Critical-severity CVEs (page 16)
Page 16 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51643 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and curren… |
CVE-2026-51636 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via se… |
CVE-2026-51628 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a… |
CVE-2026-51626 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, inclu… |
CVE-2026-51622 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via s… |
CVE-2026-51611 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot v… |
CVE-2026-82078 | Critical | 9.1 | 2026-08-28 | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database… |
CVE-2026-81578 | Critical | 9.8 | 2026-08-28 | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remo… |
CVE-2026-37751 | Critical | 9.8 | 2026-08-28 | An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arb… |
CVE-2026-37236 | Critical | 9.8 | 2026-08-28 | grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restr… |
CVE-2026-82244 | Critical | 9.1 | 2026-08-28 | Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary cod… |
CVE-2026-82222 | Critical | 10.0 | 2026-08-28 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1. |
CVE-2026-42007 | Critical | 9.1 | 2026-08-28 | An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write… |
CVE-2026-80714 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created… |
CVE-2026-80694 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_i… |
CVE-2026-80693 | Critical | 9.3 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpf_get_reg_intr_vecs(… |
CVE-2026-80684 | Critical | 9.3 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can… |
CVE-2026-80681 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the et… |
CVE-2026-80674 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUT… |
CVE-2026-80673 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolvi… |
CVE-2026-80671 | Critical | 9.3 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several is… |
CVE-2026-80670 | Critical | 9.1 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() acc… |
CVE-2026-80668 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces… |
CVE-2026-80634 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLA… |
CVE-2026-80630 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restorin… |
CVE-2026-80617 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer… |
CVE-2026-80612 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passi… |
CVE-2026-80609 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe->len_list[] Move index check before element access. |
CVE-2026-80603 | Critical | 9.1 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_… |
CVE-2026-80600 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb_may_pull() called… |
CVE-2026-78032 | Critical | 9.8 | 2026-08-28 | SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege. |
CVE-2026-76581 | Critical | 9.8 | 2026-08-28 | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and… |
CVE-2026-40541 | Critical | 9.0 | 2026-08-28 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22… |
CVE-2026-82082 | Critical | 9.8 | 2026-08-28 | NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute th… |
CVE-2026-61800 | Critical | 9.1 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a part… |
CVE-2026-78239 | Critical | 9.8 | 2026-08-28 | Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative servic… |
CVE-2026-76943 | Critical | 9.8 | 2026-08-28 | Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtai… |
CVE-2026-76179 | Critical | 9.8 | 2026-08-28 | An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management inte… |
CVE-2026-75337 | Critical | 9.8 | 2026-08-28 | The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to t… |
CVE-2026-73125 | Critical | 9.8 | 2026-08-28 | Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated… |
CVE-2026-71187 | Critical | 9.8 | 2026-08-28 | The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication re… |
CVE-2026-69658 | Critical | 9.8 | 2026-08-28 | MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized de… |
CVE-2026-50152 | Critical | 9.1 | 2026-08-28 | Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription… |
CVE-2026-59313 | Critical | 9.8 | 2026-08-27 | Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7… |
CVE-2026-59283 | Critical | 9.1 | 2026-08-27 | Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL… |
CVE-2026-54687 | Critical | 9.8 | 2026-08-27 | n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database f… |
CVE-2026-37072 | Critical | 9.8 | 2026-08-27 | Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. |
CVE-2026-37071 | Critical | 9.8 | 2026-08-27 | Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker wit… |
CVE-2026-37065 | Critical | 9.1 | 2026-08-27 | Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=. |
CVE-2026-37007 | Critical | 9.8 | 2026-08-27 | A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the… |
CVE-2026-37006 | Critical | 9.8 | 2026-08-27 | A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via maliciou… |
CVE-2026-37004 | Critical | 9.8 | 2026-08-27 | BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands… |
