Critical-severity CVEs (page 20)
Page 20 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56067 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. |
CVE-2026-56062 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. |
CVE-2026-56059 | Critical | 9.9 | 2026-06-26 | Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions. |
CVE-2026-56058 | Critical | 9.9 | 2026-06-26 | Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions. |
CVE-2026-56057 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. |
CVE-2026-56036 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. |
CVE-2026-56034 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. |
CVE-2026-56033 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. |
CVE-2026-56032 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. |
CVE-2026-56030 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions. |
CVE-2026-56028 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions. |
CVE-2026-56027 | Critical | 9.9 | 2026-06-26 | Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions. |
CVE-2026-54831 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. |
CVE-2026-54827 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-54825 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. |
CVE-2026-54820 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. |
CVE-2025-64152 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 befo… |
CVE-2025-55017 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 befo… |
CVE-2026-57881 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is cau… |
CVE-2026-57880 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57879 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57878 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is ca… |
CVE-2026-48930 | Critical | 9.8 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings… |
CVE-2026-40702 | Critical | 9.4 | 2026-06-25 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weaknes… |
CVE-2025-71338 | Critical | 10.0 | 2026-06-25 | Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary… |
CVE-2025-71336 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which… |
CVE-2025-71334 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and ch… |
CVE-2025-71333 | Critical | 9.8 | 2026-06-25 | Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Att… |
CVE-2025-71327 | Critical | 9.1 | 2026-06-25 | Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create us… |
CVE-2026-56445 | Critical | 9.1 | 2026-06-25 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowin… |
CVE-2026-7531 | Critical | 9.8 | 2026-06-25 | Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a… |
CVE-2026-57700 | Critical | 10.0 | 2026-06-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through… |
CVE-2026-56786 | Critical | 9.8 | 2026-06-25 | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size… |
CVE-2026-54917 | Critical | 10.0 | 2026-06-25 | SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST cat… |
CVE-2026-54089 | Critical | 9.1 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc… |
CVE-2026-50549 | Critical | 9.8 | 2026-06-25 | Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent can… |
CVE-2026-50548 | Critical | 9.8 | 2026-06-25 | Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write… |
CVE-2026-6094 | Critical | 9.1 | 2026-06-25 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data… |
CVE-2026-54849 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. |
CVE-2026-54843 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. |
CVE-2026-54836 | Critical | 9.3 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC… |
CVE-2026-54823 | Critical | 9.9 | 2026-06-25 | Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions. |
CVE-2026-41120 | Critical | 9.8 | 2026-06-25 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged… |
CVE-2026-53260 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a w… |
CVE-2026-53247 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() ca… |
CVE-2026-53246 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening S… |
CVE-2026-53228 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inn… |
CVE-2026-53225 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sc… |
CVE-2026-53224 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie(… |
CVE-2026-53221 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an… |
CVE-2026-53216 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and… |
CVE-2026-53215 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current… |
CVE-2026-53186 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense… |
CVE-2026-53176 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert… |
CVE-2026-53175 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, f… |
CVE-2026-53151 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the r… |
CVE-2026-53131 | Critical | 9.4 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the… |
CVE-2026-40079 | Critical | 9.8 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization i… |
CVE-2026-39955 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALID… |
CVE-2026-39948 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw access… |
CVE-2026-39938 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC seri… |
CVE-2026-55570 | Critical | 9.0 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) whe… |
CVE-2026-55455 | Critical | 9.1 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by th… |
CVE-2026-55454 | Critical | 9.9 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authenti… |
CVE-2026-54158 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell con… |
CVE-2026-54067 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing </style> breaks out of its surrounding <style> tag w… |
CVE-2026-50551 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribu… |
CVE-2026-39893 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQ… |
CVE-2026-52813 | Critical | 10.0 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and reposit… |
CVE-2026-52806 | Critical | 9.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creati… |
CVE-2026-45689 | Critical | 9.1 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an u… |
CVE-2026-45688 | Critical | 9.1 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rock… |
CVE-2026-53943 | Critical | 9.6 | 2026-06-24 | Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared betwe… |
CVE-2026-49980 | Critical | 9.8 | 2026-06-24 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve a… |
CVE-2026-13032 | Critical | 9.6 | 2026-06-24 | Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-13028 | Critical | 9.6 | 2026-06-24 | Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-54906 | Critical | 9.8 | 2026-06-24 | concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread ac… |
CVE-2026-53088 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open… |
CVE-2026-53086 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down… |
CVE-2026-53055 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission… |
CVE-2026-53049 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions… |
CVE-2026-53046 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message… |
CVE-2026-53045 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory… |
CVE-2026-53043 | Critical | 9.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two… |
CVE-2026-53010 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to… |
CVE-2026-53006 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is prob… |
CVE-2026-53002 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes ar… |
CVE-2026-52999 | Critical | 9.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), th… |
CVE-2026-52993 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate… |
CVE-2026-52989 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nv… |
CVE-2026-52986 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epad… |
CVE-2026-52982 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN sla… |
CVE-2026-52958 | Critical | 9.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state an… |
CVE-2026-52955 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_… |
CVE-2026-56121 | Critical | 9.8 | 2026-06-24 | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by… |
CVE-2026-56111 | Critical | 9.1 | 2026-06-24 | Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, contains an out-of-bounds write vulnerability in the M421… |
CVE-2026-56237 | Critical | 9.1 | 2026-06-24 | Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the ba… |
CVE-2026-52931 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_… |
CVE-2026-52924 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked w… |
CVE-2026-52914 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload… |