Critical-severity CVEs (page 18)
Page 18 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-79058 | Critical | 9.1 | 2026-08-25 | Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI eleme… |
CVE-2026-79056 | Critical | 9.6 | 2026-08-25 | Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via… |
CVE-2026-79052 | Critical | 9.6 | 2026-08-25 | Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-79047 | Critical | 9.6 | 2026-08-25 | Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the s… |
CVE-2026-79043 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-79026 | Critical | 9.6 | 2026-08-25 | Use after free in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary c… |
CVE-2026-79019 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the… |
CVE-2026-79012 | Critical | 9.6 | 2026-08-25 | Use after free in Safebrowsing in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary c… |
CVE-2026-78989 | Critical | 9.6 | 2026-08-25 | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the s… |
CVE-2026-78985 | Critical | 9.6 | 2026-08-25 | Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially exe… |
CVE-2026-78964 | Critical | 9.6 | 2026-08-25 | Use after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox vi… |
CVE-2026-78951 | Critical | 9.6 | 2026-08-25 | Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted H… |
CVE-2026-78948 | Critical | 9.6 | 2026-08-25 | Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pag… |
CVE-2026-78945 | Critical | 9.6 | 2026-08-25 | Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code o… |
CVE-2026-78939 | Critical | 9.6 | 2026-08-25 | Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary co… |
CVE-2026-78937 | Critical | 9.6 | 2026-08-25 | Use after free in Search in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute a… |
CVE-2026-78935 | Critical | 9.6 | 2026-08-25 | Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outsi… |
CVE-2026-78909 | Critical | 9.6 | 2026-08-25 | Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the s… |
CVE-2026-78904 | Critical | 9.6 | 2026-08-25 | Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
CVE-2026-78900 | Critical | 9.6 | 2026-08-25 | Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
CVE-2026-65093 | Critical | 9.9 | 2026-08-25 | NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to co… |
CVE-2026-65083 | Critical | 9.9 | 2026-08-25 | NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A s… |
CVE-2026-51368 | Critical | 9.8 | 2026-08-25 | An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code vi… |
CVE-2026-45018 | Critical | 9.8 | 2026-08-25 | Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp… |
CVE-2026-79787 | Critical | 9.8 | 2026-08-25 | Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user ident… |
CVE-2026-76197 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that co… |
CVE-2026-76195 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that co… |
CVE-2026-76193 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-19912 | Critical | 9.8 | 2026-08-25 | The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanit… |
CVE-2026-79675 | Critical | 9.8 | 2026-08-25 | NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous J… |
CVE-2026-55640 | Critical | 9.1 | 2026-08-25 | Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpo… |
CVE-2026-55546 | Critical | 9.8 | 2026-08-25 | QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-contr… |
CVE-2026-55536 | Critical | 9.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the… |
CVE-2026-16286 | Critical | 9.8 | 2026-08-25 | Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Sof… |
CVE-2026-75803 | Critical | 9.1 | 2026-08-25 | Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the… |
CVE-2026-63073 | Critical | 9.8 | 2026-08-25 | Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Im… |
CVE-2026-79657 | Critical | 9.8 | 2026-08-25 | NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific… |
CVE-2026-55976 | Critical | 9.1 | 2026-08-25 | Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privil… |
CVE-2026-49845 | Critical | 9.8 | 2026-08-25 | SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hiv… |
CVE-2026-63586 | Critical | 9.8 | 2026-08-25 | The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Author… |
CVE-2026-59769 | Critical | 9.1 | 2026-08-25 | FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the set… |
CVE-2026-13214 | Critical | 9.8 | 2026-08-25 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from th… |
CVE-2026-78683 | Critical | 9.6 | 2026-08-25 | NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/trans… |
CVE-2026-78676 | Critical | 9.8 | 2026-08-25 | GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected direc… |
CVE-2026-56710 | Critical | 9.8 | 2026-08-25 | Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with a… |
CVE-2026-56705 | Critical | 9.8 | 2026-08-25 | Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via… |
CVE-2026-78267 | Critical | 9.8 | 2026-08-24 | Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions. |
CVE-2026-78265 | Critical | 9.8 | 2026-08-24 | Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions. |
CVE-2026-78262 | Critical | 9.8 | 2026-08-24 | Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions. |
