Critical-severity CVEs (page 29)
Page 29 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45988 | Critical | 9.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failur… |
CVE-2026-45972 | Critical | 9.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and… |
CVE-2026-45898 | Critical | 9.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/… |
CVE-2026-42761 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-42758 | Critical | 9.8 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This issue affects Webina… |
CVE-2026-42757 | Critical | 9.9 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allow… |
CVE-2026-42756 | Critical | 9.9 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & C… |
CVE-2026-42755 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQ… |
CVE-2026-42748 | Critical | 9.9 | 2026-05-27 | Unrestricted Upload of File with Dangerous Type vulnerability in WPify WPify Woo Czech wpify-woo allows Upload a Web Shell to a Web Server.This issue affects W… |
CVE-2026-42747 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows… |
CVE-2026-42740 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.Thi… |
CVE-2026-42731 | Critical | 9.8 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affec… |
CVE-2026-42727 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-49002 | Critical | 9.1 | 2026-05-27 | Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond t… |
CVE-2025-12686 | Critical | 9.8 | 2026-05-27 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote… |
CVE-2026-8760 | Critical | 9.8 | 2026-05-27 | The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for… |
CVE-2026-8450 | Critical | 9.1 | 2026-05-27 | HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-a… |
CVE-2026-44985 | Critical | 9.6 | 2026-05-26 | Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *htt… |
CVE-2026-44451 | Critical | 9.3 | 2026-05-26 | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with… |
CVE-2026-44450 | Critical | 9.9 | 2026-05-26 | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary n… |
CVE-2026-44449 | Critical | 9.1 | 2026-05-26 | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename… |
CVE-2026-44444 | Critical | 9.1 | 2026-05-26 | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag befo… |
CVE-2026-48689 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hp… |
CVE-2026-3660 | Critical | 9.8 | 2026-05-26 | IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow th… |
CVE-2026-9170 | Critical | 9.8 | 2026-05-26 | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation. |
CVE-2026-8633 | Critical | 9.8 | 2026-05-26 | IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liber… |
CVE-2026-7251 | Critical | 9.8 | 2026-05-26 | Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with r… |
CVE-2026-46624 | Critical | 9.9 | 2026-05-26 | Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection… |
CVE-2026-44668 | Critical | 9.8 | 2026-05-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 action… |
CVE-2026-48904 | Critical | 9.8 | 2026-05-26 | An improper access check allows privelege escalation through the com_users group editing webservice endpoint. |
CVE-2026-48902 | Critical | 9.8 | 2026-05-26 | The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. |
CVE-2026-48899 | Critical | 9.8 | 2026-05-26 | An improper access check allows privilege escalation through the com_users batch task. |
CVE-2026-48898 | Critical | 9.8 | 2026-05-26 | An improper access check allows privilege escalation through the com_users batch task. |
CVE-2026-48691 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce… |
CVE-2026-45721 | Critical | 9.0 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index f… |
CVE-2026-40383 | Critical | 9.8 | 2026-05-26 | An improper validation of user-supplied input leads to a local file inclusion vulnerability. |
CVE-2026-35223 | Critical | 9.8 | 2026-05-26 | An improper access check allows unauthorized access to com_config webservice endpoints. |
CVE-2026-35222 | Critical | 9.8 | 2026-05-26 | Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. |
CVE-2026-35221 | Critical | 9.8 | 2026-05-26 | Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. |
CVE-2026-48687 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/… |
CVE-2026-48686 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The functio… |
CVE-2026-4480 | Critical | 9.0 | 2026-05-26 | A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command"… |
CVE-2026-45247 | Critical | 9.8 | 2026-05-26 | Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to ach… |
CVE-2026-9543 | Critical | 9.8 | 2026-05-26 | A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-7374 | Critical | 9.9 | 2026-05-26 | A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to… |
CVE-2026-42496 | Critical | 9.1 | 2026-05-26 | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the… |
CVE-2026-8376 | Critical | 9.8 | 2026-05-26 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk i… |
CVE-2026-42774 | Critical | 9.3 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue af… |
CVE-2026-42773 | Critical | 9.3 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Inject… |
CVE-2026-9478 | Critical | 9.8 | 2026-05-25 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the compo… |
