE-2026-9163 | Critical | 9.8 | 2026-09-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allow… |
CVE-2026-8323 | Critical | 9.3 | 2026-09-10 | URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of D… |
CVE-2026-88285 | Critical | 9.4 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and iss… |
CVE-2026-88278 | Critical | 9.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be repla… |
CVE-2026-59679 | Critical | 9.0 | 2026-09-10 | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 r… |