CVE-2026-37003 | Critical | 9.8 | 2026-08-27 | Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, L… |
CVE-2026-35869 | Critical | 9.8 | 2026-08-27 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs d… |
CVE-2026-35868 | Critical | 9.8 | 2026-08-27 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4. This flaw occu… |
CVE-2026-30612 | Critical | 9.8 | 2026-08-27 | An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to… |
CVE-2026-19092 | Critical | 9.8 | 2026-08-27 | The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticat… |
CVE-2026-81735 | Critical | 10.0 | 2026-08-27 | startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpSe… |
CVE-2026-81707 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge th… |
CVE-2026-81702 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public k… |
CVE-2026-81701 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn… |
CVE-2026-81700 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl… |
CVE-2026-81098 | Critical | 9.1 | 2026-08-27 | The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the… |
CVE-2026-81096 | Critical | 10.0 | 2026-08-27 | ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_cod… |
CVE-2026-81094 | Critical | 9.1 | 2026-08-27 | The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/… |
CVE-2026-75357 | Critical | 9.8 | 2026-08-27 | An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components. |
CVE-2026-57499 | Critical | 9.1 | 2026-08-27 | Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows… |
CVE-2026-26897 | Critical | 9.8 | 2026-08-27 | An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbit… |
CVE-2026-16279 | Critical | 9.3 | 2026-08-27 | An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an at… |
CVE-2026-74233 | Critical | 9.8 | 2026-08-27 | Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC… |
CVE-2026-74232 | Critical | 9.8 | 2026-08-27 | Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQ… |
CVE-2026-78292 | Critical | 9.8 | 2026-08-27 | Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions. |
CVE-2026-78288 | Critical | 9.3 | 2026-08-27 | Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. |
CVE-2026-78286 | Critical | 9.8 | 2026-08-27 | Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions. |
CVE-2026-78274 | Critical | 9.1 | 2026-08-27 | Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. |
CVE-2026-78260 | Critical | 9.3 | 2026-08-27 | Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. |
CVE-2026-59354 | Critical | 9.6 | 2026-08-27 | In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registrati… |
CVE-2026-32566 | Critical | 9.8 | 2026-08-27 | Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. |
CVE-2026-32479 | Critical | 9.3 | 2026-08-27 | Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. |
CVE-2026-77016 | Critical | 9.6 | 2026-08-27 | The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain t… |
CVE-2026-59270 | Critical | 9.4 | 2026-08-27 | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all avai… |
CVE-2026-47892 | Critical | 9.8 | 2026-08-27 | A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Sp… |
CVE-2026-47891 | Critical | 9.8 | 2026-08-27 | A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7… |
CVE-2026-47890 | Critical | 9.8 | 2026-08-27 | Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8… |
CVE-2026-47884 | Critical | 9.8 | 2026-08-27 | Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where… |
CVE-2026-75340 | Critical | 9.1 | 2026-08-26 | The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forg… |
CVE-2026-75338 | Critical | 9.8 | 2026-08-26 | disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/confi… |
CVE-2026-75336 | Critical | 9.8 | 2026-08-26 | Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. |
CVE-2026-75332 | Critical | 9.1 | 2026-08-26 | Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download(). |
CVE-2026-75330 | Critical | 9.8 | 2026-08-26 | The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module paramet… |
CVE-2026-75329 | Critical | 9.8 | 2026-08-26 | The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the fu… |
CVE-2026-65646 | Critical | 9.9 | 2026-08-26 | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files… |
CVE-2026-75414 | Critical | 9.8 | 2026-08-26 | In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerabili… |
CVE-2026-75411 | Critical | 9.8 | 2026-08-26 | JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityC… |
CVE-2026-52103 | Critical | 9.8 | 2026-08-26 | A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbit… |
CVE-2025-51679 | Critical | 9.1 | 2026-08-26 | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior. |
CVE-2026-75334 | Critical | 9.8 | 2026-08-26 | The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the t_report_sql_res… |
CVE-2026-75327 | Critical | 9.8 | 2026-08-26 | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability: |
CVE-2026-68000 | Critical | 9.8 | 2026-08-26 | The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of… |
CVE-2026-60004 | Critical | 9.8 | 2026-08-26 | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. |