Critical-severity CVEs (page 16)
Page 16 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51541 | Critical | 9.1 | 2026-07-13 | OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An att… |
CVE-2026-51540 | Critical | 9.8 | 2026-07-13 | OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connect… |
CVE-2026-51538 | Critical | 9.1 | 2026-07-13 | EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server p… |
CVE-2026-51537 | Critical | 9.1 | 2026-07-13 | EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malfor… |
CVE-2026-51536 | Critical | 9.1 | 2026-07-13 | In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across th… |
CVE-2026-58409 | Critical | 9.1 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the ser… |
CVE-2026-61500 | Critical | 9.8 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same gen… |
CVE-2026-57433 | Critical | 9.8 | 2026-07-13 | Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit… |
CVE-2026-13221 | Critical | 9.1 | 2026-07-13 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled int… |
CVE-2026-61498 | Critical | 9.8 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticat… |
CVE-2026-60121 | Critical | 9.8 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execut… |
CVE-2026-40469 | Critical | 9.1 | 2026-07-13 | Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata… |
CVE-2026-40468 | Critical | 9.1 | 2026-07-13 | Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and… |
CVE-2026-59518 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8… |
CVE-2026-59515 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL… |
CVE-2026-57813 | Critical | 9.8 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <… |
CVE-2026-57811 | Critical | 10.0 | 2026-07-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote… |
CVE-2026-57770 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography… |
CVE-2026-57744 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Ext… |
CVE-2026-57739 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acy… |
CVE-2026-57738 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0. |
CVE-2026-57726 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue… |
CVE-2026-57724 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12. |
CVE-2026-57719 | Critical | 10.0 | 2026-07-13 | Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen… |
CVE-2026-57714 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection… |
CVE-2026-57710 | Critical | 9.9 | 2026-07-13 | Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects W… |
CVE-2026-57707 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-busines… |
CVE-2026-57702 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blin… |
CVE-2026-57401 | Critical | 9.9 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This i… |
CVE-2026-41041 | Critical | 9.1 | 2026-07-13 | URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. U… |
CVE-2026-14453 | Critical | 9.6 | 2026-07-13 | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The mess… |
CVE-2026-57830 | Critical | 9.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an… |
CVE-2026-4769 | Critical | 9.8 | 2026-07-13 | Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not f… |
CVE-2026-11964 | Critical | 9.1 | 2026-07-13 | The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before ac… |
CVE-2026-15511 | Critical | 9.8 | 2026-07-12 | A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /us… |
CVE-2026-56271 | Critical | 9.8 | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and is… |
CVE-2026-56260 | Critical | 9.1 | 2026-07-12 | Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accep… |
CVE-2026-61447 | Critical | 10.0 | 2026-07-11 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST valid… |
CVE-2026-61445 | Critical | 9.9 | 2026-07-11 | PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command… |
CVE-2026-60090 | Critical | 9.8 | 2026-07-11 | PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends… |
CVE-2026-57827 | Critical | 9.8 | 2026-07-11 | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated… |
CVE-2026-20744 | Critical | 9.8 | 2026-07-10 | The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation. |
CVE-2026-15089 | Critical | 9.1 | 2026-07-10 | vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest registration versions: *.*. |
CVE-2026-14480 | Critical | 9.9 | 2026-07-10 | OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attac… |
CVE-2026-11913 | Critical | 9.8 | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. |
CVE-2026-12535 | Critical | 9.8 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affe… |
CVE-2026-10768 | Critical | 9.8 | 2026-07-10 | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0. |
CVE-2026-9726 | Critical | 9.8 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Inject… |
CVE-2026-57807 | Critical | 9.8 | 2026-07-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allow… |
CVE-2026-55879 | Critical | 9.3 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from… |
