Critical-severity CVEs (page 32)
Page 32 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45091 | Critical | 9.1 | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 throu… |
CVE-2026-41551 | Critical | 9.1 | 2026-05-12 | A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properl… |
CVE-2026-25787 | Critical | 9.1 | 2026-05-12 | Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This… |
CVE-2026-25786 | Critical | 9.1 | 2026-05-12 | Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow… |
CVE-2026-22924 | Critical | 9.1 | 2026-05-12 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections a… |
CVE-2025-6577 | Critical | 9.8 | 2026-05-12 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce… |
CVE-2025-40949 | Critical | 9.1 | 2026-05-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (Al… |
CVE-2026-34263 | Critical | 9.6 | 2026-05-12 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary s… |
CVE-2026-34260 | Critical | 9.6 | 2026-05-12 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements th… |
CVE-2026-45321 | Critical | 9.6 | 2026-05-12 | On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishe… |
CVE-2026-43900 | Critical | 9.3 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS)… |
CVE-2026-43899 | Critical | 9.6 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for… |
CVE-2026-42882 | Critical | 9.4 | 2026-05-11 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation… |
CVE-2026-42869 | Critical | 10.0 | 2026-05-11 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded… |
CVE-2026-42864 | Critical | 9.9 | 2026-05-11 | FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable withou… |
CVE-2026-43995 | Critical | 9.8 | 2026-05-11 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invo… |
CVE-2026-38567 | Critical | 9.8 | 2026-05-11 | HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without paramet… |
CVE-2026-7813 | Critical | 9.9 | 2026-05-11 | Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple en… |
CVE-2026-44643 | Critical | 10.0 | 2026-05-11 | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression… |
CVE-2026-42613 | Critical | 9.4 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields… |
CVE-2026-42608 | Critical | 9.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sess… |
CVE-2026-42607 | Critical | 9.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploa… |
CVE-2026-40636 | Critical | 9.8 | 2026-05-11 | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenti… |
CVE-2021-47940 | Critical | 9.8 | 2026-05-10 | WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload m… |
CVE-2021-47936 | Critical | 9.8 | 2026-05-10 | OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP fi… |
CVE-2021-47933 | Critical | 9.8 | 2026-05-10 | WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requ… |
CVE-2021-47932 | Critical | 9.8 | 2026-05-10 | WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitt… |
CVE-2021-47923 | Critical | 9.8 | 2026-05-10 | OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie… |
CVE-2026-6104 | Critical | 9.1 | 2026-05-10 | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related… |
CVE-2026-7261 | Critical | 9.8 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESS… |
CVE-2026-6722 | Critical | 9.8 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stor… |
CVE-2025-14179 | Critical | 9.8 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes whe… |
CVE-2026-42601 | Critical | 9.8 | 2026-05-09 | ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config J… |
CVE-2026-42569 | Critical | 9.4 | 2026-05-09 | phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a lega… |
CVE-2026-42257 | Critical | 9.8 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP comma… |
CVE-2026-42560 | Critical | 9.1 | 2026-05-09 | auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps eve… |
CVE-2026-44313 | Critical | 9.1 | 2026-05-09 | Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. Prior to version 2.13.0, a Server-Side Reque… |
CVE-2026-42454 | Critical | 9.9 | 2026-05-08 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container mana… |
CVE-2026-42354 | Critical | 9.1 | 2026-05-08 | Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML… |
CVE-2026-42302 | Critical | 9.8 | 2026-05-08 | FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticat… |
CVE-2026-42298 | Critical | 10.0 | 2026-05-08 | Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github… |
CVE-2026-42193 | Critical | 9.1 | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads fro… |
CVE-2026-44694 | Critical | 9.1 | 2026-05-08 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2… |
CVE-2026-42072 | Critical | 9.8 | 2026-05-08 | Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, th… |
CVE-2026-41889 | Critical | 9.8 | 2026-05-08 | pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted st… |
CVE-2026-38360 | Critical | 9.8 | 2026-05-08 | Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/… |
CVE-2026-41070 | Critical | 10.0 | 2026-05-08 | openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to… |
CVE-2026-44497 | Critical | 9.1 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a… |
CVE-2026-43465 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can… |
