Critical-severity CVEs (page 38)
Page 38 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-52656 | Critical | 9.8 | 2026-07-20 | An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a… |
CVE-2024-51315 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName |
CVE-2024-51314 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg. |
CVE-2024-51312 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg. |
CVE-2026-53595 | Critical | 9.4 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invi… |
CVE-2024-51313 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg. |
CVE-2024-51311 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList. |
CVE-2026-63767 | Critical | 9.8 | 2026-07-20 | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute… |
CVE-2026-63766 | Critical | 9.8 | 2026-07-20 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitiz… |
CVE-2026-44231 | Critical | 9.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information discl… |
CVE-2026-64193 | Critical | 9.8 | 2026-07-20 | Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXT… |
CVE-2026-62414 | Critical | 9.1 | 2026-07-20 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access contr… |
CVE-2026-39878 | Critical | 9.3 | 2026-07-20 | Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated atta… |
CVE-2026-54051 | Critical | 9.9 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy… |
CVE-2026-41252 | Critical | 9.8 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating i… |
CVE-2026-35048 | Critical | 9.8 | 2026-07-20 | The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file w… |
CVE-2026-51027 | Critical | 9.9 | 2026-07-20 | An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component. |
CVE-2026-46412 | Critical | 10.0 | 2026-07-20 | @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:5… |
CVE-2026-35198 | Critical | 9.0 | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privile… |
CVE-2026-63071 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malic… |
CVE-2026-62183 | Critical | 9.8 | 2026-07-20 | Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adap… |
CVE-2026-57308 | Critical | 9.8 | 2026-07-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitleme… |
CVE-2026-53421 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution th… |
CVE-2026-53405 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process defi… |
CVE-2026-12701 | Critical | 9.0 | 2026-07-20 | A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to… |
CVE-2026-64620 | Critical | 9.8 | 2026-07-20 | FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the mo… |
CVE-2026-16242 | Critical | 9.4 | 2026-07-20 | A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and… |
CVE-2026-16235 | Critical | 9.8 | 2026-07-20 | Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable… |
CVE-2026-13147 | Critical | 9.1 | 2026-07-20 | The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make th… |
CVE-2026-44359 | Critical | 10.0 | 2026-07-20 | Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggere… |
CVE-2026-64162 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev… |
CVE-2026-64160 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearin… |
CVE-2026-64150 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: release local_lock before re-enabling softirqs Quoting sashiko: In… |
CVE-2026-64142 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against m_fp_list lookups ksmbd_durable_scavenger()… |
CVE-2026-64136 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4… |
CVE-2026-64132 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_io… |
CVE-2026-64125 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_… |
CVE-2026-64122 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_time… |
CVE-2026-64113 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prune… |
CVE-2026-64106 | Critical | 9.0 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace ca… |
CVE-2026-64102 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connect… |
CVE-2026-64091 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated b… |
CVE-2026-64089 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was… |
CVE-2026-64080 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers curr… |
CVE-2026-64069 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a ne… |
CVE-2026-64068 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subreques… |
CVE-2026-64067 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of sub… |
CVE-2026-64066 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure Fix netfs_read_to_pagecac… |
CVE-2026-64061 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release… |
CVE-2026-64056 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragme… |
CVE-2026-64055 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assemble… |
CVE-2026-64047 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg s… |
CVE-2026-64046 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 (… |
CVE-2026-64037 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC no… |
CVE-2026-64035 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame()… |
CVE-2026-64034 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_han… |
CVE-2026-64033 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv… |
CVE-2026-64025 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() alre… |
CVE-2026-64024 | Critical | 9.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TI… |
CVE-2026-64018 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event… |
CVE-2026-64016 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds… |
CVE-2026-64007 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() re… |
CVE-2026-64000 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV he… |
CVE-2026-63994 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko… |
CVE-2026-63993 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_… |
CVE-2026-63992 | Critical | 9.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, ipt… |
CVE-2026-63984 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() com… |
CVE-2026-63979 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() rem… |
CVE-2026-63978 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_… |
CVE-2026-63940 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of l… |
CVE-2026-63939 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the len… |
CVE-2026-63938 | Critical | 9.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing… |
CVE-2026-63924 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim… |
CVE-2026-63922 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_he… |
CVE-2026-63912 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path append… |
CVE-2026-63888 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two lat… |
CVE-2026-63887 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_tex… |
CVE-2026-63886 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash… |
CVE-2026-63857 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit… |
CVE-2026-63830 | Critical | 9.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of th… |
CVE-2026-63825 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentat… |
CVE-2026-63808 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry()… |
CVE-2026-63800 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branc… |
CVE-2026-63795 | Critical | 10.0 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called w… |
CVE-2026-53399 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid in… |
CVE-2026-53398 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently i… |
CVE-2026-53384 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() reg… |
CVE-2026-16117 | Critical | 10.0 | 2026-07-18 | Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL… |
CVE-2026-47865 | Critical | 9.8 | 2026-07-18 | VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by b… |
CVE-2026-55518 | Critical | 9.6 | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<associati… |
CVE-2026-54159 | Critical | 10.0 | 2026-07-17 | PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filt… |
CVE-2026-52348 | Critical | 9.8 | 2026-07-17 | cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. |
CVE-2026-48062 | Critical | 9.8 | 2026-07-17 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIM… |
CVE-2026-13446 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenticatio… |
CVE-2026-8859 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the… |
CVE-2026-8635 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary s… |
CVE-2026-8505 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of a… |
CVE-2026-8481 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/cod… |
CVE-2026-8476 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses… |
CVE-2026-63030 | Critical | 9.8 | 2026-07-17 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Q… |