Critical-severity CVEs (page 4)
Page 4 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71945 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-71944 | Critical | 9.8 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/for… |
CVE-2026-68082 | Critical | 9.8 | 2026-08-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_cli… |
CVE-2026-14526 | Critical | 9.8 | 2026-08-08 | The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the p… |
CVE-2026-46409 | Critical | 9.6 | 2026-08-07 | OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backe… |
CVE-2026-48170 | Critical | 9.1 | 2026-08-07 | `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object co… |
CVE-2026-50540 | Critical | 9.6 | 2026-08-07 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to ve… |
CVE-2026-61808 | Critical | 9.8 | 2026-08-07 | LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentic… |
CVE-2026-48039 | Critical | 9.1 | 2026-08-07 | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `… |
CVE-2026-71851 | Critical | 9.0 | 2026-08-07 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a cust… |
CVE-2026-64637 | Critical | 9.9 | 2026-08-07 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root use… |
CVE-2026-19264 | Critical | 9.8 | 2026-08-07 | Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory an… |
CVE-2022-4995 | Critical | 9.8 | 2026-08-07 | Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary fil… |
CVE-2026-71560 | Critical | 9.1 | 2026-08-07 | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing s… |
CVE-2026-71558 | Critical | 9.8 | 2026-08-07 | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input pa… |
CVE-2026-16258 | Critical | 9.8 | 2026-08-07 | The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP… |
CVE-2026-16038 | Critical | 9.1 | 2026-08-07 | The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-c… |
CVE-2026-14205 | Critical | 9.8 | 2026-08-07 | The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the… |
CVE-2026-14365 | Critical | 9.8 | 2026-08-07 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2… |
CVE-2026-14364 | Critical | 9.8 | 2026-08-07 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all… |
CVE-2026-70332 | Critical | 9.6 | 2026-08-07 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-68823 | Critical | 9.1 | 2026-08-07 | Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network. |
CVE-2026-65667 | Critical | 10.0 | 2026-08-07 | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-63508 | Critical | 10.0 | 2026-08-07 | Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62896 | Critical | 9.6 | 2026-08-07 | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. |
CVE-2026-62873 | Critical | 9.8 | 2026-08-07 | Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62830 | Critical | 9.9 | 2026-08-07 | Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. |
CVE-2026-59118 | Critical | 9.3 | 2026-08-07 | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-59115 | Critical | 9.9 | 2026-08-07 | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. |
CVE-2026-56162 | Critical | 10.0 | 2026-08-07 | Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-56161 | Critical | 9.6 | 2026-08-07 | Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. |
CVE-2026-50515 | Critical | 9.9 | 2026-08-07 | Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. |
CVE-2026-50481 | Critical | 9.9 | 2026-08-07 | Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70558 | Critical | 9.8 | 2026-08-06 | Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path… |
CVE-2026-67689 | Critical | 9.8 | 2026-08-06 | SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpo… |
CVE-2026-67688 | Critical | 9.8 | 2026-08-06 | ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execu… |
CVE-2026-67622 | Critical | 9.9 | 2026-08-06 | Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to ac… |
CVE-2026-65400 | Critical | 9.8 | 2026-08-06 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An… |
CVE-2026-53984 | Critical | 9.1 | 2026-08-06 | Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_ba… |
CVE-2026-48088 | Critical | 9.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenant… |
CVE-2026-48087 | Critical | 9.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at… |
CVE-2026-48086 | Critical | 9.9 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes the… |
CVE-2026-48085 | Critical | 9.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenRec… |
CVE-2026-3418 | Critical | 9.1 | 2026-08-06 | The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to… |
CVE-2026-19175 | Critical | 9.6 | 2026-08-06 | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-19171 | Critical | 9.6 | 2026-08-06 | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-19170 | Critical | 9.6 | 2026-08-06 | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-19166 | Critical | 9.6 | 2026-08-06 | Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-19164 | Critical | 9.6 | 2026-08-06 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape… |
CVE-2026-19157 | Critical | 9.6 | 2026-08-06 | Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafte… |
CVE-2026-19149 | Critical | 9.6 | 2026-08-06 | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML p… |
CVE-2026-18367 | Critical | 9.3 | 2026-08-06 | A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos… |
CVE-2026-17032 | Critical | 9.8 | 2026-08-06 | Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deplo… |
CVE-2026-15734 | Critical | 9.8 | 2026-08-06 | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as roo… |
CVE-2026-15733 | Critical | 9.8 | 2026-08-06 | A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to exe… |
CVE-2026-15732 | Critical | 9.8 | 2026-08-06 | A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to… |
CVE-2026-14812 | Critical | 10.0 | 2026-08-06 | The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enabl… |
CVE-2026-11976 | Critical | 10.0 | 2026-08-06 | The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the ve… |
CVE-2025-14561 | Critical | 9.0 | 2026-08-06 | In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privil… |
CVE-2026-67261 | Critical | 9.8 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component… |
CVE-2026-66709 | Critical | 9.1 | 2026-08-06 | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. |
CVE-2026-66665 | Critical | 10.0 | 2026-08-06 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. |
CVE-2026-66662 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-66447 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. |
CVE-2026-65581 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. |
CVE-2026-65579 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. |
CVE-2026-65578 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. |
CVE-2026-65577 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. |
CVE-2026-65576 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. |
CVE-2026-65575 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. |
CVE-2026-65574 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. |
CVE-2026-65573 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. |
CVE-2026-65572 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. |
CVE-2026-65571 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. |
CVE-2026-65556 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. |
CVE-2026-65553 | Critical | 10.0 | 2026-08-06 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. |
CVE-2026-65552 | Critical | 9.8 | 2026-08-06 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. |
CVE-2026-65548 | Critical | 9.9 | 2026-08-06 | Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. |
CVE-2026-65546 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. |
CVE-2026-65520 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. |
CVE-2026-65508 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. |
CVE-2026-65507 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. |
CVE-2026-54489 | Critical | 9.1 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthe… |
CVE-2026-53976 | Critical | 9.1 | 2026-08-06 | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticate… |
CVE-2026-53975 | Critical | 9.8 | 2026-08-06 | OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending… |
CVE-2026-34191 | Critical | 9.1 | 2026-08-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provid… |
CVE-2026-32327 | Critical | 9.1 | 2026-08-06 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the… |
CVE-2026-28139 | Critical | 9.8 | 2026-08-06 | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. |
CVE-2026-28005 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions. |
CVE-2026-5134 | Critical | 9.8 | 2026-08-06 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows… |
CVE-2026-12605 | Critical | 9.6 | 2026-08-06 | In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if th… |
CVE-2026-68079 | Critical | 9.8 | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementati… |
CVE-2026-65583 | Critical | 9.1 | 2026-08-06 | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and s… |
CVE-2026-63687 | Critical | 9.1 | 2026-08-06 | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive paramet… |
CVE-2026-61466 | Critical | 9.1 | 2026-08-06 | In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration… |
CVE-2026-66909 | Critical | 9.8 | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any at… |
CVE-2026-64597 | Critical | 9.8 | 2026-08-06 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return… |
CVE-2026-5430 | Critical | 10.0 | 2026-08-06 | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a… |
CVE-2026-1728 | Critical | 9.8 | 2026-08-06 | Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this… |
CVE-2025-15039 | Critical | 9.4 | 2026-08-06 | The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific… |