Critical-severity CVEs (page 19)
Page 19 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74612 | Critical | 10.0 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fra… |
CVE-2026-74611 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->… |
CVE-2026-74608 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels()… |
CVE-2026-74597 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error… |
CVE-2026-74591 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: mm/filemap: __filemap_add_folio() restore index before retrying In __filemap_add_folio()'… |
CVE-2026-74588 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx()… |
CVE-2026-74587 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding… |
CVE-2026-74586 | Critical | 9.8 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly… |
CVE-2026-4703 | Critical | 9.8 | 2026-08-22 | The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 vi… |
CVE-2026-75870 | Critical | 9.1 | 2026-08-22 | Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword… |
CVE-2026-75866 | Critical | 9.1 | 2026-08-22 | Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path read… |
CVE-2026-77946 | Critical | 10.0 | 2026-08-22 | A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cg… |
CVE-2026-78003 | Critical | 9.8 | 2026-08-22 | The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. Th… |
CVE-2026-77002 | Critical | 9.8 | 2026-08-22 | The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing u… |
CVE-2026-77001 | Critical | 9.8 | 2026-08-22 | The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks… |
CVE-2026-77000 | Critical | 9.8 | 2026-08-22 | The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authentic… |
CVE-2026-49849 | Critical | 9.1 | 2026-08-21 | xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to up… |
CVE-2026-76904 | Critical | 9.8 | 2026-08-21 | GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL In… |
CVE-2026-62283 | Critical | 9.9 | 2026-08-21 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9… |
CVE-2026-61539 | Critical | 10.0 | 2026-08-21 | Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-… |
CVE-2026-77810 | Critical | 9.9 | 2026-08-21 | In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for… |
CVE-2026-62674 | Critical | 9.0 | 2026-08-21 | Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_E… |
CVE-2026-74581 | Critical | 9.8 | 2026-08-21 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed rout… |
CVE-2026-69502 | Critical | 10.0 | 2026-08-21 | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-77087 | Critical | 9.6 | 2026-08-21 | Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An att… |
CVE-2026-63343 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrar… |
CVE-2026-63125 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity wi… |
CVE-2026-62941 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`Allo… |
CVE-2026-62940 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configurat… |
CVE-2026-62867 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume… |
CVE-2026-48769 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image serv… |
CVE-2026-48755 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to arg… |
CVE-2026-48753 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows cre… |
CVE-2026-48752 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/wri… |
CVE-2026-48751 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting… |
CVE-2026-48750 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores t… |
CVE-2026-48749 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files… |
CVE-2026-77806 | Critical | 9.8 | 2026-08-21 | SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injectio… |
CVE-2026-77776 | Critical | 9.1 | 2026-08-21 | Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handl… |
CVE-2026-77683 | Critical | 9.9 | 2026-08-21 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§i… |
CVE-2026-77086 | Critical | 9.1 | 2026-08-21 | SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform pa… |
CVE-2026-62440 | Critical | 9.1 | 2026-08-21 | Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster whil… |
CVE-2026-61398 | Critical | 9.1 | 2026-08-21 | Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache C… |
CVE-2026-59085 | Critical | 9.1 | 2026-08-21 | Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache C… |
CVE-2026-77264 | Critical | 9.8 | 2026-08-21 | The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versi… |
CVE-2026-77651 | Critical | 9.8 | 2026-08-21 | The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that… |
CVE-2026-77650 | Critical | 9.8 | 2026-08-21 | The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependenc… |
CVE-2026-77649 | Critical | 9.8 | 2026-08-21 | The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency tha… |
CVE-2026-77647 | Critical | 9.8 | 2026-08-20 | SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect ide… |
CVE-2026-72843 | Critical | 9.8 | 2026-08-20 | The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes… |
CVE-2026-69851 | Critical | 9.9 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69836 | Critical | 10.0 | 2026-08-20 | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. |
CVE-2026-69555 | Critical | 10.0 | 2026-08-20 | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69400 | Critical | 9.6 | 2026-08-20 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-68789 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-68782 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-66309 | Critical | 9.1 | 2026-08-20 | Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network. |
CVE-2026-65816 | Critical | 10.0 | 2026-08-20 | Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-65801 | Critical | 10.0 | 2026-08-20 | Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-65770 | Critical | 10.0 | 2026-08-20 | Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attack… |
CVE-2026-63509 | Critical | 9.9 | 2026-08-20 | Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. |
CVE-2026-62834 | Critical | 9.3 | 2026-08-20 | Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-18835 | Critical | 9.9 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of speci… |
CVE-2026-17422 | Critical | 9.3 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. |
CVE-2026-17160 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation. |
CVE-2026-17157 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. |
CVE-2026-17152 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
CVE-2026-17145 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management. |
CVE-2026-17142 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication. |
CVE-2026-17141 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
CVE-2026-17136 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability. |
CVE-2026-17122 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. |
CVE-2026-17118 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability. |
CVE-2026-17040 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
CVE-2026-71485 | Critical | 9.1 | 2026-08-20 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map t… |
CVE-2026-67567 | Critical | 9.9 | 2026-08-20 | A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resou… |
CVE-2026-43798 | Critical | 9.8 | 2026-08-20 | A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any appli… |
CVE-2026-77148 | Critical | 9.9 | 2026-08-20 | A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of… |
CVE-2026-19586 | Critical | 9.8 | 2026-08-20 | A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient va… |
CVE-2026-73257 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Conte… |
CVE-2026-73256 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by se… |
CVE-2026-73253 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can… |
CVE-2026-73251 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a m… |
CVE-2026-77022 | Critical | 9.9 | 2026-08-20 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&s… |
CVE-2026-71428 | Critical | 9.3 | 2026-08-20 | The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many mo… |
CVE-2026-55642 | Critical | 9.8 | 2026-08-20 | dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to… |
CVE-2026-18265 | Critical | 9.8 | 2026-08-20 | OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-63039 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the stri… |
CVE-2026-63038 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrar… |
CVE-2026-63037 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the… |
CVE-2026-16926 | Critical | 9.1 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in… |
CVE-2026-15706 | Critical | 9.8 | 2026-08-20 | Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (B… |
CVE-2026-28164 | Critical | 9.6 | 2026-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addon… |
CVE-2026-18482 | Critical | 9.8 | 2026-08-20 | Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSynta… |
CVE-2026-77071 | Critical | 9.8 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations… |
CVE-2026-77070 | Critical | 9.8 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the… |
CVE-2026-74018 | Critical | 9.9 | 2026-08-20 | Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. |
CVE-2026-74016 | Critical | 9.9 | 2026-08-20 | Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. |
CVE-2026-74014 | Critical | 9.9 | 2026-08-20 | Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. |
CVE-2026-74001 | Critical | 9.8 | 2026-08-20 | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. |