Critical-severity CVEs (page 20)
Page 20 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73993 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. |
CVE-2026-73992 | Critical | 9.9 | 2026-08-20 | Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. |
CVE-2026-68566 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. |
CVE-2026-66682 | Critical | 9.8 | 2026-08-20 | Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. |
CVE-2026-66680 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. |
CVE-2026-66672 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. |
CVE-2026-66649 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. |
CVE-2026-66609 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. |
CVE-2026-66600 | Critical | 9.1 | 2026-08-20 | Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions. |
CVE-2026-66593 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions. |
CVE-2026-66592 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions. |
CVE-2026-66583 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions. |
CVE-2025-15689 | Critical | 9.8 | 2026-08-20 | Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions. |
CVE-2025-15688 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Capella <= 2.5.5 versions. |
CVE-2026-11861 | Critical | 9.6 | 2026-08-20 | A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for… |
CVE-2026-14950 | Critical | 9.8 | 2026-08-20 | An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increas… |
CVE-2026-75860 | Critical | 9.8 | 2026-08-20 | The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and… |
CVE-2026-76850 | Critical | 9.8 | 2026-08-19 | LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-… |
CVE-2026-76590 | Critical | 9.9 | 2026-08-19 | A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the c… |
CVE-2026-76589 | Critical | 9.9 | 2026-08-19 | A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument s… |
CVE-2026-76404 | Critical | 9.1 | 2026-08-19 | In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. Th… |
CVE-2026-76312 | Critical | 9.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a p… |
CVE-2026-76311 | Critical | 9.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch ar… |
CVE-2026-76310 | Critical | 9.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated… |
CVE-2026-76584 | Critical | 9.9 | 2026-08-19 | A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time… |
CVE-2026-75595 | Critical | 9.1 | 2026-08-19 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode… |
CVE-2026-53548 | Critical | 9.6 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/passwor… |
CVE-2026-53546 | Critical | 9.6 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a… |
CVE-2026-53545 | Critical | 9.8 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect… |
CVE-2026-63722 | Critical | 9.8 | 2026-08-19 | ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining… |
CVE-2026-55089 | Critical | 9.9 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authoriz… |
CVE-2026-55085 | Critical | 9.6 | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list… |
CVE-2026-22306 | Critical | 10.0 | 2026-08-19 | Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulner… |
CVE-2026-19508 | Critical | 9.8 | 2026-08-19 | Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated at… |
CVE-2026-19505 | Critical | 9.8 | 2026-08-19 | Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentic… |
CVE-2026-16919 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers. |
CVE-2026-16917 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow. |
CVE-2026-16913 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. |
CVE-2026-16903 | Critical | 9.6 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code or cause a denial of service due to an out-of-bounds writ… |
CVE-2026-16894 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. |
CVE-2026-16885 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. |
CVE-2026-16882 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements us… |
CVE-2026-16872 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. |
CVE-2026-16864 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. |
CVE-2026-16862 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. |
CVE-2026-16845 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. |
CVE-2026-16840 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. |
CVE-2026-16839 | Critical | 9.4 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options… |
CVE-2026-16834 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow. |
CVE-2026-16822 | Critical | 9.3 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate… |
CVE-2026-70496 | Critical | 9.9 | 2026-08-19 | A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other enti… |
CVE-2026-18315 | Critical | 9.8 | 2026-08-19 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Acc… |
CVE-2026-16835 | Critical | 9.6 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in… |
CVE-2026-16687 | Critical | 9.6 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability i… |
CVE-2026-66794 | Critical | 9.3 | 2026-08-19 | A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can a… |
CVE-2026-63633 | Critical | 9.8 | 2026-08-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainin… |
CVE-2026-55194 | Critical | 9.8 | 2026-08-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the… |
CVE-2026-55191 | Critical | 9.8 | 2026-08-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend ca… |
CVE-2026-32475 | Critical | 9.0 | 2026-08-19 | Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from… |
CVE-2026-75143 | Critical | 9.8 | 2026-08-19 | FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and… |
CVE-2026-72530 | Critical | 9.0 | 2026-08-19 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlie… |
CVE-2026-72529 | Critical | 9.8 | 2026-08-19 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlie… |
CVE-2026-71470 | Critical | 9.1 | 2026-08-19 | A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fi… |
CVE-2026-49441 | Critical | 9.1 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of… |
CVE-2026-48162 | Critical | 9.1 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_… |
CVE-2026-48024 | Critical | 9.1 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() i… |
CVE-2026-20359 | Critical | 9.9 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-20358 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-20357 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-20318 | Critical | 9.6 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-20317 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-20315 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-20231 | Critical | 9.9 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-20030 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-71960 | Critical | 9.1 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin… |
CVE-2026-53451 | Critical | 9.8 | 2026-08-19 | Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthent… |
CVE-2026-52889 | Critical | 9.8 | 2026-08-19 | Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, C… |
CVE-2026-47187 | Critical | 9.3 | 2026-08-19 | SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative… |
CVE-2026-16816 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of speci… |
CVE-2026-16656 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication. |
CVE-2026-15068 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of s… |
CVE-2026-15065 | Critical | 9.1 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate… |
CVE-2026-51366 | Critical | 9.9 | 2026-08-19 | SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and… |
CVE-2026-16019 | Critical | 9.8 | 2026-08-19 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injec… |
CVE-2026-73391 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions. |
CVE-2026-73390 | Critical | 9.8 | 2026-08-19 | Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions. |
CVE-2026-73389 | Critical | 9.8 | 2026-08-19 | Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions. |
CVE-2026-73388 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions. |
CVE-2026-73364 | Critical | 9.8 | 2026-08-19 | Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions. |
CVE-2026-73347 | Critical | 9.8 | 2026-08-19 | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions. |
CVE-2026-73185 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions. |
CVE-2026-73183 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions. |
CVE-2026-66613 | Critical | 9.8 | 2026-08-19 | Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions. |
CVE-2026-19490 | Critical | 9.8 | 2026-08-19 | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through… |
CVE-2026-72889 | Critical | 9.8 | 2026-08-19 | Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the sig… |
CVE-2026-58082 | Critical | 9.8 | 2026-08-19 | The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10… |
CVE-2026-58081 | Critical | 9.8 | 2026-08-19 | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted char… |
CVE-2026-18937 | Critical | 9.0 | 2026-08-19 | The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowin… |
CVE-2026-18776 | Critical | 9.8 | 2026-08-19 | The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change t… |
CVE-2026-18051 | Critical | 10.0 | 2026-08-19 | The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attac… |