Critical-severity CVEs (page 35)
Page 35 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6911 | Critical | 9.8 | 2026-04-24 | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the appli… |
CVE-2026-39920 | Critical | 9.8 | 2026-04-24 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default… |
CVE-2026-31669 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are l… |
CVE-2026-31668 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel us… |
CVE-2026-31659 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_dat… |
CVE-2026-31657 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace… |
CVE-2026-31649 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementatio… |
CVE-2026-31637 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RX… |
CVE-2026-31636 | Critical | 9.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth… |
CVE-2026-31633 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's… |
CVE-2026-31609 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_… |
CVE-2026-31608 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list… |
CVE-2026-31607 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receive… |
CVE-2026-31589 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_fre… |
CVE-2026-31536 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_se… |
CVE-2026-25660 | Critical | 9.8 | 2026-04-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the U… |
CVE-2026-21515 | Critical | 9.9 | 2026-04-24 | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network. |
CVE-2026-1952 | Critical | 9.8 | 2026-04-24 | Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability. |
CVE-2026-1951 | Critical | 9.8 | 2026-04-24 | Delta Electronics AS320T has no checking of the length of the buffer with the directory name vulnerability. |
CVE-2026-1950 | Critical | 9.8 | 2026-04-24 | Delta Electronics AS320T has No checking of the length of the buffer with the file name vulnerability. |
CVE-2026-1949 | Critical | 9.8 | 2026-04-24 | Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service. |
CVE-2026-33078 | Critical | 9.8 | 2026-04-24 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the hapr… |
CVE-2026-33076 | Critical | 9.8 | 2026-04-24 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a… |
CVE-2026-40630 | Critical | 9.8 | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control e… |
CVE-2026-40620 | Critical | 9.8 | 2026-04-24 | A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or aut… |
CVE-2026-35503 | Critical | 9.8 | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded val… |
CVE-2026-27843 | Critical | 9.1 | 2026-04-24 | A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentica… |
CVE-2026-25775 | Critical | 9.8 | 2026-04-24 | A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or author… |
CVE-2026-41274 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided inp… |
CVE-2026-35431 | Critical | 10.0 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-33819 | Critical | 10.0 | 2026-04-23 | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. |
CVE-2026-33102 | Critical | 9.3 | 2026-04-23 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32210 | Critical | 9.3 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26210 | Critical | 9.8 | 2026-04-23 | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTE… |
CVE-2026-24303 | Critical | 9.6 | 2026-04-23 | Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-6942 | Critical | 9.8 | 2026-04-23 | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing th… |
CVE-2026-41276 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, this vulnerability allows remote attackers to bypass a… |
CVE-2026-41268 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated re… |
CVE-2026-41265 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the… |
CVE-2026-41264 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the… |
CVE-2026-25874 | Critical | 9.8 | 2026-04-23 | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data receive… |
CVE-2026-6074 | Critical | 9.8 | 2026-04-23 | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs dow… |
CVE-2026-41247 | Critical | 9.8 | 2026-04-23 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in… |
CVE-2026-6920 | Critical | 9.6 | 2026-04-23 | Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-6919 | Critical | 9.6 | 2026-04-23 | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-31533 | Critical | 9.8 | 2026-04-23 | In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling… |
CVE-2026-31181 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter t… |
CVE-2026-31178 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to… |
CVE-2026-31177 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to… |
CVE-2026-31175 | Critical | 9.8 | 2026-04-23 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /c… |
CVE-2026-40472 | Critical | 9.9 | 2026-04-23 | In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Sc… |
CVE-2026-40471 | Critical | 9.6 | 2026-04-23 | hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, pos… |
CVE-2026-40470 | Critical | 9.9 | 2026-04-23 | A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation u… |
CVE-2026-23751 | Critical | 9.8 | 2026-04-23 | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 24… |
CVE-2025-62373 | Critical | 9.8 | 2026-04-23 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerabili… |
CVE-2025-50229 | Critical | 9.8 | 2026-04-23 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. |
CVE-2026-41460 | Critical | 9.8 | 2026-04-23 | SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via… |
CVE-2026-39440 | Critical | 9.9 | 2026-04-23 | Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects Funne… |
CVE-2026-6887 | Critical | 9.8 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to in… |
CVE-2026-6886 | Critical | 9.8 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attacke… |
CVE-2026-6885 | Critical | 9.8 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attack… |
CVE-2026-3960 | Critical | 9.8 | 2026-04-23 | A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vuln… |
CVE-2026-41229 | Critical | 9.1 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP st… |
CVE-2026-41228 | Critical | 9.9 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not valid… |
CVE-2026-3844 | Critical | 9.8 | 2026-04-23 | The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function… |
CVE-2026-41679 | Critical | 10.0 | 2026-04-23 | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker ca… |
CVE-2026-41211 | Critical | 10.0 | 2026-04-23 | Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and… |
CVE-2026-41196 | Critical | 10.0 | 2026-04-23 | Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially… |
CVE-2026-41179 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1… |
CVE-2026-41176 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without… |
CVE-2026-29198 | Critical | 9.8 | 2026-04-23 | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the firs… |
CVE-2026-41167 | Critical | 9.1 | 2026-04-22 | Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolatin… |
CVE-2026-33656 | Critical | 9.1 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating a… |
CVE-2026-33471 | Critical | 9.6 | 2026-04-22 | nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then… |
CVE-2026-34415 | Critical | 9.8 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP… |
CVE-2018-25272 | Critical | 9.8 | 2026-04-22 | ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM leve… |
CVE-2018-25270 | Critical | 9.8 | 2026-04-22 | ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions throug… |
CVE-2026-6356 | Critical | 9.6 | 2026-04-22 | A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, ena… |
CVE-2026-31501 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_p… |
CVE-2026-31478 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After th… |
CVE-2026-31463 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: iomap: fix invalid folio access when i_blkbits differs from I/O granularity Commit aa35dd… |
CVE-2026-31448 | Critical | 9.4 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping… |
CVE-2026-31444 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() smb_grant_oplock() has two… |
CVE-2026-31436 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() At the en… |
CVE-2026-6235 | Critical | 9.8 | 2026-04-22 | The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and in… |
CVE-2026-4119 | Critical | 9.1 | 2026-04-22 | The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post acti… |
CVE-2026-41304 | Critical | 9.8 | 2026-04-22 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands… |
CVE-2026-41064 | Critical | 9.3 | 2026-04-22 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget bu… |
CVE-2026-40575 | Critical | 9.1 | 2026-04-22 | OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri… |
CVE-2026-5845 | Critical | 9.6 | 2026-04-21 | An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to acc… |
CVE-2026-40933 | Critical | 9.9 | 2026-04-21 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the M… |
CVE-2026-40911 | Critical | 10.0 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies… |
CVE-2026-40906 | Critical | 9.9 | 2026-04-21 | Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injec… |
CVE-2026-40892 | Critical | 9.8 | 2026-04-21 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2… |
CVE-2026-34287 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34286 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34285 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34279 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are a… |
CVE-2026-34275 | Critical | 9.8 | 2026-04-21 | Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are a… |
CVE-2026-33519 | Critical | 9.8 | 2026-04-21 | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check per… |