Critical-severity CVEs (page 18)
Page 18 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55116 | Critical | 9.0 | 2026-07-02 | A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain d… |
CVE-2026-55115 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate pri… |
CVE-2026-54402 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command… |
CVE-2026-54400 | Critical | 9.1 | 2026-07-02 | A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to es… |
CVE-2026-50748 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-50747 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Appli… |
CVE-2026-50746 | Critical | 10.0 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Inj… |
CVE-2026-4767 | Critical | 9.8 | 2026-07-02 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v… |
CVE-2026-5524 | Critical | 9.8 | 2026-07-02 | The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. T… |
CVE-2026-57683 | Critical | 9.3 | 2026-07-02 | Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions. |
CVE-2026-57679 | Critical | 9.3 | 2026-07-02 | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. |
CVE-2026-57677 | Critical | 9.8 | 2026-07-02 | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions. |
CVE-2026-57625 | Critical | 9.6 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions. |
CVE-2026-57624 | Critical | 10.0 | 2026-07-02 | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions. |
CVE-2026-57623 | Critical | 9.0 | 2026-07-02 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. |
CVE-2026-57621 | Critical | 9.8 | 2026-07-02 | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. |
CVE-2026-27436 | Critical | 9.1 | 2026-07-02 | Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions. |
CVE-2026-27419 | Critical | 9.9 | 2026-07-02 | Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. |
CVE-2026-14425 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14424 | Critical | 9.6 | 2026-07-01 | Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-14423 | Critical | 9.6 | 2026-07-01 | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14420 | Critical | 9.6 | 2026-07-01 | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT… |
CVE-2026-14419 | Critical | 9.6 | 2026-07-01 | Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14417 | Critical | 9.6 | 2026-07-01 | Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14416 | Critical | 9.6 | 2026-07-01 | Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (… |
CVE-2026-14411 | Critical | 9.6 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-14405 | Critical | 9.6 | 2026-07-01 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-14398 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14397 | Critical | 9.6 | 2026-07-01 | Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-14392 | Critical | 9.6 | 2026-07-01 | Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-14390 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14387 | Critical | 9.6 | 2026-07-01 | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Ch… |
CVE-2026-14382 | Critical | 9.6 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-52186 | Critical | 9.8 | 2026-07-01 | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component |
CVE-2026-58457 | Critical | 9.8 | 2026-07-01 | Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers… |
CVE-2026-14363 | Critical | 9.8 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-53492 | Critical | 9.6 | 2026-07-01 | containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interfac… |
CVE-2026-51947 | Critical | 9.8 | 2026-07-01 | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a… |
CVE-2026-50195 | Critical | 9.9 | 2026-07-01 | containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it… |
CVE-2026-50160 | Critical | 10.0 | 2026-07-01 | Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/on… |
CVE-2026-58521 | Critical | 9.8 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-58453 | Critical | 9.8 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to g… |
CVE-2026-34117 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/t… |
CVE-2026-34116 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcri… |
CVE-2026-34115 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/t… |
CVE-2026-34114 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/tran… |
CVE-2026-34113 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec(\"php jobs/speech_… |
CVE-2026-34112 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_au… |
CVE-2026-34111 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/spee… |
CVE-2026-34110 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/compl… |
CVE-2026-34109 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio… |
CVE-2026-34108 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$l… |
CVE-2026-34107 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate… |
CVE-2026-34106 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_… |
CVE-2026-34105 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, ty… |
CVE-2026-34104 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\"… |
CVE-2026-34103 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FR… |
CVE-2026-34102 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\… |
CVE-2026-34101 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, d… |
CVE-2026-34100 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, durat… |
CVE-2026-34099 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET[… |
CVE-2026-58127 | Critical | 9.8 | 2026-07-01 | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemot… |
CVE-2026-58126 | Critical | 9.8 | 2026-07-01 | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by expl… |
CVE-2026-58025 | Critical | 9.8 | 2026-07-01 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiIm… |
CVE-2026-57517 | Critical | 9.8 | 2026-07-01 | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries… |
CVE-2026-24270 | Critical | 9.8 | 2026-07-01 | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit of this vulnerability might lead to denia… |
CVE-2025-23351 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-23350 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-15646 | Critical | 9.8 | 2026-07-01 | HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, bu… |
CVE-2026-23537 | Critical | 9.1 | 2026-07-01 | A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary J… |
CVE-2026-57692 | Critical | 9.8 | 2026-07-01 | Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2. |
CVE-2026-53355 | Critical | 9.8 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so… |
CVE-2026-14198 | Critical | 9.1 | 2026-07-01 | @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underl… |
CVE-2026-11387 | Critical | 9.8 | 2026-07-01 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account… |
CVE-2026-10539 | Critical | 9.0 | 2026-07-01 | A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauth… |
CVE-2026-7840 | Critical | 9.8 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in… |
CVE-2026-7839 | Critical | 9.1 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when setting… |
CVE-2026-6070 | Critical | 9.1 | 2026-07-01 | The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to in… |
CVE-2026-56700 | Critical | 9.8 | 2026-06-30 | Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapte… |
CVE-2026-56415 | Critical | 10.0 | 2026-06-30 | Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attac… |
CVE-2026-56413 | Critical | 10.0 | 2026-06-30 | Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts… |
CVE-2026-56278 | Critical | 9.1 | 2026-06-30 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRES… |
CVE-2026-55721 | Critical | 9.3 | 2026-06-30 | Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incor… |
CVE-2026-50110 | Critical | 9.2 | 2026-06-30 | Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are… |
CVE-2026-14152 | Critical | 9.6 | 2026-06-30 | Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-14121 | Critical | 9.8 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic… |
CVE-2026-14120 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2026-14113 | Critical | 9.6 | 2026-06-30 | Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-14109 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-14106 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere… |
CVE-2026-14104 | Critical | 9.8 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside… |
CVE-2026-14101 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-14097 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-14095 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potent… |
CVE-2026-14093 | Critical | 9.6 | 2026-06-30 | Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-14056 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14055 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the… |
CVE-2026-14044 | Critical | 9.6 | 2026-06-30 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-14043 | Critical | 9.6 | 2026-06-30 | Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-14038 | Critical | 9.3 | 2026-06-30 | Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer p… |