CVE-2026-43414 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is s… |
CVE-2026-43407 | Critical | 9.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes… |
CVE-2026-43406 | Critical | 9.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() If the message… |
CVE-2026-43402 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread exit paths to prevent use-after-free Guillaume reported cras… |
CVE-2026-43384 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need t… |
CVE-2026-43383 | Critical | 9.4 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need… |
CVE-2026-43379 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() opinfo pointer obtained… |
CVE-2026-43378 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_derefe… |
CVE-2026-43376 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd currently frees oploc… |
CVE-2026-41588 | Critical | 9.0 | 2026-05-08 | RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue h… |
CVE-2026-41583 | Critical | 9.1 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to val… |
CVE-2026-41574 | Critical | 9.8 | 2026-05-08 | Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost a… |
CVE-2026-37431 | Critical | 9.8 | 2026-05-08 | Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoi… |
CVE-2026-44336 | Critical | 9.6 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-han… |
CVE-2026-44335 | Critical | 9.8 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, l… |
CVE-2026-43341 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() s… |
CVE-2026-43304 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key m… |
CVE-2026-41512 | Critical | 9.9 | 2026-05-08 | ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via… |
CVE-2026-41509 | Critical | 9.8 | 2026-05-08 | CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer… |
CVE-2026-41507 | Critical | 9.8 | 2026-05-08 | math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new… |
CVE-2026-41497 | Critical | 9.8 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument vali… |
CVE-2026-25199 | Critical | 9.1 | 2026-05-08 | Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from… |
CVE-2026-8153 | Critical | 9.8 | 2026-05-08 | OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands tha… |
CVE-2013-10075 | Critical | 9.1 | 2026-05-08 | Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_Fil… |
CVE-2025-69691 | Critical | 9.9 | 2026-05-08 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available… |
CVE-2025-69690 | Critical | 9.1 | 2026-05-08 | Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_command… |
CVE-2025-69599 | Critical | 9.8 | 2026-05-08 | RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. NOTE: this is disp… |
CVE-2025-67887 | Critical | 9.8 | 2026-05-08 | 1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code b… |
CVE-2023-46453 | Critical | 9.8 | 2026-05-08 | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid S… |
CVE-2024-51092 | Critical | 9.1 | 2026-05-08 | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController… |
CVE-2026-43944 | Critical | 9.6 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbit… |
CVE-2026-43941 | Critical | 9.6 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler p… |
CVE-2026-42208 | Critical | 9.8 | 2026-05-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used duri… |
CVE-2026-41501 | Critical | 9.8 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in g… |
CVE-2026-41500 | Critical | 9.8 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in g… |
CVE-2026-42880 | Critical | 9.6 | 2026-05-07 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing au… |
CVE-2026-8034 | Critical | 9.8 | 2026-05-07 | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal s… |
CVE-2026-7891 | Critical | 9.1 | 2026-05-07 | A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior o… |
CVE-2026-42826 | Critical | 10.0 | 2026-05-07 | Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network. |
CVE-2026-35428 | Critical | 9.6 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing ov… |
CVE-2026-33844 | Critical | 9.0 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-33823 | Critical | 9.6 | 2026-05-07 | Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. |
CVE-2026-33109 | Critical | 9.9 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-41902 | Critical | 9.1 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-chara… |
CVE-2026-37709 | Critical | 9.8 | 2026-05-07 | Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute ar… |
CVE-2026-7415 | Critical | 9.8 | 2026-05-07 | The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same net… |
CVE-2026-7414 | Critical | 9.8 | 2026-05-07 | Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running… |
CVE-2025-63704 | Critical | 9.8 | 2026-05-07 | NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges th… |
CVE-2025-63703 | Critical | 9.8 | 2026-05-07 | npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). |
CVE-2026-36458 | Critical | 9.8 | 2026-05-07 | ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a… |
CVE-2025-63706 | Critical | 9.8 | 2026-05-07 | NPM package next-npm-version1.0.1 is vulnerable to Command injection. |