CVE-2026-9477 | Critical | 9.8 | 2026-05-25 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cg… |
CVE-2026-9476 | Critical | 9.8 | 2026-05-25 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-9475 | Critical | 9.8 | 2026-05-25 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the compone… |
CVE-2026-9458 | Critical | 9.8 | 2026-05-25 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-9457 | Critical | 9.8 | 2026-05-25 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cg… |
CVE-2026-9456 | Critical | 9.8 | 2026-05-25 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnCfg of the file /cgi-bin/cstecgi.cgi of the component Web… |
CVE-2026-9455 | Critical | 9.8 | 2026-05-25 | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-9454 | Critical | 9.8 | 2026-05-25 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi… |
CVE-2026-9436 | Critical | 9.8 | 2026-05-25 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-9435 | Critical | 9.8 | 2026-05-25 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-9434 | Critical | 9.8 | 2026-05-25 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-9433 | Critical | 9.8 | 2026-05-25 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of t… |
CVE-2026-9432 | Critical | 9.8 | 2026-05-25 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setWiFiAdvancedCfg of the file /cgi-bin/cs… |
CVE-2026-2651 | Critical | 9.0 | 2026-05-25 | A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. T… |
CVE-2026-9408 | Critical | 9.8 | 2026-05-25 | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cg… |
CVE-2026-9407 | Critical | 9.8 | 2026-05-25 | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setFirewallType of the file… |
CVE-2026-9406 | Critical | 9.8 | 2026-05-25 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-9405 | Critical | 9.8 | 2026-05-25 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-9404 | Critical | 9.8 | 2026-05-24 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-9388 | Critical | 9.8 | 2026-05-24 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-9387 | Critical | 9.8 | 2026-05-24 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-9386 | Critical | 9.8 | 2026-05-24 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the compone… |
CVE-2026-9385 | Critical | 9.8 | 2026-05-24 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-9384 | Critical | 9.8 | 2026-05-24 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2018-25357 | Critical | 9.8 | 2026-05-23 | Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code thr… |
CVE-2018-25350 | Critical | 9.8 | 2026-05-23 | userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to th… |
CVE-2026-47280 | Critical | 10.0 | 2026-05-22 | Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-42901 | Critical | 10.0 | 2026-05-22 | Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41104 | Critical | 10.0 | 2026-05-22 | Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network. |
CVE-2026-41090 | Critical | 9.3 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-40412 | Critical | 10.0 | 2026-05-22 | Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network. |
CVE-2026-40411 | Critical | 9.9 | 2026-05-22 | Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network. |
CVE-2026-33843 | Critical | 9.1 | 2026-05-22 | Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a n… |
CVE-2026-23652 | Critical | 10.0 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code ov… |
CVE-2026-33712 | Critical | 10.0 | 2026-05-22 | Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) allows unauthe… |
CVE-2026-32253 | Critical | 9.8 | 2026-05-22 | Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because o… |
CVE-2026-39821 | Critical | 9.6 | 2026-05-22 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") i… |
CVE-2026-8670 | Critical | 9.6 | 2026-05-22 | Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue aff… |
CVE-2026-44930 | Critical | 9.8 | 2026-05-22 | An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates fr… |
CVE-2026-46595 | Critical | 10.0 | 2026-05-22 | Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key… |
CVE-2026-42508 | Critical | 9.1 | 2026-05-22 | Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @re… |
CVE-2026-39834 | Critical | 9.1 | 2026-05-22 | When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop… |
CVE-2026-39833 | Critical | 9.1 | 2026-05-22 | The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without an… |
CVE-2026-39832 | Critical | 9.1 | 2026-05-22 | When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrict… |
CVE-2026-39831 | Critical | 9.1 | 2026-05-22 | The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Sign… |
CVE-2026-39830 | Critical | 9.1 | 2026-05-22 | A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine cou… |
CVE-2026-9264 | Critical | 9.3 | 2026-05-22 | A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through malic… |
CVE-2026-34910 | Critical | 10.0 | 2026-05-22 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. |
CVE-2026-34909 | Critical | 10.0 | 2026-05-22 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system th… |
CVE-2026-34908 | Critical | 10.0 | 2026-05-22 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to t… |