Critical-severity CVEs (page 15)
Page 15 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51720 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter r… |
CVE-2026-76133 | Critical | 9.8 | 2026-08-31 | The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or… |
CVE-2026-73819 | Critical | 9.8 | 2026-08-31 | The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain… |
CVE-2026-51718 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reserva… |
CVE-2026-51717 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode… |
CVE-2026-51715 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via… |
CVE-2026-51713 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state vi… |
CVE-2026-51711 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing windo… |
CVE-2026-51710 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behav… |
CVE-2026-51709 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi set… |
CVE-2026-51708 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sen… |
CVE-2026-51705 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sendi… |
CVE-2026-51701 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access contro… |
CVE-2026-51700 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior… |
CVE-2026-51699 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending… |
CVE-2026-51698 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via… |
CVE-2026-51152 | Critical | 9.1 | 2026-08-31 | Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclie… |
CVE-2026-82970 | Critical | 10.0 | 2026-08-31 | Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files… |
CVE-2026-59111 | Critical | 9.3 | 2026-08-31 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Iden… |
CVE-2026-51697 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration v… |
CVE-2026-51696 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services… |
CVE-2026-51693 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sendi… |
CVE-2026-51692 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wir… |
CVE-2026-51691 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or fla… |
CVE-2026-51690 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and con… |
CVE-2026-51689 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflo… |
CVE-2026-51687 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wir… |
CVE-2026-51686 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireles… |
CVE-2026-51684 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related servi… |
CVE-2026-51681 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration v… |
CVE-2026-51680 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a c… |
CVE-2026-51679 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator accou… |
CVE-2026-51677 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP service state via send… |
CVE-2026-51676 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device polici… |
CVE-2026-51675 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via s… |
CVE-2026-51674 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks… |
CVE-2026-51672 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement f… |
CVE-2026-51670 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slave upgrade status and… |
CVE-2026-51669 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave conf… |
CVE-2026-82695 | Critical | 10.0 | 2026-08-31 | A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The… |
CVE-2026-82694 | Critical | 10.0 | 2026-08-31 | A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web… |
CVE-2026-82693 | Critical | 10.0 | 2026-08-31 | A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web… |
CVE-2026-82692 | Critical | 9.9 | 2026-08-31 | A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipula… |
CVE-2026-82691 | Critical | 9.1 | 2026-08-31 | A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the f… |
CVE-2026-82690 | Critical | 9.1 | 2026-08-31 | A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cg… |
CVE-2026-82689 | Critical | 9.9 | 2026-08-31 | A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_m… |
CVE-2026-82688 | Critical | 9.1 | 2026-08-31 | A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-b… |
CVE-2026-49003 | Critical | 9.6 | 2026-08-31 | Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simul… |
CVE-2026-82874 | Critical | 9.9 | 2026-08-31 | ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db end… |
CVE-2026-82872 | Critical | 9.1 | 2026-08-31 | ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operation… |
CVE-2026-82870 | Critical | 9.6 | 2026-08-31 | ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or d… |
CVE-2026-82860 | Critical | 9.8 | 2026-08-31 | @hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craf… |
CVE-2026-82859 | Critical | 9.8 | 2026-08-31 | hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intend… |
CVE-2026-82858 | Critical | 9.8 | 2026-08-31 | @hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input… |
CVE-2026-82857 | Critical | 9.8 | 2026-08-31 | hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e… |
CVE-2026-82856 | Critical | 9.8 | 2026-08-31 | @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use For… |
CVE-2026-82855 | Critical | 9.8 | 2026-08-31 | @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attac… |
CVE-2026-82854 | Critical | 9.8 | 2026-08-31 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope o… |
CVE-2026-58574 | Critical | 9.8 | 2026-08-31 | Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted manage… |
CVE-2026-82616 | Critical | 9.9 | 2026-08-31 | A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulati… |
CVE-2026-82593 | Critical | 9.9 | 2026-08-31 | A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module… |
CVE-2026-82592 | Critical | 9.9 | 2026-08-30 | A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting… |
CVE-2026-82542 | Critical | 10.0 | 2026-08-30 | A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of th… |
CVE-2026-82539 | Critical | 9.1 | 2026-08-30 | A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MA… |
CVE-2026-15980 | Critical | 9.8 | 2026-08-30 | The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization i… |
CVE-2026-15369 | Critical | 9.8 | 2026-08-29 | The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is… |
CVE-2026-82460 | Critical | 9.8 | 2026-08-29 | Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path… |
CVE-2026-82456 | Critical | 10.0 | 2026-08-29 | argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is con… |
CVE-2026-82454 | Critical | 9.1 | 2026-08-29 | The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken fu… |
CVE-2026-82452 | Critical | 9.8 | 2026-08-29 | rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handle… |
CVE-2026-82448 | Critical | 9.8 | 2026-08-29 | Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary databas… |
CVE-2026-14494 | Critical | 9.8 | 2026-08-29 | The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission func… |
CVE-2026-80725 | Critical | 9.8 | 2026-08-29 | In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate p… |
CVE-2026-77012 | Critical | 9.3 | 2026-08-29 | The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default… |
CVE-2026-16947 | Critical | 9.1 | 2026-08-29 | The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side v… |
CVE-2026-16259 | Critical | 9.8 | 2026-08-29 | The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to t… |
CVE-2026-10522 | Critical | 9.8 | 2026-08-29 | The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthen… |
CVE-2026-51663 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger wireless scans and r… |
CVE-2026-51661 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding ru… |
CVE-2026-3627 | Critical | 9.1 | 2026-08-28 | IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker t… |
CVE-2026-19295 | Critical | 9.9 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow wi… |
CVE-2026-19286 | Critical | 9.8 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A p… |
CVE-2026-18527 | Critical | 9.9 | 2026-08-28 | IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by A… |
CVE-2026-82329 | Critical | 9.8 | 2026-08-28 | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain ad… |
CVE-2026-82277 | Critical | 9.8 | 2026-08-28 | Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protectio… |
CVE-2026-82266 | Critical | 9.8 | 2026-08-28 | Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. A… |
CVE-2026-55634 | Critical | 9.9 | 2026-08-28 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/… |
CVE-2026-55565 | Critical | 9.9 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/stre… |
CVE-2026-55559 | Critical | 9.8 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into… |
CVE-2026-55511 | Critical | 9.1 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL… |
CVE-2026-55248 | Critical | 9.1 | 2026-08-28 | plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS port… |
CVE-2026-55247 | Critical | 9.1 | 2026-08-28 | plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py acce… |
CVE-2026-54755 | Critical | 9.6 | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can… |
CVE-2026-54754 | Critical | 9.6 | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderDa… |
CVE-2026-54745 | Critical | 10.0 | 2026-08-28 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an… |
CVE-2026-51660 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filte… |
CVE-2026-51657 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configurat… |
CVE-2026-51649 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configurati… |
CVE-2026-51646 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rule… |
CVE-2026-51645 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative user… |