CVE-2026-32563 | Critical | 9.8 | 2026-08-24 | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. |
CVE-2026-32559 | Critical | 9.9 | 2026-08-24 | Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions. |
CVE-2026-32555 | Critical | 9.3 | 2026-08-24 | Unauthenticated SQL Injection in Boost <= 2.0.4 versions. |
CVE-2026-32554 | Critical | 9.3 | 2026-08-24 | Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. |
CVE-2026-52490 | Critical | 9.8 | 2026-08-24 | An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiff… |
CVE-2026-76835 | Critical | 9.1 | 2026-08-24 | OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-405… |
CVE-2026-71933 | Critical | 9.1 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authori… |
CVE-2026-71921 | Critical | 9.8 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by in… |
CVE-2026-71914 | Critical | 9.8 | 2026-08-24 | Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of… |
CVE-2026-78329 | Critical | 9.8 | 2026-08-24 | Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4… |
CVE-2026-77915 | Critical | 9.8 | 2026-08-24 | rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Admi… |
CVE-2026-71300 | Critical | 9.8 | 2026-08-24 | Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15… |
CVE-2026-66906 | Critical | 9.1 | 2026-08-24 | Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 b… |
CVE-2026-76071 | Critical | 9.8 | 2026-08-24 | Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved st… |
CVE-2026-76070 | Critical | 9.8 | 2026-08-24 | Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved st… |
CVE-2026-19874 | Critical | 9.1 | 2026-08-24 | A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked… |
CVE-2026-76840 | Critical | 9.6 | 2026-08-24 | RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer… |
CVE-2026-67602 | Critical | 9.1 | 2026-08-24 | phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploitin… |
CVE-2026-59568 | Critical | 9.1 | 2026-08-24 | Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability… |
CVE-2026-59564 | Critical | 9.1 | 2026-08-24 | An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal. |
CVE-2026-66650 | Critical | 9.8 | 2026-08-24 | Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions. |
CVE-2026-66648 | Critical | 9.8 | 2026-08-24 | Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions. |
CVE-2026-66587 | Critical | 9.8 | 2026-08-24 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-32558 | Critical | 9.8 | 2026-08-24 | Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions. |
CVE-2026-32551 | Critical | 9.3 | 2026-08-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue… |
CVE-2026-28165 | Critical | 9.8 | 2026-08-24 | Unauthenticated Privilege Escalation in Digits <= 9.2 versions. |
CVE-2026-66897 | Critical | 9.9 | 2026-08-24 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image… |
CVE-2026-78211 | Critical | 9.8 | 2026-08-24 | 4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious comma… |
CVE-2026-78169 | Critical | 9.9 | 2026-08-24 | A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the… |
CVE-2026-78168 | Critical | 9.8 | 2026-08-24 | A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Va… |
CVE-2026-78167 | Critical | 10.0 | 2026-08-24 | A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validatio… |
CVE-2026-78207 | Critical | 9.4 | 2026-08-24 | exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when… |
CVE-2026-78183 | Critical | 9.8 | 2026-08-23 | DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the… |
CVE-2026-8445 | Critical | 9.8 | 2026-08-23 | justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed do… |
CVE-2026-7808 | Critical | 9.8 | 2026-08-23 | justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitizatio… |
CVE-2026-5388 | Critical | 9.8 | 2026-08-23 | justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown pas… |
CVE-2026-78155 | Critical | 9.9 | 2026-08-23 | privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges |
CVE-2026-13598 | Critical | 9.8 | 2026-08-23 | The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to cre… |
CVE-2026-78050 | Critical | 9.9 | 2026-08-23 | A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET§ion=ntp_t… |
CVE-2026-74730 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was… |
CVE-2026-74727 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves t… |
CVE-2026-74723 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image… |
CVE-2026-74712 | Critical | 9.3 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following… |
CVE-2026-74705 | Critical | 10.0 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets… |
CVE-2026-74688 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() cach… |
CVE-2026-74669 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb… |
CVE-2026-74665 | Critical | 9.1 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-… |
CVE-2026-74662 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queu… |
CVE-2026-74628 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod… |
CVE-2026-74617 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add… |
CVE-2026-74616 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast co… |