Critical-severity CVEs (page 25)
Page 25 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72226 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of… |
CVE-2026-72222 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback svc_tcp_handshake() s… |
CVE-2026-72221 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When wait_for_co… |
CVE-2026-72220 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rq_procinfo lifecycle to prevent double-free The svc_release_rqst() functi… |
CVE-2026-72217 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing xdr_buf_to_bvec() writes a bi… |
CVE-2026-72211 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfs_ir_reparent() moves the re… |
CVE-2026-72210 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfs_mapping_pairs_decomp… |
CVE-2026-72209 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfs_attr_find() and ntfs_external_attr_find()… |
CVE-2026-72208 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfs_ea_lookup and ntfs_listxattr… |
CVE-2026-72207 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfs_resident_attr_resize()… |
CVE-2026-72206 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfs_index_block_inconsisent() to… |
CVE-2026-72201 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading… |
CVE-2026-72200 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumul… |
CVE-2026-72199 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEX_ROOT values carry ind… |
CVE-2026-72194 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow indx_find_buffer(… |
CVE-2026-72192 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head indx_insert_into_roo… |
CVE-2026-72191 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indx_insert_into_buffer indx_insert_into_buffer() c… |
CVE-2026-72188 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() ntfs_lookup_inode… |
CVE-2026-72186 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitma… |
CVE-2026-72185 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock() When ntfs_map_runli… |
CVE-2026-72139 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig_info kfree past RCU grace period in tcp_connect The md5+ao reconciliati… |
CVE-2026-72137 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xfrm: nat_keepalive: avoid double free on send error nat_keepalive_send() frees the keepa… |
CVE-2026-72130 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUT… |
CVE-2026-72129 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the… |
CVE-2026-72098 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-… |
CVE-2026-72085 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback_get_p… |
CVE-2026-72084 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_s… |
CVE-2026-72083 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate… |
CVE-2026-72069 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() rt_spin_unlock() release… |
CVE-2026-72065 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length repo… |
CVE-2026-72064 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragm… |
CVE-2026-72046 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath progra… |
CVE-2026-72041 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consi… |
CVE-2026-72033 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill_from_part() fill_from_part() compute… |
CVE-2026-72020 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Commit 9a05475cebdd ("ipvs: avoid km… |
CVE-2026-72014 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv_dless_read() receives a… |
CVE-2026-68477 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrec… |
CVE-2026-68476 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writ… |
CVE-2026-68457 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SET_SPARSE, SET_ZERO_DATA and SET_COMPR… |
CVE-2026-15341 | Critical | 9.8 | 2026-08-15 | The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4… |
CVE-2026-15303 | Critical | 9.8 | 2026-08-15 | The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_creat… |
CVE-2026-14484 | Critical | 9.1 | 2026-08-15 | The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validati… |
CVE-2026-17186 | Critical | 9.9 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a c… |
CVE-2026-17184 | Critical | 9.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path. |
CVE-2026-17182 | Critical | 9.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validat… |
CVE-2026-17181 | Critical | 9.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal. |
CVE-2026-73678 | Critical | 10.0 | 2026-08-14 | MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to exec… |
CVE-2026-50027 | Critical | 9.8 | 2026-08-14 | mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served wi… |
CVE-2026-49457 | Critical | 9.1 | 2026-08-14 | erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The Cer… |
CVE-2026-19188 | Critical | 10.0 | 2026-08-14 | A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check fea… |
CVE-2026-73849 | Critical | 9.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the… |
CVE-2026-48528 | Critical | 9.8 | 2026-08-14 | Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated… |
CVE-2026-19682 | Critical | 9.9 | 2026-08-14 | A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on… |
CVE-2026-19681 | Critical | 9.9 | 2026-08-14 | An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading… |
CVE-2026-19626 | Critical | 9.9 | 2026-08-14 | A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could expl… |
CVE-2026-72811 | Critical | 10.0 | 2026-08-14 | SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored bloc… |
CVE-2026-12949 | Critical | 9.8 | 2026-08-14 | The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3… |
CVE-2026-73843 | Critical | 9.6 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing mana… |
CVE-2026-73842 | Critical | 9.0 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api… |
CVE-2026-72851 | Critical | 10.0 | 2026-08-13 | Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST at… |
CVE-2026-72850 | Critical | 9.1 | 2026-08-13 | Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved d… |
CVE-2026-72842 | Critical | 9.9 | 2026-08-13 | luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes with… |
CVE-2026-72841 | Critical | 9.9 | 2026-08-13 | luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write a… |
CVE-2026-72839 | Critical | 9.8 | 2026-08-13 | filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated at… |
CVE-2026-72776 | Critical | 9.8 | 2026-08-13 | AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary com… |
CVE-2026-8715 | Critical | 9.6 | 2026-08-13 | Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration… |
CVE-2026-19297 | Critical | 9.1 | 2026-08-13 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive auth… |
CVE-2026-17482 | Critical | 9.8 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths. |
CVE-2026-73656 | Critical | 9.9 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-w… |
CVE-2026-19747 | Critical | 9.8 | 2026-08-13 | A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAt… |
CVE-2026-14525 | Critical | 9.4 | 2026-08-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when th… |
CVE-2026-73653 | Critical | 9.4 | 2026-08-13 | Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreensh… |
CVE-2026-73649 | Critical | 9.8 | 2026-08-13 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __p… |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-73567 | Critical | 9.1 | 2026-08-13 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKe… |
CVE-2026-67614 | Critical | 9.8 | 2026-08-13 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to f… |
CVE-2026-58508 | Critical | 9.1 | 2026-08-13 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
CVE-2026-58443 | Critical | 9.1 | 2026-08-13 | Public-only repository tokens can update private PR head branches |
CVE-2026-58433 | Critical | 9.1 | 2026-08-13 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
CVE-2026-56750 | Critical | 9.1 | 2026-08-13 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
CVE-2026-56654 | Critical | 9.8 | 2026-08-13 | Privilege Escalation via Access Token Scope Escalation in API |
CVE-2026-56443 | Critical | 9.6 | 2026-08-13 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 |
CVE-2026-55982 | Critical | 9.1 | 2026-08-13 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
CVE-2026-13051 | Critical | 9.1 | 2026-08-13 | Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy… |
CVE-2022-4993 | Critical | 9.1 | 2026-08-13 | HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use er… |
CVE-2026-73533 | Critical | 9.8 | 2026-08-13 | Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server… |
CVE-2026-73532 | Critical | 9.8 | 2026-08-13 | Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server… |
CVE-2026-53791 | Critical | 9.1 | 2026-08-13 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by send… |
CVE-2026-66691 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. |
CVE-2026-66478 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. |
CVE-2026-66472 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. |
CVE-2026-66465 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. |
CVE-2026-66458 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. |
CVE-2026-66453 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. |
CVE-2026-66446 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions. |
CVE-2026-66436 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. |
CVE-2026-66424 | Critical | 9.8 | 2026-08-13 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. |
CVE-2026-61969 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. |
CVE-2026-61967 | Critical | 9.8 | 2026-08-13 | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. |
CVE-2026-61966 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. |