CVE-2026-12761 | Critical | 9.8 | 2026-07-10 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account ta… |
CVE-2026-57158 | Critical | 9.1 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix fo… |
CVE-2026-57156 | Critical | 9.8 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_d… |
CVE-2026-61459 | Critical | 9.8 | 2026-07-10 | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows… |
CVE-2026-5801 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM… |
CVE-2026-59151 | Critical | 9.6 | 2026-07-10 | Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding whi… |
CVE-2026-2397 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injec… |
CVE-2026-51119 | Critical | 9.1 | 2026-07-10 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components |
CVE-2026-55500 | Critical | 9.9 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys… |
CVE-2026-15143 | Critical | 9.3 | 2026-07-10 | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Defin… |
CVE-2026-61444 | Critical | 9.1 | 2026-07-10 | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-str… |
CVE-2026-59792 | Critical | 9.6 | 2026-07-10 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible |
CVE-2026-56765 | Critical | 9.8 | 2026-07-10 | Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission… |
CVE-2026-56688 | Critical | 9.1 | 2026-07-10 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vuln… |
CVE-2026-53363 | Critical | 9.8 | 2026-07-10 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() t… |
CVE-2026-15378 | Critical | 9.3 | 2026-07-10 | A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by… |
CVE-2026-40008 | Critical | 9.8 | 2026-07-10 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Ja… |
CVE-2026-40005 | Critical | 9.1 | 2026-07-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere th… |
CVE-2026-28564 | Critical | 9.8 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credenti… |
CVE-2026-15300 | Critical | 9.1 | 2026-07-10 | The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The… |
CVE-2026-15282 | Critical | 9.8 | 2026-07-10 | The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachm… |
CVE-2026-14894 | Critical | 9.8 | 2026-07-10 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the su… |
CVE-2026-54769 | Critical | 10.0 | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to… |
CVE-2026-58123 | Critical | 9.8 | 2026-07-09 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands b… |
CVE-2026-58122 | Critical | 9.1 | 2026-07-09 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restric… |
CVE-2026-0284 | Critical | 9.9 | 2026-07-09 | An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with net… |
CVE-2026-59827 | Critical | 9.9 | 2026-07-09 | Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2… |
CVE-2026-59826 | Critical | 9.1 | 2026-07-09 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not vali… |
CVE-2026-59726 | Critical | 10.0 | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST… |
CVE-2026-51599 | Critical | 9.8 | 2026-07-09 | An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker… |
CVE-2026-51597 | Critical | 9.1 | 2026-07-09 | MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can c… |
CVE-2026-13461 | Critical | 9.6 | 2026-07-09 | When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScri… |
CVE-2026-14261 | Critical | 9.1 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling at… |
CVE-2026-12116 | Critical | 9.8 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpre… |
CVE-2026-56291 | Critical | 9.8 | 2026-07-09 | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauth… |
CVE-2026-5955 | Critical | 9.8 | 2026-07-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows S… |
CVE-2026-2342 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Store… |
CVE-2026-15158 | Critical | 9.8 | 2026-07-09 | The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments functio… |
CVE-2026-14245 | Critical | 9.8 | 2026-07-09 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeo… |
CVE-2026-47826 | Critical | 9.1 | 2026-07-09 | The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected… |
CVE-2026-47646 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform… |
CVE-2026-54782 | Critical | 10.0 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token val… |
CVE-2026-15113 | Critical | 9.6 | 2026-07-08 | Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-55471 | Critical | 9.1 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities… |
CVE-2026-52200 | Critical | 9.8 | 2026-07-08 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiSer… |
CVE-2026-44024 | Critical | 9.8 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamic… |
CVE-2026-31309 | Critical | 9.8 | 2026-07-08 | Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrari… |
CVE-2026-54527 | Critical | 9.0 | 2026-07-08 | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to inne… |
CVE-2026-9074 | Critical | 9.1 | 2026-07-08 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functiona… |
CVE-2026-59702 | Critical | 9.3 | 2026-07-08 | repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound re… |