Critical-severity CVEs (page 3)
Page 3 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18948 | Critical | 9.9 | 2026-08-10 | A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' libra… |
CVE-2026-14450 | Critical | 9.9 | 2026-08-10 | A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, speci… |
CVE-2026-72902 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local… |
CVE-2026-72901 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary comm… |
CVE-2026-72886 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/router… |
CVE-2026-72882 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service… |
CVE-2026-72880 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.t… |
CVE-2026-72878 | Critical | 9.6 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly in… |
CVE-2026-72877 | Critical | 9.6 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in b… |
CVE-2026-72876 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in… |
CVE-2026-72872 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepositor… |
CVE-2026-72869 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName par… |
CVE-2026-72868 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, sec… |
CVE-2026-72867 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/s… |
CVE-2026-72865 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/s… |
CVE-2026-72864 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/dock… |
CVE-2026-72863 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate… |
CVE-2026-72899 | Critical | 10.0 | 2026-08-10 | Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. |
CVE-2026-72898 | Critical | 10.0 | 2026-08-10 | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the con… |
CVE-2026-72862 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokpl… |
CVE-2026-72740 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGi… |
CVE-2026-72738 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/ba… |
CVE-2026-72737 | Critical | 9.6 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/do… |
CVE-2026-72736 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquote… |
CVE-2026-72735 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts s… |
CVE-2026-72733 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore she… |
CVE-2026-47754 | Critical | 9.3 | 2026-08-10 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unau… |
CVE-2026-18412 | Critical | 9.1 | 2026-08-10 | OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files… |
CVE-2026-63106 | Critical | 9.8 | 2026-08-10 | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products end… |
CVE-2026-68426 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leave… |
CVE-2026-68388 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range(… |
CVE-2026-68385 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without vector facility Currently csum_partial() calls… |
CVE-2026-68381 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_… |
CVE-2026-68343 | Critical | 9.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the… |
CVE-2026-68302 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths… |
CVE-2026-68300 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() retu… |
CVE-2026-68170 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb->sk reference on subflow close The backlog list is updated by mptcp_… |
CVE-2026-68161 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-n… |
CVE-2026-68160 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() ceph_handle_caps… |
CVE-2026-68159 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp()… |
CVE-2026-68158 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type… |
CVE-2026-68156 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_author… |
CVE-2026-68154 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for dev… |
CVE-2026-68144 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pep_get_sb() pep_get_sb() doesn't consider that pskb_m… |
CVE-2026-68137 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25_kill_by_neigh() x25_kill_by_neigh() walks the global X… |
CVE-2026-68136 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix… |
CVE-2026-68127 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport(… |
CVE-2026-68124 | Critical | 9.6 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial rec… |
CVE-2026-68123 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently store… |
CVE-2026-68117 | Critical | 9.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() When tipc_sk_create()… |
CVE-2026-13206 | Critical | 9.8 | 2026-08-10 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection… |
CVE-2026-68083 | Critical | 9.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbd_vfs_kern_path_create The SMB2 open lookup is rooted a… |
CVE-2026-72593 | Critical | 9.8 | 2026-08-10 | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality… |
CVE-2026-72592 | Critical | 9.8 | 2026-08-10 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server… |
CVE-2026-72590 | Critical | 9.8 | 2026-08-10 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries b… |
CVE-2026-72589 | Critical | 9.8 | 2026-08-10 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands b… |
CVE-2026-72580 | Critical | 9.8 | 2026-08-10 | An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smar… |
CVE-2026-72577 | Critical | 9.8 | 2026-08-10 | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station ho… |
CVE-2026-72575 | Critical | 9.1 | 2026-08-10 | An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup record… |
CVE-2026-72569 | Critical | 9.1 | 2026-08-10 | A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the inten… |
CVE-2026-72567 | Critical | 9.8 | 2026-08-10 | An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arb… |
CVE-2026-72565 | Critical | 9.8 | 2026-08-10 | A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary da… |
CVE-2026-72564 | Critical | 9.6 | 2026-08-10 | An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organi… |
CVE-2026-55799 | Critical | 9.8 | 2026-08-10 | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this i… |
CVE-2026-44416 | Critical | 9.8 | 2026-08-10 | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to vers… |
CVE-2026-42537 | Critical | 9.8 | 2026-08-10 | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-40920 | Critical | 9.8 | 2026-08-10 | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this iss… |
CVE-2026-32227 | Critical | 9.8 | 2026-08-10 | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue. |
CVE-2026-28672 | Critical | 9.8 | 2026-08-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6… |
CVE-2026-19089 | Critical | 9.8 | 2026-08-10 | The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, whi… |
CVE-2026-19053 | Critical | 9.1 | 2026-08-10 | The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticate… |
CVE-2026-16299 | Critical | 9.8 | 2026-08-10 | The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the p… |
CVE-2026-16298 | Critical | 9.8 | 2026-08-10 | The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password… |
CVE-2026-19348 | Critical | 9.8 | 2026-08-09 | A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt… |
CVE-2026-18473 | Critical | 9.1 | 2026-08-09 | The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injec… |
CVE-2026-15038 | Critical | 9.8 | 2026-08-09 | The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-manageme… |
CVE-2026-71993 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute ar… |
CVE-2026-71992 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute… |
CVE-2026-71991 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allow… |
CVE-2026-71990 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows r… |
CVE-2026-71989 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute… |
CVE-2026-71988 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arb… |
CVE-2026-71987 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitr… |
CVE-2026-71986 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitr… |
CVE-2026-71985 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to exec… |
CVE-2026-71984 | Critical | 9.8 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute… |
CVE-2026-71983 | Critical | 9.8 | 2026-08-08 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute a… |
CVE-2026-71958 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi inter… |
CVE-2026-71957 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A… |
CVE-2026-71956 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface… |
CVE-2026-71955 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc in… |
CVE-2026-71954 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71953 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71952 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71951 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71950 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71949 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71948 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71947 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71946 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |