Critical-severity CVEs (page 30)
Page 30 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69264 | Critical | 9.8 | 2026-08-04 | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then e… |
CVE-2026-24254 | Critical | 9.8 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit… |
CVE-2026-69263 | Critical | 9.8 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes… |
CVE-2026-69258 | Critical | 9.1 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoi… |
CVE-2026-63456 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2026-63455 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2025-29296 | Critical | 9.8 | 2026-08-04 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C… |
CVE-2026-69110 | Critical | 9.1 | 2026-08-04 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the te… |
CVE-2026-69098 | Critical | 9.8 | 2026-08-04 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiat… |
CVE-2026-25289 | Critical | 9.6 | 2026-08-04 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. |
CVE-2026-61515 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrar… |
CVE-2026-61514 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device funct… |
CVE-2026-10050 | Critical | 9.1 | 2026-08-04 | In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specifi… |
CVE-2026-15721 | Critical | 9.8 | 2026-08-04 | Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injecti… |
CVE-2026-14804 | Critical | 9.1 | 2026-08-04 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Con… |
CVE-2026-14175 | Critical | 9.8 | 2026-08-04 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload… |
CVE-2026-18754 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-18753 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-64564 | Critical | 9.8 | 2026-08-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() ca… |
CVE-2026-16618 | Critical | 9.8 | 2026-08-04 | The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the… |
CVE-2026-15958 | Critical | 9.3 | 2026-08-04 | The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it al… |
CVE-2026-18686 | Critical | 9.8 | 2026-08-04 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component… |
CVE-2026-18685 | Critical | 9.8 | 2026-08-04 | A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component mod… |
CVE-2026-48333 | Critical | 9.8 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this… |
CVE-2026-48331 | Critical | 10.0 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this… |
CVE-2026-48330 | Critical | 10.0 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-48326 | Critical | 9.9 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-48323 | Critical | 10.0 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitra… |
CVE-2026-48317 | Critical | 9.6 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could… |
CVE-2026-18684 | Critical | 9.8 | 2026-08-03 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem… |
CVE-2026-18667 | Critical | 9.6 | 2026-08-03 | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an a… |
CVE-2026-69240 | Critical | 9.8 | 2026-08-03 | Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-s… |
CVE-2026-52102 | Critical | 9.8 | 2026-08-03 | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via inj… |
CVE-2026-51775 | Critical | 9.8 | 2026-08-03 | SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php compon… |
CVE-2026-51190 | Critical | 9.8 | 2026-08-03 | The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in "… |
CVE-2026-68980 | Critical | 9.1 | 2026-08-03 | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authoriz… |
CVE-2026-68979 | Critical | 9.8 | 2026-08-03 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Par… |
CVE-2026-48031 | Critical | 9.1 | 2026-08-03 | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hard… |
CVE-2026-38447 | Critical | 9.8 | 2026-08-03 | osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current… |
CVE-2026-18616 | Critical | 9.8 | 2026-08-03 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component… |
CVE-2026-18615 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of… |
CVE-2026-18614 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Na… |
CVE-2026-18613 | Critical | 9.8 | 2026-08-03 | A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component p… |
CVE-2026-18612 | Critical | 9.8 | 2026-08-03 | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi… |
CVE-2026-41452 | Critical | 9.8 | 2026-08-03 | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the prim… |
CVE-2026-39932 | Critical | 9.1 | 2026-08-03 | OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authe… |
CVE-2026-18602 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the comp… |
CVE-2026-18248 | Critical | 9.1 | 2026-08-03 | @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are docum… |
CVE-2026-9487 | Critical | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the Sign… |
CVE-2026-9390 | Critical | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concate… |
CVE-2026-69085 | Critical | 10.0 | 2026-08-03 | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenat… |
CVE-2026-69084 | Critical | 10.0 | 2026-08-03 | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan… |
CVE-2026-69083 | Critical | 10.0 | 2026-08-03 | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish R… |
CVE-2026-64827 | Critical | 9.8 | 2026-08-03 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where… |
CVE-2026-18601 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-c… |
CVE-2026-18108 | Critical | 9.8 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content… |
CVE-2026-2346 | Critical | 9.8 | 2026-08-03 | Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile… |
CVE-2026-18589 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument… |
CVE-2026-18588 | Critical | 9.8 | 2026-08-03 | A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONT… |
CVE-2026-16534 | Critical | 9.1 | 2026-08-03 | The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV i… |
CVE-2026-16532 | Critical | 9.1 | 2026-08-03 | The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthentic… |
CVE-2026-16300 | Critical | 9.8 | 2026-08-03 | The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of ar… |
CVE-2026-16250 | Critical | 9.8 | 2026-08-03 | The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthe… |
CVE-2026-16060 | Critical | 9.8 | 2026-08-03 | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a… |
CVE-2026-15930 | Critical | 9.4 | 2026-08-03 | The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user… |
CVE-2026-14557 | Critical | 9.1 | 2026-08-03 | The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification… |
CVE-2026-12965 | Critical | 9.1 | 2026-08-03 | The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing un… |
CVE-2026-12872 | Critical | 9.8 | 2026-08-03 | The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capabil… |
CVE-2026-58062 | Critical | 9.1 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Jav… |
CVE-2026-8763 | Critical | 9.1 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2026-59650 | Critical | 9.1 | 2026-08-03 | In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73… |
CVE-2026-65321 | Critical | 9.8 | 2026-08-02 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-esca… |
CVE-2026-68579 | Critical | 9.6 | 2026-08-02 | FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprd… |
CVE-2026-16256 | Critical | 9.8 | 2026-08-02 | The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that c… |
CVE-2026-8457 | Critical | 9.8 | 2026-08-02 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin… |
CVE-2026-67342 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that f… |
CVE-2026-67341 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database a… |
CVE-2026-67330 | Critical | 9.9 | 2026-08-01 | @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypas… |
CVE-2026-67324 | Critical | 9.8 | 2026-08-01 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-opt… |
CVE-2026-67308 | Critical | 10.0 | 2026-08-01 | Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull… |
CVE-2026-67289 | Critical | 9.8 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress fie… |
CVE-2026-66402 | Critical | 9.8 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hos… |
CVE-2026-15964 | Critical | 9.8 | 2026-08-01 | The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including… |
CVE-2026-13596 | Critical | 9.1 | 2026-08-01 | The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allow… |
CVE-2026-3141 | Critical | 9.1 | 2026-08-01 | The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/at… |
CVE-2026-68771 | Critical | 9.8 | 2026-07-31 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitr… |
CVE-2026-52134 | Critical | 9.8 | 2026-07-31 | An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame. |
CVE-2026-68770 | Critical | 9.8 | 2026-07-31 | sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in… |
CVE-2026-51785 | Critical | 9.8 | 2026-07-31 | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request |
CVE-2026-38713 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-38708 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2025-69948 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. |
CVE-2025-69946 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and wa… |
CVE-2026-38711 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-54725 | Critical | 9.6 | 2026-07-31 | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhoo… |
CVE-2026-21662 | Critical | 9.8 | 2026-07-31 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Syst… |
CVE-2026-67822 | Critical | 9.8 | 2026-07-31 | Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to c… |
CVE-2026-52855 | Critical | 9.9 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configura… |
CVE-2026-17566 | Critical | 9.9 | 2026-07-31 | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the ren… |
CVE-2026-17351 | Critical | 9.0 | 2026-07-31 | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exa… |