Critical-severity CVEs (page 3)
Page 3 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75799 | Critical | 9.0 | 2026-09-23 | The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthe… |
CVE-2026-96257 | Critical | 10.0 | 2026-09-23 | A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service… |
CVE-2026-18169 | Critical | 9.9 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper valida… |
CVE-2026-18163 | Critical | 9.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrust… |
CVE-2026-18162 | Critical | 9.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-con… |
CVE-2026-17645 | Critical | 9.1 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege… |
CVE-2026-17635 | Critical | 9.1 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTT… |
CVE-2026-17472 | Critical | 9.6 | 2026-09-22 | IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC perm… |
CVE-2026-16346 | Critical | 9.9 | 2026-09-22 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
CVE-2026-89282 | Critical | 9.1 | 2026-09-22 | The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default in… |
CVE-2026-88624 | Critical | 9.1 | 2026-09-22 | Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted… |
CVE-2026-87121 | Critical | 9.8 | 2026-09-22 | lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device. |
CVE-2026-76709 | Critical | 9.8 | 2026-09-22 | A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could all… |
CVE-2026-76708 | Critical | 9.8 | 2026-09-22 | A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for… |
CVE-2026-47116 | Critical | 9.8 | 2026-09-22 | LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recove… |
CVE-2026-28324 | Critical | 9.8 | 2026-09-22 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity check… |
CVE-2026-88414 | Critical | 9.8 | 2026-09-22 | MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). |
CVE-2026-82000 | Critical | 9.6 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privilege… |
CVE-2026-81995 | Critical | 9.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-77254 | Critical | 9.1 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without… |
CVE-2026-75745 | Critical | 10.0 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2026-75698 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts int… |
CVE-2026-75697 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75689 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75686 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An at… |
CVE-2026-75684 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75682 | Critical | 9.9 | 2026-09-22 | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitra… |
CVE-2026-57149 | Critical | 9.9 | 2026-09-22 | plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting i… |
CVE-2026-37604 | Critical | 9.8 | 2026-09-22 | pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP an… |
CVE-2026-89276 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-89275 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-84412 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-83660 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this… |
CVE-2026-82443 | Critical | 9.6 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged atta… |
CVE-2026-82013 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged atta… |
CVE-2026-82011 | Critical | 9.1 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-82010 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-82009 | Critical | 9.1 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-82008 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-77244 | Critical | 10.0 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests witho… |
CVE-2026-75728 | Critical | 9.1 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-75723 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-75721 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-75703 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-75699 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-73369 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exec… |
CVE-2026-43641 | Critical | 9.8 | 2026-09-22 | Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticat… |
CVE-2026-94456 | Critical | 9.1 | 2026-09-22 | Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access to… |
CVE-2026-86059 | Critical | 9.6 | 2026-09-22 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintex… |
CVE-2026-85734 | Critical | 9.1 | 2026-09-22 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a… |
CVE-2026-80156 | Critical | 9.1 | 2026-09-22 | Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLC… |
CVE-2026-80155 | Critical | 10.0 | 2026-09-22 | Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLC… |
CVE-2026-80154 | Critical | 9.6 | 2026-09-22 | All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web m… |
CVE-2026-80152 | Critical | 9.1 | 2026-09-22 | Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLC… |
CVE-2026-80151 | Critical | 9.1 | 2026-09-22 | Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLC… |
CVE-2026-80147 | Critical | 9.9 | 2026-09-22 | Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a sta… |
CVE-2026-80146 | Critical | 9.9 | 2026-09-22 | Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a sta… |
CVE-2026-80145 | Critical | 9.1 | 2026-09-22 | Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a com… |
CVE-2026-80144 | Critical | 9.9 | 2026-09-22 | Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a com… |
CVE-2026-80143 | Critical | 9.9 | 2026-09-22 | Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a com… |
CVE-2026-94127 | Critical | 9.8 | 2026-09-22 | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). Th… |
CVE-2026-93088 | Critical | 9.8 | 2026-09-22 | SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionSe… |
CVE-2026-84388 | Critical | 9.6 | 2026-09-22 | A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all… |
CVE-2026-79313 | Critical | 9.8 | 2026-09-22 | webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead… |
CVE-2026-65113 | Critical | 9.8 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this v… |
CVE-2026-95675 | Critical | 9.8 | 2026-09-22 | D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbit… |
CVE-2026-12718 | Critical | 9.8 | 2026-09-22 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows… |
CVE-2026-93616 | Critical | 9.8 | 2026-09-22 | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. |
CVE-2026-74849 | Critical | 9.8 | 2026-09-22 | Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client. |
CVE-2026-25254 | Critical | 9.8 | 2026-09-22 | Improper authorization leads to Remote Code Execution via SocketIO interface. |
CVE-2026-93952 | Critical | 10.0 | 2026-09-22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2026-87080 | Critical | 9.1 | 2026-09-22 | Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-… |
CVE-2026-87078 | Critical | 9.1 | 2026-09-22 | Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the s… |
CVE-2016-15059 | Critical | 9.8 | 2026-09-22 | Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend… |
CVE-2026-19658 | Critical | 9.8 | 2026-09-22 | The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input… |
CVE-2026-13355 | Critical | 9.8 | 2026-09-22 | The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained… |
CVE-2026-94493 | Critical | 10.0 | 2026-09-22 | A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebS… |
CVE-2026-78847 | Critical | 9.8 | 2026-09-21 | An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/… |
CVE-2026-88405 | Critical | 9.8 | 2026-09-21 | A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha… |
CVE-2026-88404 | Critical | 9.8 | 2026-09-21 | A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha… |
CVE-2026-88402 | Critical | 9.8 | 2026-09-21 | A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL s… |
CVE-2026-79916 | Critical | 9.1 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access… |
CVE-2026-77521 | Critical | 10.0 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellB… |
CVE-2026-67827 | Critical | 9.8 | 2026-09-21 | Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated… |
CVE-2026-58491 | Critical | 9.3 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attack… |
CVE-2026-93012 | Critical | 9.8 | 2026-09-21 | Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches… |
CVE-2026-79920 | Critical | 9.9 | 2026-09-21 | Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, Un… |
CVE-2026-85751 | Critical | 9.8 | 2026-09-21 | Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH… |
CVE-2026-36469 | Critical | 9.1 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionali… |
CVE-2026-94301 | Critical | 9.8 | 2026-09-21 | The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 an… |
CVE-2026-86473 | Critical | 9.1 | 2026-09-21 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as a… |
CVE-2026-82187 | Critical | 9.8 | 2026-09-21 | The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those… |
CVE-2026-94101 | Critical | 9.9 | 2026-09-21 | A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/… |
CVE-2026-94100 | Critical | 9.9 | 2026-09-21 | A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the componen… |
CVE-2026-94099 | Critical | 9.9 | 2026-09-21 | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component… |
CVE-2026-94098 | Critical | 9.1 | 2026-09-21 | A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component… |
CVE-2026-94097 | Critical | 10.0 | 2026-09-21 | A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI… |
CVE-2026-94096 | Critical | 9.9 | 2026-09-21 | A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the… |
CVE-2026-94095 | Critical | 9.9 | 2026-09-21 | A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_t… |
CVE-2026-94089 | Critical | 10.0 | 2026-09-20 | A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authen… |